lumma | hxxps://sites[.]google[.]com/view/exlauncher69/download

Analysis

max time kernel
228s
max time network
230s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 20:35

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://sites.google.com/view/exlauncher69/download

Score

10^/10

lumma discovery evasion persistence ransomware stealer trojan

Malware Config

Extracted

Family

lumma

https://robinsharez.shop/api

https://handscreamny.shop/api

https://chipdonkeruz.shop/api

https://versersleep.shop/api

https://crowdwarek.shop/api

https://apporholis.shop/api

https://femalsabler.shop/api

https://soundtappysk.shop/api

https://jumplilltk.cfd/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Executes dropped EXE 2 IoCs

pid	Process
5648	[x86-х64]_Helper_.exe
5784	[x86-х64]_Helper_.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	vc_redist.x86.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	sites.google.com
5	sites.google.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[x86-х64]_Helper_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[x86-х64]_Helper_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "162"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
4812	msedge.exe
4812	msedge.exe
4888	identity_helper.exe
4888	identity_helper.exe
1672	msedge.exe
1672	msedge.exe
5620	msedge.exe
5620	msedge.exe
5648	[x86-х64]_Helper_.exe
5648	[x86-х64]_Helper_.exe
5784	[x86-х64]_Helper_.exe
5784	[x86-х64]_Helper_.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	1792	7zG.exe
Token: 35	1792	7zG.exe
Token: SeSecurityPrivilege	1792	7zG.exe
Token: SeSecurityPrivilege	1792	7zG.exe
Token: SeDebugPrivilege	4540	taskmgr.exe
Token: SeSystemProfilePrivilege	4540	taskmgr.exe
Token: SeCreateGlobalPrivilege	4540	taskmgr.exe
Token: 33	4540	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4540	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
1792	7zG.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4540	taskmgr.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3880	4812	msedge.exe	84
PID 4812 wrote to memory of 3880	4812	msedge.exe	84
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 2572	4812	msedge.exe	85
PID 4812 wrote to memory of 836	4812	msedge.exe	86
PID 4812 wrote to memory of 836	4812	msedge.exe	86
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87
PID 4812 wrote to memory of 4280	4812	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://sites.google.com/view/exlauncher69/download
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd576f46f8,0x7ffd576f4708,0x7ffd576f4718
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,14036109147608883208,551028593842361214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2848

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\[x86-х64]_Helper_ (1)\[x86-х64]_Helper_\" -ad -an -ai#7zMap32288:140:7zEvent30001
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1792

C:\Users\Admin\Downloads\[x86-х64]_Helper_ (1)\[x86-х64]_Helper_\[x86-х64]_Helper_.exe
"C:\Users\Admin\Downloads\[x86-х64]_Helper_ (1)\[x86-х64]_Helper_\[x86-х64]_Helper_.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5648

C:\Users\Admin\Downloads\[x86-х64]_Helper_ (1)\[x86-х64]_Helper_\[x86-х64]_Helper_.exe
"C:\Users\Admin\Downloads\[x86-х64]_Helper_ (1)\[x86-х64]_Helper_\[x86-х64]_Helper_.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5784

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4540

C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2880
- C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" -burn.unelevated BurnPipe.{E5829B6A-363B-40C8-A74E-F09E84EFEE1B} {814EFF39-BC0C-4FFC-9BCE-6A8AB9320946} 2880
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2696

C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3824

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3860055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
49KB

MD5
562ff756a1e61d8ac17ff8f451d686db

SHA1
7078872bb471eab9596f5a6f3eb500dd45b8149d

SHA256
1a57638d26c2500a1b33bb92e499249a4c8cac7c069e7d90633a29a7cc206201

SHA512
79350e019e61ca2a2612d0783e2fa330ea59e582d24cb12371fcc5970f679f6de6e927c89d4cde3548a2d205002d1259f8ffa9ac64e6f6892532512c4da53b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
52KB

MD5
e02ec4935e659de3679dfb6a08e436ec

SHA1
3e30fb8f14f2c2914ef5b25a39a3dc752e2b5088

SHA256
ad1eb0fa34a68fdca7d3e9f0e18d06cb05b625881bfdd0b89c1e6011ee825a37

SHA512
f467f91fb0888045ed560a0a47109077b884d912f8c322cbf2ab064688200f71831ff537709bf29baf6710bebc6554fc56266582ff6cfe20d14d944233a2edfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
52KB

MD5
d825d3fe0f213fc9a2b8124f087ed2bb

SHA1
61b8b467ad4b6c61618d630bb2d249acdd30299e

SHA256
f52c9b54ecadff37e39fc91448c84a94a28795c21fa9a743289cedb7f742f38e

SHA512
51fb1836d07d39a260a1db748f6098721a61b1335108bb62af1627ddb92751bf289f09abfe3cd971bc167a76a8b3bb0d47dcfb655b57c1bc444b5aa7965cd7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
50KB

MD5
2a7ed800939f6540ceb91b6594ecf239

SHA1
73773e8a908af93029e1f3dc081242f7fb73dc8b

SHA256
d914d12db91a3151b3ab8b288d5ef49b955a7bd747d3a346a84aa5bb1e9e5648

SHA512
5bb592d50b297c993992b0bc92b8f6d924458e0b1b447ecb62f0480ca4d2672730b7b0f8ee103df36347c42eca2531105f7b4ea13e68374a64791f9318685225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
54KB

MD5
b27df89e5a6f0afda4cd5419e73b99b1

SHA1
810d7fb026fc22cf3de9e8b445696d1bba94484f

SHA256
0fd797dcfb0e8ef3ed7c3643e9ed0a301e5abd110dc629aa1e2edfe3dda304c9

SHA512
e1f5242168b011091ae8459c1a52499d27f38c6f03b3cedf660ddb15bf6e4e180c097879395152836e50cf859f5316af511fdc012de673b971e19bf951f51e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
52KB

MD5
882450963df212d9c0de15bfa24ba5f4

SHA1
124e859b00a77c4709888c0173cebeb4e1ef8b35

SHA256
2ad4ecde46ca4c9f20ddff1e20042d91e9b5ac8d1c3ae9194a155cbb2bc271f6

SHA512
a0c2f54aa27b11dded4e121f4691172e721774c9aaecb21c5da55f298fabe2999516786be016504e10c78cdf385d48a91de2ca8e30bd24d2e5016a4a115c9ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
18KB

MD5
9fea0b42802ac8a974de5701ce1db652

SHA1
56f9d71b4b3405ff9ff434b473133835e968edcc

SHA256
a75ca9d1d64735bc4430502500c026ad0b2a96ee82abfa8b96c01e3b9fa80eaf

SHA512
ed04d001874562f5e74196e6431f3ab66fe7f705125989341ed9ed832f11e04534ed2092031e928af162439e933c87f52b4960a767add1a1212fb9ba7a9b7254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
18KB

MD5
8bac0b01b06f48f7313a3294de022366

SHA1
12f972e8b178343d7a9767d5e65ef6d9cf56193d

SHA256
610b0ca8fb4bbdb883377d4adb5b7273cfd6041d0e618b586859837799ac2bff

SHA512
9e10fc7438a4bcda8a786d94daeeab9333154625b332cdae8595b841e252adc37dd40021fefa8377508a665323075bd258e47b14b2942ecdd6cd00e1deba76ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
29KB

MD5
9e72eab4bdc6153a28df783d5cd0fcc7

SHA1
05ed8ad81e550880378254bca70b601849ffa6e2

SHA256
57f0ddd5ab6e8b6d7b6a475c8b5117e7129ad35a704eee24fd6a601d6841f4ce

SHA512
da9f76e65826a438f8b952cda17917d6374020074fc75916c52342acf1d7781a74ec4bc9cb90e0e7615d0333d8b1951fc2196208d071900ec94dd0559bc46886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
112KB

MD5
f426b5273f5508c72b3a57a82216c5ad

SHA1
f48ed8dc6ffe5bac0f710d1ae85510dd9883228e

SHA256
98ebb0bb3d36f69246fd88133a465f045508d462bf30109fb0c0a5450aad1e9a

SHA512
d27a8d47cbf972dd7d8a20d39a6070997bffca3c2d05b1a8714d671a15c36b87135c64e274bfc1bfe1be6d71d6fed54bc272a6ce8bc020c3f2a41b55b2fe229e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
33KB

MD5
ce3a913496c8bdd00600b9d978f67d3e

SHA1
8678d99710372c4d5e11c7abc0f20d12d3cbaa5e

SHA256
551a3c5bb3cb4f893cd84f2d37c81778d3baacb2117d8fdab03610db4c658361

SHA512
b58bc7f1ed4d56d2445d63f2e7e43d9acd2ab4b17764fc05740a2120f1d8b6f8cf5f18481851649ae788e263c1104cf4d2aa77f42d9d2b8c3e96031b7fd388d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
44KB

MD5
54e90b61ec415a5ccc5b5c54188ff76f

SHA1
2e3e92c859199cdea587a86a9f4094878eae8b6b

SHA256
e0b388a5eb8a4395fdac607eab51baa728398e405c637498a211232c4a6e8f91

SHA512
910e58087f601aff582ec2a5b0254d0f2c7cd4448f319e03c451164c835725e163cb29099c0c7f0e92b282cc9ad28cbef8e315d9dcac1ffd99cc65b6c2e35bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
121KB

MD5
ac3613c8e17c21028d02ebf987e10f04

SHA1
54845078aae8339e2f003b97b3a3aaad41edec6a

SHA256
6ecbc7241da79263a977aa9405f3d069057307ab57e116ddfa4ddb4170af1610

SHA512
8c925e625fe8fa0db5a3e6b6c4c50dd4ae986a263cc7a1697bd2aaab338f043c489f8e8ec6acb7f40cf6b948dd66ab9a233114d8ced22e930c64ddf9f1dbbf40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
130KB

MD5
efa9b42c3bc13830685428225b1c11e9

SHA1
173be119d5fd3fb05e4a9f8944afe30dab81d2b5

SHA256
72abf08ad77bcda508eca9d3bbe617d90fdd8bd947cbfcd8026e3fb82d14f131

SHA512
ec8cca7d7def6a8443418d096bbcc5d1c651f4eee36b19f7c5da1239b704d71643d220cd67b5127d9e36960a7d92e7856e8e9630d1cfb6849baf6516548d4a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
326KB

MD5
f7c4e453e10dfd67089a570ba80f7a45

SHA1
ff1a913aeb39ca4ffd1e2a2fdb358ac25ac34a69

SHA256
99378cd679c9a908489975d0aacf61fc59b2ccdc4c04b5ed80ce5add4d95523e

SHA512
88c267d92562c1980a0019fbeada42da19da0ea981503ec2c3123b9af050d1061c94cfc418f04b42d89ddb6f2183d79c5015c99cf833f82cbee1685dfdb6921c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
52KB

MD5
5e72719b69e77e6f79e36ce02091f918

SHA1
a005940d8457f003c9ed608af4ffe7943e66dfd3

SHA256
ceb2efa37f1db1c2a94efb454f06fb8841ba280a75e242851a75158f1ccfdf1a

SHA512
8ae77951396e5e140be080ef0c4d10780119e3f54db4876d0ce6a4af1cb57141554f6114e7327cbd48a5bb7350bd044e35a08fe076183d126e5a65199f6c4447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
31KB

MD5
94578e4cadf9849d0a0b9aecb34018f1

SHA1
e363134beeaec9336e0a78b41f3c719c13c64466

SHA256
8a095ec0283b94fc255b27c011850ec5dd64eab95721baa3f2741d7c895ed068

SHA512
fe7367104ddae61e2f359c4973de542d0428d7620bf5f7f70d7e1a05acc41f2771f551062272c1a9c25ed5fb8dfe55fc63a82cd5ef8c5f7baced4132fa0ca795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
144KB

MD5
efe79e78ba48e96bb97f783102c87970

SHA1
eac05f27f311103e00a40d63b649a1e73b6d5f99

SHA256
c3da2dda8add34253ce1dd968b702e66fd424f7059fd75594badbd7e5c0e20fc

SHA512
b25545dccf4d2538a9295a0477d9167100c60e122c54ffa531da33a4275a2307f0682bf6ef12b56396d19ddbb250b97d6e5b5af70f1c70db6f4c523b0522f171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
67KB

MD5
bcfda9afc202574572f0247968812014

SHA1
80f8af2d5d2f978a3969a56256aace20e893fb3f

SHA256
7c970cd163690addf4a69faf5aea65e7f083ca549f75a66d04a73cb793a00f91

SHA512
508ca6011abb2ec4345c3b80bd89979151fee0a0de851f69b7aa06e69c89f6d8c3b6144f2f4715112c896c5b8a3e3e9cd49b05c9b507602d7f0d6b10061b17bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
21KB

MD5
2481ac6525d99c8aa045e0cdf9b02ef0

SHA1
e86df3a0d0f37d6cf98c892831933fc456963b4a

SHA256
3d90de223cef2364a53fff7e299f385d48605c4eaec5b168cd067882ebeb6018

SHA512
76d76e6b53f7665c1feddf9feba806e75f793948f1e5500dbcd3a3023f03ebf726982ee70e4dcc7e4e1b01cad14aeec28349de08abc8d09a58ab0f644b25c860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
35KB

MD5
7c702451150c376ff54a34249bceb819

SHA1
3ab4dc2f57c0fd141456c1cbe24f112adf3710e2

SHA256
77d21084014dcb10980c296e583371786b3886f5814d8357127f36f8c6045583

SHA512
9f1a79e93775dc5bd4aa9749387d5fa8ef55037ccda425039fe68a5634bb682656a9ed4b6940e15226f370e0111878ecd6ec357d55c4720f97a97e58ece78d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
20KB

MD5
f2ccb6f56e4d5e11978bfeb079777f93

SHA1
dcfcab174138725ba864fa18b1a56576b4a8b711

SHA256
b6ce1ec398d8d032e8b09d3d9813e4de4e2578931ce7c099025b4bf430bab5f5

SHA512
af243b4dda9e37413ff9c5433f550e6c419acc6c2304e80d74444c7c467c4e3f778cc6f01e02a45675056288255e50501ee69cfb787d1b09201634a8f4134f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
4.5MB

MD5
a7292171c5fb9c358ee694be707dc5c0

SHA1
f0b3781e4ff36efeaeeb779bfed6deabc0da3a58

SHA256
3bbd66121922f68da4df1c5b46b87b166a62cc48254f5b398225778c2f7537aa

SHA512
6119f54a319a79e14e1298b6e2c1156699841193d6b32790ae0e9175efc0681e057d10671067dfff91d2720a16909b3de86ee76eee05c95f06d1698a0c18f624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\38b795045f1cd5f2_0

Filesize
3KB

MD5
ae0d27ec9ff7d2bf3528be0e07579376

SHA1
4609a7e52cb667d68ca264806617b52565e200e2

SHA256
ad30f1f77cd0d16da12edc71807feaa2a469c0bcefe0061dc276812468b463b6

SHA512
a4a714dafadf44f595fc211bf94524c9d7fcac7469748a370962e81164faf0db2d18ef582f4f1272556a8450c9248b0cec212ba7acfba38b722f63726f84deae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
62a1cbf575c97e06f9daf05e289b47db

SHA1
2b721c11728e91446bc4f7a513e82884ab7eeead

SHA256
5fd224a246351f43e7574ca30dff7fa1fb84dc0ed99a756412d54ec857b7d0f5

SHA512
afe0ade0d36709c9709a1f9db7f9e51041e5f54cdff0c31494791f09da12e9f77eec3c241a061e92ad523f5817ac3d13f2b57e5b2fd248ecd2a21654c7e07af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ce705964bd51af70f0d5033fce665bce

SHA1
9021c0c7f5318812a3e18f120b3538ffd2f17d96

SHA256
59d528b669fd178e10ef8bd789861c089e491b6f4d3aaa5381ad02aed1721b26

SHA512
31aeff87707cc752aad670097854da438402d915e47a3d2a5ff77de14e93b8ebd3261be94b642e2f4a3dee338104a721e75168bbb106f055d9192f3dd3d6b6b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
18569c0ebdf0195e50bf747c437ed5cb

SHA1
ec5f61e51967d890a13a41754e8e13ff918da1ce

SHA256
ee892f75849c3f110014a9046e2fb39e12410a584af8b2b8a781faec8cf4c8e4

SHA512
140c323828299d273e1f87722ff477da5eb21fe081c257aee5144ee18f0e84a2ef2e826b1651d29e7c2dfe15f276a40d1101e0191906756988da60a17c2e0368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
0a6b53fbdcd58563fa5afb802edd8176

SHA1
054ebb80ee9780548f88b958dfa866cce731c459

SHA256
cd7f3b421a749f57169ad59d328f20d0eb7ca8e6cd71bba400ace144c81c9aa7

SHA512
36f7e226bdb17b896e9de8bce9a5f4ca2d39c1584ba00370a8251e5c06f8d1a87cc8fc411a67fe25703becb056777ce0bded7af358970d4b17b6e92b64008968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b6d484fd91c90642e90f843d430d918

SHA1
dd387646bbf9075c20ed1ae63e9e2ff0bcfb04a9

SHA256
bff75d6b90b503963045fe917d3746a5393510c27f7f775d1aace3ce565cda4d

SHA512
29902886b8edceed19eae0badb2c18392a36be580354e1b7f5facd4a3a96bfe4e9d15ff5d20e7ee19572a6ef7d7dceb6141829ec5147dd5abe14167a29ca7a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b93208bcc8cb34e2036cc66d7c5d6e6b

SHA1
710be6c1164b2540ae5725ef806b1233f0c9b6e7

SHA256
3fd8df52b2fc844fc3abe03f6d8af8ec06007ec4e289499b3fb26dcf627e91da

SHA512
8256baf1e843c8658d8bc68562597f8e3df07fa9f67797c1785de4cbda46b75c9658f4c3a8a906c082abf53b5d14b81d955bd9072b37bcf2bca03cf8a77881ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3b8c5dc7ae810975d4e02ac3718d1dc9

SHA1
382757151edcf05b2a1733c5072fa804a009ef5e

SHA256
96a8c8a83953afef9cf0326cd94426228e0ced7809fdd5b9a8056415069b91b3

SHA512
4a963edda5cf2eb6a4aeec7b4dabd5ca732fa585b46d357ae89cb8c0efe54a01b5d0b256fbac65401c387e9ef15ca83181785e2c52b51e695fe8da6ed9d8c168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9ad03bccb94154decc737219bfde304c

SHA1
8780586fb00bd38fe818e433c6aec71f7dd8937b

SHA256
6fd1025f78989799187d8baed4d12e929b0adcabe9da3d3e281fed158d5a826e

SHA512
e2f829a8fda699343557d4e8b4e7f65eb78600c94ee77b6687f3863388320e763e64039fde654e4a8ec5d56d5e3c53669803910e4c59846ff1121071d7a7647d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
28860c69c76f57115e7e99575b930d70

SHA1
8281ee04d1552446ff6fa499241fe685a78718e5

SHA256
a298c3d7a797c1744fa1f8721d7f4947cde3b4db4565548c8a93cea2f569683a

SHA512
844ef83669d62794d5747b1d8586e2a410d8cde25b03b6639318f3a8034f0d1792698383866d8b4f6ca515417fd0f1fe3062aa743e37b55b618802918081a260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
dd55017ad1c7cae49cfd0d26917099f5

SHA1
ee19ea234c5d51b835840c4533b351104f9859e9

SHA256
6296e4a329c172892d9df6d0a3caa19e197ec72ba4410db2815fca1365f63879

SHA512
829cdf4969db95f21e8c10ae5a3f6c74da26f88e964de38811d4cca0fbb53f1d9dd8124132d3c11ffa0a99afc7de7268ba0c785ee0e4d2e9bda2fc7e9bbd73f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584dcd.TMP

Filesize
48B

MD5
a0e7a82016aee2fa4a6ffaef7afc080e

SHA1
a6fc7383486d0fb5557b484f5a8103e9aadeb13b

SHA256
156b23d6aa07d37d867af51f8d06401cfb46a45a8e7db479292b73b008022828

SHA512
3144166e8d5d23663e704bb5d730d994c7e9a109f89e7172bf78766359fdee38930c753ad9da1742c3f150d54a640dacf21375a6270274abdc77d9f800309cad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8104927453bdb9323707e924e1e02692

SHA1
545b960d6a0f5b416a0df048bfc0b405c4bd08ba

SHA256
9f24f2dd290729b8535489ff253a54e420e123b7db6c61b48aa358b4705106b5

SHA512
5141d4cf11c8f84631104b15f483fdf2f13bc046d6a676dc1d216713317e0a5e8f9d1b9f1969a21417f085bec216cf9487b279624cc065f6f7c642660ff9364e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
16f8becb7e0d9d9072d5df18386b77dc

SHA1
019ee5693776f11cd161d524a0a63fc388bf63b4

SHA256
afd7322e7587633545e7f56284d2f2f06ffe5114ff0cd0db26803d2860badbec

SHA512
82a999fd84c0a13bc059cb9fa964bb433f3a93f8a97f563b472d923c40501fb92435eaccff71180ad21a0d1b83227f052fda10f532329a831165049a89989413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d6f98d26284e9cd4a48e0acd10204d59

SHA1
c05a32b8ea91a91363361aba4486cb7adf4e0f55

SHA256
3473203fe3ab4d073094b15d159f8e3a2194cca544b55a225a8c5eb1c9eda1c6

SHA512
c8723080989b117bfab5c2450b17f8383c031e2e2f2e3b1c692c14790bc337fa900311985220b14e228f85a0b6fcd24a4e31825e4239ed48ca247ee44ad64987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1e1db9a0d1d4bab7319445965d806b7

SHA1
5b209842cd28d204e09a4ac21e3e72491cdff07e

SHA256
08b455b446bd431c39930c8eb080aa4e3df1baf6e57f1437093e9a0856243356

SHA512
d6b46ae02450d88e85d305158d97a515409be93d59063c66618e9089dedbbf83d26e46faf5e45d8f65d7b69bf39525ad6193845085b3bfb9fc1cfb351dfa7579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
73f676866ac975cd917a9c919bb48312

SHA1
89801dcf8e1100faec2fea5993a696755e692612

SHA256
24786b248e9286471ed72465a0a30615400fd64027ef68ebebc30a1c94502326

SHA512
c5fbf29ab7913e690585eeb5cbca267caf0f1dd064d935a5dbfb1cfc5a06da71dcd5713972dfc0110c6be5775239b4874ea2627fc5bf7eb9ce230f6ba5f3a146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5819cc.TMP

Filesize
1KB

MD5
687a56fbc6c3d3733799eb3555971c09

SHA1
5b2671b4654e0246a29769e63fad9f8445404c00

SHA256
e156cbdc6d90b31e19bec27b57ba83eddd5431fc65ac7615a9ef75d977c4fac1

SHA512
39ed5b24bfc3ba3292eb929f3150a232e702ae417c6929585fbb3d3ff964188e621119fa037182f94beb6dd876a7d908d46cb349e9a747298e6fc0c148298fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5fa06b5417efe5bf70a9f656ae58c871

SHA1
dbf063d0b94109a6b8711b41f49800404edac1ac

SHA256
3c79659b5df01fad9e4f10caf26bdfa6005f65f0b4f8270e9477fdbdbdd22322

SHA512
21989e57d8d43e9760597383a5eea80ff80c047bcbb564e517816eedbd40629aef5d966f670431e7bba1a61604437b230e1f0f2f686e5dabc75da08671d8793b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4298242f49ea225d66214fa24b127fe

SHA1
f29034d812577268c2def6f8a64d0098688a6903

SHA256
27e794d18ae654184a0d35e0f0b52736122e68e599fec6ab7fa06b24b5ace2bd

SHA512
4da3aca9fce1ebfb5767ee494b088a336c9eb1e16ebba6ecc408c102f2b2fc1bc3473e61e04d3ae9204e044d973b8eb40070d384c1aae0e464fb156ee2aaac3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d21cb00ec71c3af7d4150daf85328c9

SHA1
57fe4ff9ccb1d924d856d0260b68c564f92edda0

SHA256
5bfada48299d34f10ae1b0719d2ce1de19e0fb4f1670fc9e750c99c46b0c823c

SHA512
d76064e703979d80fd7dd912cfe7991d3ba41bf03d17c7a329c1d91555855cf6546c74d1bb2fcf1ca97cb334a40e157443f3fb4eb8754b7739b5b71e1a3fcbd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll

Filesize
118KB

MD5
4d20a950a3571d11236482754b4a8e76

SHA1
e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

SHA256
a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

SHA512
8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 976168.crdownload

Filesize
13.5MB

MD5
660708319a500f1865fa9d2fadfa712d

SHA1
b2ae3aef17095ab26410e0f1792a379a4a2966f8

SHA256
542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c

SHA512
18f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517

Download Submit
C:\Users\Public\Desktop\ᚹᐲ⋨⌽⋡෱ٻ↓঺⨏ᵞ᩵␚₉✉⽼⥌ᚥ㄀ṹస⢂Ⱆᕤ

Filesize
666B

MD5
e49f0a8effa6380b4518a8064f6d240b

SHA1
ba62ffe370e186b7f980922067ac68613521bd51

SHA256
8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

SHA512
de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

Download Submit
memory/3824-1122-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/3824-1132-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/3824-1309-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/4540-718-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-716-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-717-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-719-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-720-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-721-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-722-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-710-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-711-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/4540-712-0x000001548E210000-0x000001548E211000-memory.dmp

Filesize
4KB

Download
memory/5648-677-0x0000000000400000-0x00000000006A4000-memory.dmp

Filesize
2.6MB

Download
memory/5648-675-0x0000000002470000-0x00000000024C4000-memory.dmp

Filesize
336KB

Download
memory/5784-709-0x0000000000400000-0x00000000006A4000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads