00a800f3a2c818007aaaeb790252d9e2082538bff240d47088fc43b3cf00cd54

Analysis

max time kernel
280s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cat.png
Size

184KB
MD5

3f610ad02e312982674ae05bcbee17b7
SHA1

9eacad17b2252a388850bb947cc9b8beb49d5666
SHA256

00a800f3a2c818007aaaeb790252d9e2082538bff240d47088fc43b3cf00cd54
SHA512

cde2e12c71b575eb7932257cdfd8ee3eb5f90bf170cef7508223bc76e8949987d9116cca0f6414610a5985d62eb1b8ec6a5979554cd6d7811dcc41c0b0247802
SSDEEP

3072:x2PkWEBH+yMqFxeLp3eTVDVs78GykaVJNEA4tVLUui+XPMiU/Geu:0kkHqiQV+AGZajNGZUuiwM14

Score

8^/10

discovery evasion

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5152	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
5304	MacroRecorderSetup.exe
5940	MacroRecorderSetup.tmp
5176	MacroRecorder.exe
2448	MacroRecorder.exe

Loads dropped DLL 4 IoCs

pid	Process
5940	MacroRecorderSetup.tmp
5940	MacroRecorderSetup.tmp
5176	MacroRecorder.exe
2448	MacroRecorder.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\KasperskyLab	MacroRecorderSetup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MacroRecorder\libeay32.dll	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\is-33AKK.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-T8TG8.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-M1LOS.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-MI379.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\32f9e6eb-0b1a-40a8-ad25-8dcaaa1603b1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230616130922.pma	setup.exe
File created	C:\Program Files (x86)\MacroRecorder\is-B5CLG.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\is-STLU8.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\is-PHAUR.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-R1RK8.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\is-DR37U.tmp	MacroRecorderSetup.tmp
File opened for modification	C:\Program Files (x86)\MacroRecorder\mrkey.dll	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\unins000.dat	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-2GEUT.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-OFAUD.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-GNEQK.tmp	MacroRecorderSetup.tmp
File opened for modification	C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe	MacroRecorderSetup.tmp
File opened for modification	C:\Program Files (x86)\MacroRecorder\ssleay32.dll	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\is-0CQT4.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-TN97L.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\is-50CNS.tmp	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\unins000.msg	MacroRecorderSetup.tmp
File opened for modification	C:\Program Files (x86)\MacroRecorder\mrinst.exe	MacroRecorderSetup.tmp
File opened for modification	C:\Program Files (x86)\MacroRecorder\mrocr.dll	MacroRecorderSetup.tmp
File opened for modification	C:\Program Files (x86)\MacroRecorder\unins000.dat	MacroRecorderSetup.tmp
File created	C:\Program Files (x86)\MacroRecorder\tessdata\is-CM43K.tmp	MacroRecorderSetup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder\ = "MacroRecorder macro file"	MacroRecorderSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder\DefaultIcon\ = "C:\\Program Files (x86)\\MacroRecorder\\MacroRecorder.exe,1"	MacroRecorderSetup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mrf\ = "MacroRecorder"	MacroRecorderSetup.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder\shell\open\command\ = "C:\\Program Files (x86)\\MacroRecorder\\MacroRecorder.exe \"%1\""	MacroRecorderSetup.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder\shell	MacroRecorderSetup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder\shell\open	MacroRecorderSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder\DefaultIcon	MacroRecorderSetup.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000007673eeb56645d9012286c9776d45d901ccb29ed853a0d90114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder\shell\open\command	MacroRecorderSetup.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacroRecorder	MacroRecorderSetup.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 79818.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
1176	identity_helper.exe
1176	identity_helper.exe
2224	msedge.exe
2224	msedge.exe
1424	msedge.exe
1424	msedge.exe
5940	MacroRecorderSetup.tmp
5940	MacroRecorderSetup.tmp
5176	MacroRecorder.exe
5176	MacroRecorder.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
5940	MacroRecorderSetup.tmp
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
4848	msedge.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
1424	msedge.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
5176	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe
2448	MacroRecorder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3156	4848	msedge.exe	94
PID 4848 wrote to memory of 3156	4848	msedge.exe	94
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 980	4848	msedge.exe	95
PID 4848 wrote to memory of 2388	4848	msedge.exe	96
PID 4848 wrote to memory of 2388	4848	msedge.exe	96
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97
PID 4848 wrote to memory of 560	4848	msedge.exe	97

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cat.png
1⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffddbf946f8,0x7ffddbf94708,0x7ffddbf94718
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff64eff5460,0x7ff64eff5470,0x7ff64eff5480
    3⤵
    PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=120 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8612296381449466228,13805546456685288589,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5580

C:\Users\Admin\Downloads\MacroRecorderSetup.exe
"C:\Users\Admin\Downloads\MacroRecorderSetup.exe"
1⤵
- Executes dropped EXE
PID:5304
- C:\Users\Admin\AppData\Local\Temp\is-N4DL0.tmp\MacroRecorderSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N4DL0.tmp\MacroRecorderSetup.tmp" /SL5="$20202,41089859,845824,C:\Users\Admin\Downloads\MacroRecorderSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:5940
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" advfirewall firewall add rule name="MacroRecorder" dir=in action=allow program="C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:5152
- - C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe
    "C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5176

C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe
"C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe

Filesize
14.6MB

MD5
9fcc976d5e464abc9fc60d392ac00ea6

SHA1
74e1a69d4238fc5a1cc1eff627300e8a614f5315

SHA256
208eca77b9ee54b591eadabf5324916b735bb67fbe1d72d67025137758b8350f

SHA512
9d9d9f55136ceab34e88df1d11dbdd02f4478ff9034b2aa34f78129d0fcf9d310236876d5315ac99221ff9e1f2bdb7110f57ae25f65bf3c7807f1f572442c1bd

Download Submit
C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe

Filesize
14.6MB

MD5
9fcc976d5e464abc9fc60d392ac00ea6

SHA1
74e1a69d4238fc5a1cc1eff627300e8a614f5315

SHA256
208eca77b9ee54b591eadabf5324916b735bb67fbe1d72d67025137758b8350f

SHA512
9d9d9f55136ceab34e88df1d11dbdd02f4478ff9034b2aa34f78129d0fcf9d310236876d5315ac99221ff9e1f2bdb7110f57ae25f65bf3c7807f1f572442c1bd

Download Submit
C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe

Filesize
14.6MB

MD5
9fcc976d5e464abc9fc60d392ac00ea6

SHA1
74e1a69d4238fc5a1cc1eff627300e8a614f5315

SHA256
208eca77b9ee54b591eadabf5324916b735bb67fbe1d72d67025137758b8350f

SHA512
9d9d9f55136ceab34e88df1d11dbdd02f4478ff9034b2aa34f78129d0fcf9d310236876d5315ac99221ff9e1f2bdb7110f57ae25f65bf3c7807f1f572442c1bd

Download Submit
C:\Program Files (x86)\MacroRecorder\MacroRecorder.exe

Filesize
14.6MB

MD5
9fcc976d5e464abc9fc60d392ac00ea6

SHA1
74e1a69d4238fc5a1cc1eff627300e8a614f5315

SHA256
208eca77b9ee54b591eadabf5324916b735bb67fbe1d72d67025137758b8350f

SHA512
9d9d9f55136ceab34e88df1d11dbdd02f4478ff9034b2aa34f78129d0fcf9d310236876d5315ac99221ff9e1f2bdb7110f57ae25f65bf3c7807f1f572442c1bd

Download Submit
C:\Program Files (x86)\MacroRecorder\mrkey.dll

Filesize
156KB

MD5
1d01aa12abca7c2405abb863ae670305

SHA1
452b72fd0d41f008be8e2f8bdbcb3d727da885dc

SHA256
e92e12209048ffdca0c9e8bbbbf0616ce3e83dc66152c727f1758cd711dc529a

SHA512
36fdf55268418da1f09a22f284bf3b4d63b88af998d80d41ca9e7558b498143e5babc8329504c0e4c44d0a3edfc9692e612fb90e27d78f88cb92994181e1b550

Download Submit
C:\Program Files (x86)\MacroRecorder\mrkey.dll

Filesize
156KB

MD5
1d01aa12abca7c2405abb863ae670305

SHA1
452b72fd0d41f008be8e2f8bdbcb3d727da885dc

SHA256
e92e12209048ffdca0c9e8bbbbf0616ce3e83dc66152c727f1758cd711dc529a

SHA512
36fdf55268418da1f09a22f284bf3b4d63b88af998d80d41ca9e7558b498143e5babc8329504c0e4c44d0a3edfc9692e612fb90e27d78f88cb92994181e1b550

Download Submit
C:\Program Files (x86)\MacroRecorder\mrkey.dll

Filesize
156KB

MD5
1d01aa12abca7c2405abb863ae670305

SHA1
452b72fd0d41f008be8e2f8bdbcb3d727da885dc

SHA256
e92e12209048ffdca0c9e8bbbbf0616ce3e83dc66152c727f1758cd711dc529a

SHA512
36fdf55268418da1f09a22f284bf3b4d63b88af998d80d41ca9e7558b498143e5babc8329504c0e4c44d0a3edfc9692e612fb90e27d78f88cb92994181e1b550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
67KB

MD5
c9389ff6d79f00929167e86d94179cb8

SHA1
b6e823153c057862a3a74cfabfabd18f2a4c7cf5

SHA256
fecb5956c58223de433b74014e619273315976357495cce4b5adddcc46d73ecb

SHA512
cc836895114300b244308636a2d5069f9d1aca0b77eeded381960207c000e583dbc3a3de0a3f428e5fc331696fc6a780a6d404c61676a79d73608fe95e8ec421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
38KB

MD5
e4c780a544249a7967b82f07268ef432

SHA1
64b38d103f06b8de4241c62835f67b28a96d286c

SHA256
4d2dc675ba41d56f2aa6cc1286f3f127590c9748f7b4e0bf4c79b0b4bd620a9a

SHA512
74b9135f09dffd7a081889235d2f4c7a343291a4c4458ac69754cdd5790b455b9b98a128561d516202549e83671de13cc4e4b9cfb3ff195dc3d23b42885edf49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
166KB

MD5
3b468cf23dd3d8af631fe8c65691eaa9

SHA1
2aec774fd24b58723af504fe7fb8e32d07ccc862

SHA256
4d4fbc69cc1b9dfff9ff202d2cc4a9d003ad95df58cdc91a87fe071e12897512

SHA512
90f041fa27d43d53aedb5fbdd5e6bb37c63fd7523e2f01cecae951b949c6459e340673b255fae23e3efa309f916aa8ee7dc91e4a8f96c242bdbc525fa79b534e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d729b60ab0090aaa7303d32e73302cc4

SHA1
6f4880e7c38849bae2ed7c5d11fd7928bc009c14

SHA256
2b45eece71d4507f8f2039ec0e374ccd3f3167c5e124cb7b6581b3eb0ad38f00

SHA512
ba35a476cc8f94de741f0525003f6941e67057ebfd94bd54e73c63848e9cbed4c75ea956fe9aee3100e3c772a5ac0a7b816ec1a1f129adc31e3fedbd09034c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
66bcd33a72a8ec2e820f9787ac513eaa

SHA1
8031e0c29cbc18a18def875d3a05cf577f7f8400

SHA256
caf9b908d03c71cc92e00bb3de603140338d0468cfa31a64dae168b104360939

SHA512
5268749fbbb46c7834ef3ef47969468dfea8252c51974663e305de6901f4865ee0ce313239cf60269df7590b7a567467b757f8b65686c52737ecf4ead512709d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
c5109ba4810a09d755f75301b3338b26

SHA1
6f915128d589f3004d53d0bee10509889553c5aa

SHA256
af6e678afbd81d96638a397607c88799f97bc6a8c48bccf7c8baba676262fbd0

SHA512
edf5cf8de439178ef7f59ae18c9e4043bb244185784502fae1e3de6d1f7dfaa81026c89dfa92c03f01d32c07c64bf7e3612c90453da9dfbf9b930d18475bcde6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
c450d1963f93f25df5f6575dc6eecfc3

SHA1
9201e5c2dca37e0fd03e7e5df05e71f5a37cfb6e

SHA256
ad4d1b40802b1f0e3697ff2a624bda6218f6f18c151e7e402327a6eec519cb20

SHA512
1503bd4bcce4b1695ec2744cff0d4119e2272ff7d7f01673d03b039c751eb8b704ee043eeed9433e0bd23519e7f375654af8801eb1cabdd9f091bea6f2bd235a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6324031924c1d48f429b1f3570e1a95c

SHA1
366b1682d3103557e50f9ab47a0c14b9b81e75b8

SHA256
c0331171589360b16a5c4ece4b8e315dab53d88453ff8ec1557fe4ef6e38a9ac

SHA512
672f0e2ef35e8fd05407e0bd5df73833e8cb4396efaa8db461c29a60d58530f3493dc5d28b4126befb499c8c977082bd121027bbbdb5bfc3fff841102788f77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c39ce3b75676d12600d70324761bbf2f

SHA1
50186f59fbf1fe06934496b296941c3dc295ab5e

SHA256
1fc5848ef5ca1feda1706ebe1f3a9daa7561c975744144a2f8041d82513acbb5

SHA512
cca4d650c6425b30c8056cdb745f7ad34a2aadaec155ca9ab2d5c3b15c8d4bd34f79c32a0877d3490af8c422157f06396664fe8e2cd27a524f809c5a31b030b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5b9d1aa2af24ea4a186b36c0d0bf1d27

SHA1
cee802f63ed7162f37da4ead38f36a480b6191bb

SHA256
9ae63fdd0d34c6b0db81eda14cf7fa43e1d1a90c013fdf0c897ca518e5a35447

SHA512
fe0e9a7bdec074a948303da3690858194a849402e32fafccd0beb6197481469c590ada819dc9f3beaa422c16196da0060359c8b22861ac483819d94e888e83c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8174fc3ed35bbeaf76f7238305fce0b7

SHA1
bb1eeec609a4063bf0da5110b7294d9e50a3207a

SHA256
70e797a1e59f7fb8499d9945baa7b8224d91bfdbfe3bca9dcb8c62e5e886ce61

SHA512
11dd2607348870838d323396f10537b268947ba5ea511764cc65965245baa353916341d057d0a942ff6152ed4db5d2c591dbe890e4378d0302773baf99097028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5cb1c340d71433677507ecc430787f6

SHA1
005fa05bae1e163a470167183666b51ce318b4df

SHA256
0428f100845f086223885d5c7d5aa1eb3879ab877b4c26a5e42ccd35f582db6c

SHA512
fd4b8f431aff7e4ece9f2f9ab53b2bd31d143c4c64ce8417fc5b52bda8d5cf1fb1540848214f7ced5ae57642b9e3fd30025fba8fa4b70be4ca67f38c08878c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
46d11bea09ef594d2f9455d981af858e

SHA1
50f3ff7f1582e647dc2c4a49c0c480165763de99

SHA256
2925345c0dd70265d099e08aaedc2e7303decaffa2da1d0f700224d1d41366b9

SHA512
f135302f2510584a7807869060096b5a4b7c4cf03e0bf3bdeac5ac246ce2c93041baebd0b6ddbfea223fada962fcdadb9bbcc04c5e9028487190c2d0309cd7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3cb3c464fe1a0664e66cb17307a5ee28

SHA1
bf48182fd137cfedbebeb777d602acc0312a8a23

SHA256
2426aea4ba5bb30e7ce1f34b6c5cd6571ec9db5ef86a8fc3c3d6a5dc0a897eb6

SHA512
b09b4e3bbed33e3025127ac4e868dc1896c73280a0edaa151c4fc5b329f55979bfcae43bc7c970db5383b55668b9d7a2e4f178b1c03fcbe31d2d79f272638516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13446c2e225cffedd69da08017ad2aa7

SHA1
cd8333966a96f953cb8e32f2894cc597c472ed3d

SHA256
920662f02795564b0362337308e8afebfaa027a15b05bfd80b221572b0226640

SHA512
dc605e1d480f35b147339044ec1b0cda5b456ca148cd919025998aa760c2894b1a3d67ade875929a4976285d06e3e97c0074d82d20d6106f52879782f969a788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
862be19813320e6d5c41c5851ed743a0

SHA1
a46c655be932f0057ec3e2bbb5a78aaafaf15846

SHA256
101739798f0465a5e1d07035ff83fabc675dba5fafcbd70b4b732c68dddf68e1

SHA512
22f0dbd60ae9ac1ad4dc0cda5ef957499d3fb6115d69aace750d625f8372c7ca859ade30b69e9b6ee4b239f77ba90dbd51c976b558592b3b40cdcd0e9419c42f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
03e418140e398c58ddddd09d959e0e2b

SHA1
00d8a26b8e8d35c4f7c3ac2e61a2c411b453e80c

SHA256
e5130c4753c5d95fa568c22a44adc5a9cda38344e3dd02ccb5bffe1def0edfb9

SHA512
80c13897f0b2ef63bd3dc29ec06aaaa703aff91b641dbd29806aef39d65c613190330f42af05f143a75fddecee5b6fc21c2971cdbb38ba3427a28d4c11087844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
612c1493ee14b704115a32d38cedbef0

SHA1
1e53c6557aade7c8130d52658b5ba4e0d0032a35

SHA256
5df39e6d52a5724a7d5a4ec09d505e1a138e3fb590d2259e13a33372ef97ce57

SHA512
e5837885426931fe04476e270e1ecab58fa6c09e44431cdbb426d25bdd2377b8cae98653643d3ea5e51ea80159e827bd87195de97f7350d491fe3985c6edd65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
69b72d0a4a2f9cbec95b3201ca02ae2f

SHA1
fcc44ae63c9b0280a10408551a41843f8de72b21

SHA256
996c85ab362c1d17a2a6992e03fdc8a0c0372f81f8fad93970823519973c7b9c

SHA512
08d70d28f1e8d9e539a2c0fbac667a8447ea85ea7b08679139abbbbb1b6250d944468b128ed6b386782f41ca03020e3a82491acb1fe101b09635d606b1a298be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
af01f7fa32bbefcab5cc69eb189b60c7

SHA1
95353419ad18cc519681775a255d5680da16e54d

SHA256
79ec21293f281cfa2896a58ed39e954fff36b755f97d3de3a1ce859276c69311

SHA512
1aa91842d6cc9cab6577ef3a84e7c044545954f37c88fa67e8febfd0da691b8f08ef0f8faa09933ca7edeb5b43bc602aa778ab7fd4fbe37c6e7ce8db7bb1bfb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d225.TMP

Filesize
48B

MD5
fa42929103b664de121411e71a23e58c

SHA1
3dd9aba8d87ea7635eb3a5be83db6e01493ff2c5

SHA256
666c407f7c83b52828bf293902aaa3c2421870ab8db33181cf3576bdecbb5892

SHA512
7221a439f0bd9ee392eafe02959582d66ed27749b4ec7b8aa7aa8b9197e0bb094cbdf0950abfcae80aeccd7fbb7df86e784d8bda90b99bec3765f7b164d618dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
84af7d261c7b6b96cb46e16ba50d7c54

SHA1
281a8f09d0f39fa5a8c635f8027f491d38693b51

SHA256
4db430b55fa766583e173a5e16a4b582bc04f66ad7efe80d501f1f68ddb14dfe

SHA512
58c0471b7dc5bfc386e813af62a792ad67d35769e03cc99762c4e136b4d805d0307ba5fe6c475810b506cdb28f4f7b97698c11f04d25c8d58085dfe4152f69fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579318.TMP

Filesize
538B

MD5
96a553539f6f28110bfcae468099947c

SHA1
da2b9b556295fc469859035570ae3948081560de

SHA256
6be762b7f1739e2c7e4dda90ea530393fe8d5145d595637db10626625c0d83c3

SHA512
8918ccc867ac67c4f30dc0aa140cf8f125e736ca5739b08e0fb5f5ce6ff16ae330abc284a6a580d6e92714cd6cff507f6875a52da977336675f481bc84dcadc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
ba50f6fcf6b1e0dfd9d439ebfb64b4c8

SHA1
1cac28c2efc976ae14aad96194140feebfd96cf0

SHA256
eeafbcb42218b45a82060c1e3ceff4880981d5de28d714947e033553331b242a

SHA512
be622eaf107ac6cc020287ca9b9e1c2afd7f8926e8e22b11dcbd88e0b226e70ba73fec382106a4a0b764984c5ef10a23a30dda1cfce94b86644138b0bbfe16d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5be48168479536c5a6204a4f361838b9

SHA1
dd77623ccd79f10170b1784b7d76c8361f6c4a68

SHA256
d9397388c660d2837b6504c1c1c2ee98abed8402e00a1fb8ba108be7fb0f32b0

SHA512
37715aaa7b026a21481054ca743b9dc85b7c4be178464049f1bfa55c479464e276550c13eb9a3ab2d649bd322ab2e666194130e68d4864ae6cdb088bde407be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
362303867243c3b214d2f8145fa38b98

SHA1
205d66c13ec5ad7913f821f77e06971052dbb0b7

SHA256
d77d47fd00ded6a5a3a51d065d051f5d707c8fe59d06d614ffd1df404211fad3

SHA512
0bf5e50f438c6395d8dbb8ad041778f6e5afd104d9ebd24dc5f799de203bacd6dd3ad6c925920c24b26ae5836fbc7cb57b95fa91b45e3d1db35364504467e9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
4c8938354318a6cac96d0f3c4d714631

SHA1
b3de2f927e4b1bcea0efc123cb142519840e5f70

SHA256
ff231ab0e10c34cea23fdb0bbb2a39a14304a2d0985ccbe5ebc769f9a6ddf135

SHA512
754ad32ef8e5780459c85b5567052cb94ebb5042a4288fcd6e67d5fe086130ca34301f89cc402670a060b66a699d386f7f76797a4d600530a6072feae6d3b067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
e1a7c600272a5569cf114c396b91a17b

SHA1
c09b6b9afa1e94a6143110f632f80a4c3c5ad98d

SHA256
c3bf9cfed35a6bcbd6ece5b41d0ac0e017ef457779e64b5658a80016a8bee9e7

SHA512
65d0a58110253e59d04e57c22929e8ce9325948f27157338ae5e15e5d480488ffeb29807ff3d20a0957efad27029a6d15184bc40e6a2a541f0ff0949316a59dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L5PFD.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L5PFD.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N4DL0.tmp\MacroRecorderSetup.tmp

Filesize
3.0MB

MD5
8bae34fc4511436b019fc4c1d2241f8d

SHA1
71250d7cb06c8db37b4c9cbc9b3015ac7999a66e

SHA256
46a4b12bb53856c1756c2bdb283247dbf4bf9f3faffb341f10bc8e5d97b68efd

SHA512
b2b408a1dad165f31d9a677f201cf23b8fe74d1bb85b366a62a7f85b52286953ae526b2ae6d8b2f829f220b4d5869fc5db10068a2f413582640003e7dcbebcf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N4DL0.tmp\MacroRecorderSetup.tmp

Filesize
3.0MB

MD5
8bae34fc4511436b019fc4c1d2241f8d

SHA1
71250d7cb06c8db37b4c9cbc9b3015ac7999a66e

SHA256
46a4b12bb53856c1756c2bdb283247dbf4bf9f3faffb341f10bc8e5d97b68efd

SHA512
b2b408a1dad165f31d9a677f201cf23b8fe74d1bb85b366a62a7f85b52286953ae526b2ae6d8b2f829f220b4d5869fc5db10068a2f413582640003e7dcbebcf1

Download Submit
C:\Users\Admin\AppData\Roaming\Macro Recorder\config.xml

Filesize
2KB

MD5
8db91146d278ed1a86ca4bb937e4ad59

SHA1
5a9b6750147d8acf9d233746b99a32538928b101

SHA256
cbbbc69f14e510a55666306cd871d8364d199547714c8367351196efecda4d47

SHA512
6c3e9a21c815574cd60e61cd72a36b1d8d1bc5f604ded5e03cea12694fbe4ea6207a4aa83d3746b41de907c781c756435ffff92f491f3125d3d441ab4fa8c880

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
904371b2ce6ecc95d51bf066d8f54a8e

SHA1
b50cde01c7004ad7ee71f7a4db93be6e8f755ce2

SHA256
b73c83ebd11abf8171f4c937884eab676e236dab67553d8fe95d41088cb1b75d

SHA512
912d5430b758802e78d2cccd4cc77c2ce3e13c36524a8c1b23c6705719dae866711bfa67e63ea2ecd7c257f90082426dd7be2350c6beb1ae9f4cffe05c7795ac

Download Submit
C:\Users\Admin\Downloads\MacroRecorderSetup.exe

Filesize
40.1MB

MD5
4c7e71390357acf2936fe89d8661c178

SHA1
8b3c3cba7ace5c69d36d85f09f0db26f071dbb61

SHA256
ab954efae53001fabfaa88cd4a64f5b17b87b7cc25ec9f711b82af4c5580f567

SHA512
9ae7d580a9c81aea02c80f12c0a8a889d2b79a6ec0a3859e9c513c5f0a7f04daffbf91d3da600ff288631297e9c840393dd310a8946310e734ba9c59e777661c

Download Submit
C:\Users\Admin\Downloads\MacroRecorderSetup.exe

Filesize
40.1MB

MD5
4c7e71390357acf2936fe89d8661c178

SHA1
8b3c3cba7ace5c69d36d85f09f0db26f071dbb61

SHA256
ab954efae53001fabfaa88cd4a64f5b17b87b7cc25ec9f711b82af4c5580f567

SHA512
9ae7d580a9c81aea02c80f12c0a8a889d2b79a6ec0a3859e9c513c5f0a7f04daffbf91d3da600ff288631297e9c840393dd310a8946310e734ba9c59e777661c

Download Submit
C:\Users\Admin\Downloads\MacroRecorderSetup.exe

Filesize
40.1MB

MD5
4c7e71390357acf2936fe89d8661c178

SHA1
8b3c3cba7ace5c69d36d85f09f0db26f071dbb61

SHA256
ab954efae53001fabfaa88cd4a64f5b17b87b7cc25ec9f711b82af4c5580f567

SHA512
9ae7d580a9c81aea02c80f12c0a8a889d2b79a6ec0a3859e9c513c5f0a7f04daffbf91d3da600ff288631297e9c840393dd310a8946310e734ba9c59e777661c

Download Submit
memory/2448-1123-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/2448-1146-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1145-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1144-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1143-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1142-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1141-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1140-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1139-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1134-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1133-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1132-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1131-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1130-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1129-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1128-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/2448-1127-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/2448-1126-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2448-1125-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-956-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-932-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-916-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-917-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5176-918-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/5176-921-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-922-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5176-933-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5176-965-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5176-964-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-960-0x0000000001BA0000-0x0000000001BA1000-memory.dmp

Filesize
4KB

Download
memory/5176-959-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5176-958-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-957-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5176-915-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/5176-936-0x0000000000C10000-0x0000000001AD4000-memory.dmp

Filesize
14.8MB

Download
memory/5176-937-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5304-914-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5304-831-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5304-854-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5940-911-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/5940-896-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/5940-903-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/5940-837-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/5940-871-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download