Resubmissions

06/12/2023, 18:14

231206-wvml1agb5w 10

06/12/2023, 18:05

231206-wpghssbd87 8

06/12/2023, 18:03

231206-wnfj4sbd82 1

Analysis

  • max time kernel
    267s
  • max time network
    313s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231129-en
  • resource tags

    arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/12/2023, 18:14

General

  • Target

    https://rodhigital.com/ambalwarsa/file_ver_9.rar

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 19 IoCs

    Detects Themida, an advanced Windows software protection system.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 58 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rodhigital.com/ambalwarsa/file_ver_9.rar
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f9b03cb8,0x7ff8f9b03cc8,0x7ff8f9b03cd8
      2⤵
        PID:3172
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
        2⤵
          PID:4308
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3944
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
          2⤵
            PID:3496
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
            2⤵
              PID:4016
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
              2⤵
                PID:1448
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
                2⤵
                  PID:3300
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2304
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1436
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4820
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                  2⤵
                    PID:4340
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                    2⤵
                      PID:4420
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                      2⤵
                        PID:3456
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
                        2⤵
                          PID:4088
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
                          2⤵
                            PID:3200
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
                            2⤵
                              PID:1840
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
                              2⤵
                                PID:1764
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                                2⤵
                                  PID:3444
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
                                  2⤵
                                    PID:1816
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
                                    2⤵
                                      PID:5104
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
                                      2⤵
                                        PID:2304
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
                                        2⤵
                                          PID:980
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
                                          2⤵
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4012
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
                                          2⤵
                                            PID:3008
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
                                            2⤵
                                              PID:2144
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                              2⤵
                                                PID:3444
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                                                2⤵
                                                  PID:4748
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
                                                  2⤵
                                                    PID:3596
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
                                                    2⤵
                                                      PID:3888
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6508 /prefetch:8
                                                      2⤵
                                                        PID:3308
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5752 /prefetch:2
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4004
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                        2⤵
                                                          PID:3020
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,14435025311365464905,18335183967805453553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5028
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:2964
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:1812
                                                          • C:\Windows\system32\OpenWith.exe
                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4484
                                                          • C:\Windows\SysWOW64\DllHost.exe
                                                            C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                            1⤵
                                                              PID:3996
                                                            • C:\Windows\system32\rundll32.exe
                                                              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
                                                              1⤵
                                                                PID:856
                                                              • C:\Windows\System32\rundll32.exe
                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                1⤵
                                                                  PID:424
                                                                • C:\Users\Admin\Desktop\setup.exe
                                                                  "C:\Users\Admin\Desktop\setup.exe"
                                                                  1⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • Drops file in System32 directory
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1848
                                                                  • C:\Users\Admin\Pictures\Minor Policy\mGQb8kgBUBZGM4XX94s5UaeO.exe
                                                                    "C:\Users\Admin\Pictures\Minor Policy\mGQb8kgBUBZGM4XX94s5UaeO.exe"
                                                                    2⤵
                                                                      PID:2608
                                                                    • C:\Users\Admin\Pictures\Minor Policy\M2_JlR4wTs55CcvJ0KzVH360.exe
                                                                      "C:\Users\Admin\Pictures\Minor Policy\M2_JlR4wTs55CcvJ0KzVH360.exe"
                                                                      2⤵
                                                                        PID:1228
                                                                      • C:\Users\Admin\Pictures\Minor Policy\qzvo3q0DFiXKkhfWIvjTO9Cf.exe
                                                                        "C:\Users\Admin\Pictures\Minor Policy\qzvo3q0DFiXKkhfWIvjTO9Cf.exe"
                                                                        2⤵
                                                                          PID:4112
                                                                        • C:\Users\Admin\Pictures\Minor Policy\tvo7mxGsFtKybaZmbh5wmHeN.exe
                                                                          "C:\Users\Admin\Pictures\Minor Policy\tvo7mxGsFtKybaZmbh5wmHeN.exe"
                                                                          2⤵
                                                                            PID:1840
                                                                          • C:\Users\Admin\Pictures\Minor Policy\jZPYws7fchcK_G5U0nxQlwb2.exe
                                                                            "C:\Users\Admin\Pictures\Minor Policy\jZPYws7fchcK_G5U0nxQlwb2.exe"
                                                                            2⤵
                                                                              PID:3140
                                                                            • C:\Users\Admin\Pictures\Minor Policy\Ui2yTvmXvWu8rarjQYPvlEYd.exe
                                                                              "C:\Users\Admin\Pictures\Minor Policy\Ui2yTvmXvWu8rarjQYPvlEYd.exe"
                                                                              2⤵
                                                                                PID:1260
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                              1⤵
                                                                                PID:1556
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                1⤵
                                                                                  PID:4500

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                        Filesize

                                                                                        152B

                                                                                        MD5

                                                                                        5d6afc2bfd830a32083c64d184e5a220

                                                                                        SHA1

                                                                                        3d83d57733d0d717e32a7ece2912e5593916b08e

                                                                                        SHA256

                                                                                        05d7bdda813544520f5a4b50509e7b29c24733b233b1333cdf9d5f6016dc7c88

                                                                                        SHA512

                                                                                        29db7c4e85dc41eabc07be506a05df8dbf8b8b9380eeb719ae0e6413afb29e9d823ebe901ed3f924746ca1b99f86f58d93a0a7a7263ee6efaea3eacd6f30b47b

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63bdf198-a5ef-4fc3-81e2-267d31ad4b53.tmp

                                                                                        Filesize

                                                                                        371B

                                                                                        MD5

                                                                                        a9247f8e991c62359bf268ebee71fbe4

                                                                                        SHA1

                                                                                        bc986e851efe9808f4933ce380fc545e7aa3f164

                                                                                        SHA256

                                                                                        063a95f9c3c44a2fc0edec04030ccf95cde381afc0661ea043cba74c21af9021

                                                                                        SHA512

                                                                                        2fc07210ce7bbe41b939ab8ba083196d46bb6eff91fc91533b60101482dd768341d65bd510fe227f41f352d1946ed6f44d988b1f69dfd1cca86f50233211a876

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                        Filesize

                                                                                        864B

                                                                                        MD5

                                                                                        f6016d8cbd44213b1a363e28319fb77a

                                                                                        SHA1

                                                                                        79937eba7c9ce1dac95840acb68bb871f48c88b5

                                                                                        SHA256

                                                                                        88ccfe11622e0de70e5c542d661771a6dc6afc0782863dde637626e4ed2e9652

                                                                                        SHA512

                                                                                        50b4d09be3a543f38b98de9af3957483ab1cd6cdbae48546eeedd7b3966a4b34cd2e223432ee3ca5f20fcc7f4376e0c4eedc57c4aba4d85a32ab253226daa823

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                        Filesize

                                                                                        192B

                                                                                        MD5

                                                                                        336593b067ee5b560657d3dbef71c2d9

                                                                                        SHA1

                                                                                        96c2c3e34e72fdc7c4956fabbc3bff48157f405e

                                                                                        SHA256

                                                                                        e2d7f4901bb64a30937f70015eedb03642d23d259ad9fa8d698cfab5e86080b5

                                                                                        SHA512

                                                                                        6766a5bfcbee46e26ff1f02036e801c83a0a2e8c92f1a597280667449aa22aa3df86576b115a8525b2f7e4a75500b34a19b021b5503e77556498c1c6886526e3

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        2763b65a682411b5096275f12a3f25a1

                                                                                        SHA1

                                                                                        bffbcd9150c330bc609c4cd81988fad298ec98ac

                                                                                        SHA256

                                                                                        76e975f2be0562283d5525eec408c0c5b17b142facfe9aaec4bb886a8b02503f

                                                                                        SHA512

                                                                                        57f21b57b6dbc70c2b119c7e07425b10541e9d39396444e00857d5b1a445cb2d67acd38bd6cd51e953e50bb5c21ba76fc92febae16d30967612a462bbfcac4f7

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        d37630368461d7a9c57aa78581e41eef

                                                                                        SHA1

                                                                                        1b6181ceff31d0ccfc861cdfcb6905e2e80225fd

                                                                                        SHA256

                                                                                        ca77190748cd65ae3c70facef58610e484edbd82ec049b7446939ac3bb68eed6

                                                                                        SHA512

                                                                                        ac1847ed277df7f6a6aaa995c8e310e345fa43a71afabf8437d72e4425e8240bb7783f6d336b060cb657a1236b7db8490059dae567dc645c44849721193bffc5

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                        Filesize

                                                                                        111B

                                                                                        MD5

                                                                                        285252a2f6327d41eab203dc2f402c67

                                                                                        SHA1

                                                                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                        SHA256

                                                                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                        SHA512

                                                                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        76494344a40fee1c21531868fa36a88e

                                                                                        SHA1

                                                                                        f3caf6a5f9dc3add23ce4057c733be3d5e68d888

                                                                                        SHA256

                                                                                        0ebade92fc20bcb60fa087d14ac9d234bd3f9c9a3274765e95b6b2d16e3568e6

                                                                                        SHA512

                                                                                        6dc12f2829df7ef237a2b0149998c9be64bf319bc14e6b5ffdcba3c2f2530d795f3b531098d915e4bcb267eaacde10b42226305197d59c89c06f6cda3349ff82

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        19f21dbfdb0cd5dbf6a3f17467cfdc09

                                                                                        SHA1

                                                                                        02e200ab8a17a12f8f1a41b078b6e211f2cb8b58

                                                                                        SHA256

                                                                                        de3159fbe15e3b039e3a9cc6ad7a50d08b36f94d6c0deff6e97650927881b87b

                                                                                        SHA512

                                                                                        a26a14b89064e1451c23dddbc83b6a80a22c71ef55aba7d06ad321f9505481690493faf66e706d903488c5bc98aadc9f9dea5574b2db6bd4c0cdcbf80cbe0fc4

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        6KB

                                                                                        MD5

                                                                                        605ead38f5a5b63c2c47e9c19f4396eb

                                                                                        SHA1

                                                                                        04a6f8c1304db57eff3caf59153693b500aa0604

                                                                                        SHA256

                                                                                        6e3ea184ea98468413f5b0259354de4e29241845197448870ea68270d96e277a

                                                                                        SHA512

                                                                                        75d1e4e1107804ec474fc83818797573ab14b2ef01d7fd88a3f5c4f65fd84a8da3c7f9c6e008668c0af3a1d6fbe18ae26ebe532a5f4982df814f38db1d052688

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        6KB

                                                                                        MD5

                                                                                        5be62c8401f182831567f925e9f8eff0

                                                                                        SHA1

                                                                                        a52f6efdf5f9ea139433e92d8b44125903ac05ad

                                                                                        SHA256

                                                                                        26ffbf6537acaf49426435d4733f4dc7d3d827a1ada161652515456d603f2e31

                                                                                        SHA512

                                                                                        7f7816072064e45b3f4b045a22ab7dc2714d3404b6c39a641873ee45fff462fa2f1f6e1812b992eb6db189239790b3377b925e4cb14f18d1afd55608d8290611

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        6KB

                                                                                        MD5

                                                                                        d3f7809f4142310044e180851130f1fd

                                                                                        SHA1

                                                                                        f99ad34df21bef164a50b6783ac556c1883914f4

                                                                                        SHA256

                                                                                        11a9705e137a71aab3f474048b42a6d98a0ece9987f8804790f0c73465a915a4

                                                                                        SHA512

                                                                                        7157912529b0e951fd28a9ccc3a9317963d40fb97248acb34696d45f48b733bfa08e766caf7304bcecace0eeea13e61a867e1b8ea1cdc8c1a200d53a73be6339

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        0f1d28fd43e48cc4081c7edb02644505

                                                                                        SHA1

                                                                                        e1e0909d83416964cba9c73134372d40e84d751d

                                                                                        SHA256

                                                                                        68fd6d26886df8d32182397eff7e1e19c763e7fc0150a02a041d8260b078ec68

                                                                                        SHA512

                                                                                        ce3cbf4a99181f456050a3d861a6b6e981ff365bb3d12e3f5459116165812b02d9d3fc6d532194aeba6a7cda734564c60babaad73ca56f449248a0cb0c2994ed

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        6KB

                                                                                        MD5

                                                                                        32bb4707f61a1920a5235bc1f7d24838

                                                                                        SHA1

                                                                                        98dc5eb90430121f015d147ac15ef2af2cde670f

                                                                                        SHA256

                                                                                        55d4b5f643f5733df1347f9ed70a04cff11b8226e578a6403634b10a881c8274

                                                                                        SHA512

                                                                                        76296a949cf1d23c397bdcd3268fb3bc557dad68dce3d4db7ea5112751b5befada2a804092833b9e8ac398eb24b7697de2f3fb97771e7e0621392239749f2117

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                        Filesize

                                                                                        25KB

                                                                                        MD5

                                                                                        1dccb6cfbf5557e99e110e1c88971dcc

                                                                                        SHA1

                                                                                        bea4891349f510ab586da6304f99ccc0eefc8282

                                                                                        SHA256

                                                                                        b13e021c0aa2eab302a1ed8934825d6b884a5f86e44810507458e0462f266cb4

                                                                                        SHA512

                                                                                        6d4876ba1ac513c9494186311eb9134817273ae3020bff649c42d74cba516ff250eefff727881e62655fe6961b4cb663ff6e288fa165dd6fc02e5f965b080359

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        0251ac54f1b0ed7d2c41f4ae75d9f4a1

                                                                                        SHA1

                                                                                        aba7998910dd20ec5312a870f075c81f5f7ce34e

                                                                                        SHA256

                                                                                        e233bb95dc7f9f3aba4665bc19f3ecf4febcb1a66e509a41de26ca20fa731d26

                                                                                        SHA512

                                                                                        2b496bc20f4e8d14b83eb60002f663d9601e040f3a0ea9b0f41640d456914c366f174ae9e862212bb15b64096efc6799c2a0701ecbee1d4be19649d3620de800

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        371B

                                                                                        MD5

                                                                                        14bf6c49254640090a8eeadb4af500a1

                                                                                        SHA1

                                                                                        6d890051006fb5941e17786fbe66ce129a4422b7

                                                                                        SHA256

                                                                                        e5b5c35ea8e1774c0aa30aa91cf7e8045236c0b869fdce2a8d8874c4a21ab6d5

                                                                                        SHA512

                                                                                        c5647139ba27718baf3c78f158abee9833c834cb6023d90f41eac413c8faaeffc6d4a5f5bca006148052a6b6335014001c4853930fe98dfef873917f15c3d4e6

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        18d0bffbb3922ac431513c1eb33d2132

                                                                                        SHA1

                                                                                        41582d89a963dd702de8a0c3809c147d8e7d6305

                                                                                        SHA256

                                                                                        5767c25c0a88c6c20cf6621bc697b9ba7a72bed9c6c8ad32a3b688de27d85472

                                                                                        SHA512

                                                                                        abd7ac21aaba9ecd5a4f198cc82adad6e0f82700da1cd769286c1734f7dc0ace5b4ac5c5044f086a2a5932e85e09b7e592462b540029c0a3e5aea5daaa33698f

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        bbdf9cc22bdaebcd517165483165b553

                                                                                        SHA1

                                                                                        c36f897726b651d1f5d121cc066007e227f7521a

                                                                                        SHA256

                                                                                        3649127538748bac066f0e514f2f702379a294adea25186baa0a10924a14e957

                                                                                        SHA512

                                                                                        01041c2b42c2f21755062a3a4c4b27027ec7b531619df1fd2957a4e4580d49b7b52d9382c7e9c17ef656e9d616b354f6f8cb02f9c34a17cf49f93f238007a9ed

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581d37.TMP

                                                                                        Filesize

                                                                                        203B

                                                                                        MD5

                                                                                        d98ab4041dbeea35ac95ee50c6d45c02

                                                                                        SHA1

                                                                                        a29817d569b3678f53513bfc6f80610904f7510b

                                                                                        SHA256

                                                                                        a061ac2b42e6636c396ab79c3ce612ffdbc7dcec364c14640d0a832339da57fe

                                                                                        SHA512

                                                                                        90bc66a4b85423716cba56c022d201031c59afd8bd9f0d9d7c9f11f46ad888fe29107f7081e604b01d67ec4ba2ad0b5bd6f7660ebadaf98d5b1fe561ca84e788

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7dc2ee5-e8d9-465a-a463-25e12416b828.tmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        8ee28872a5cc934ee923b111b94308f4

                                                                                        SHA1

                                                                                        7e5333812840833b404469162b4cc7178d8f52f9

                                                                                        SHA256

                                                                                        ed0fd0845b79732474cdaeddd017cfdc877ed984764534165c9b1d7495b707af

                                                                                        SHA512

                                                                                        f501937a1a56d3734268f2dbf7d6383cf2c6d46b16a648f00841e166ef6044d5fd72437155f5e89aeed34d9898b585af1a089d3eff6e8076232806b9bc72f0b9

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                        Filesize

                                                                                        16B

                                                                                        MD5

                                                                                        46295cac801e5d4857d09837238a6394

                                                                                        SHA1

                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                        SHA256

                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                        SHA512

                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                        Filesize

                                                                                        16B

                                                                                        MD5

                                                                                        206702161f94c5cd39fadd03f4014d98

                                                                                        SHA1

                                                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                        SHA256

                                                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                        SHA512

                                                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        a742ab0f533b11ce9bfff3f9a8c86298

                                                                                        SHA1

                                                                                        3cc2aecbedbbaa7fdadd80eb16b14393537ef5c9

                                                                                        SHA256

                                                                                        252ee644d6d8a8282aece6a286f1035d74ffb8f5e0bc5127457cbb255cd8285e

                                                                                        SHA512

                                                                                        0165f5778a58f78c6f9b03669b5ddde25b38b0988d6a66f6f1a5008269e7f05234e9b799f0deddf77a44e9d451516b9e73d8a395c6a6f389b1e758c6ef25cc27

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        84ec7d932354e9320f1245f9eeefe912

                                                                                        SHA1

                                                                                        f22bb64b4efc991d749f98815c4d95483b31f251

                                                                                        SHA256

                                                                                        dc61f603b2007545d12b5607094d052bd8089823bbe3fedd63d8483c3585d703

                                                                                        SHA512

                                                                                        e901c438aad2b663db261c46cb41e0d8ddd134b0ba278b4a7d73e9438e76ab408948aff59ad9729bed7da909b9be9a304a189a85afab5138dec3eaef1216edb3

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        9b6429c868cf5c1d5e4255e8e525a3bc

                                                                                        SHA1

                                                                                        2c24fba84ba9d4beb6686dd7a86cbcb823ec2fab

                                                                                        SHA256

                                                                                        b403021bb77d1e35208cae8f346e851e271c47dd7ea75933c358c29188352b55

                                                                                        SHA512

                                                                                        d473801f02ab55064377f5f4070dc81bab63c20768cc8457b066be64c221bf3c0b2947b0668c4f42b6cb28eaeb9901851ba68395b99f9271446615a0d7515a03

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        2dea076cdc2cd1133e7f754dede803bb

                                                                                        SHA1

                                                                                        81a43b5be730fbf9366e29302ce3bf833d7a7ebe

                                                                                        SHA256

                                                                                        129a702e46b7b0c2909a5934845339ab42580351c0e90620b4959a8d6e9e13bf

                                                                                        SHA512

                                                                                        2ff2d739c907c2f1a6ff96b7b33c76a6f32efc16d3481f0337095a5df222fccd264276261dba898c9c58b8061415979f555eb0de4e4414ef7b2a697490807290

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        c8e0e1be6dfc371efc5c29daad91634e

                                                                                        SHA1

                                                                                        29b80052a65290f5ddd06a96fd1ff81d852b159c

                                                                                        SHA256

                                                                                        fe6db576370172528c42d53e3d20f1637b9144d8d1aee1c52325a8d38d8ae281

                                                                                        SHA512

                                                                                        6213e99486a8d3afece76db8d8c44ee2b6cb489b1aced89b6e8ecd0e29ca5860b8e9afec21f4955cf2369c50a14b68519cb136cfbb74caac8afa444b2ffce1e5

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        24264849dcb8bc54bcda9170d3640bb7

                                                                                        SHA1

                                                                                        9be663223a2a8acc47acfb774eeab21ee0acc95d

                                                                                        SHA256

                                                                                        2df59cd57b50a61a2404e6c153ad49d62bc46e8931351964041fc0895e517b37

                                                                                        SHA512

                                                                                        4c63c96685aecc3c424a3a1c815cd844d441c2fc3e63187de03c54d467ad07867681a33ec11e4804422afe4cd511c00d9b3b1022f86f559bb2d2dfc314f4a788

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        ea0bdcc1af5d56a450c3e5886f2eae6a

                                                                                        SHA1

                                                                                        a264e02566dee9c82b8e66e0a4b33c083a17f08d

                                                                                        SHA256

                                                                                        9ec569b7c4b428a80c995c60e95dfc20cc715de38aa755667d5adc9f55b8d600

                                                                                        SHA512

                                                                                        a494a31ea8d0a8c61020e9ca43e730ab05ae83cc15b1a3ab7a02f81469290ef48b34554bdff934fc37ff8791ba9cdb393dc1cc144539a80b9038f459e651e44a

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        d40275a682e816072428b499a10c51b4

                                                                                        SHA1

                                                                                        112c89596c1ff1198aa7fb5d564a66aec3839a55

                                                                                        SHA256

                                                                                        98bd081f1313e0a225647c453d134ab2f3426ed662c876075ef2bc749880f60f

                                                                                        SHA512

                                                                                        cc573896c27fc676daa9581c638e5bdbd9778f3e25522a01af64394ef27dcdbebb73c947212b117c0d73dac17245c59f9a7f42ff87729dcae05995fabdf0053c

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        074c63967440c508edeb13b763b3c9d2

                                                                                        SHA1

                                                                                        0eb65a35e2b1a13099ba908550f41fb15c97836c

                                                                                        SHA256

                                                                                        4eb1d035d2ec66dd1f189edff01761ab3f6783b33cdcb1b183c62e3e6f3a9503

                                                                                        SHA512

                                                                                        4515bb67d25e77a1fb71914eb8b90adb472f2713ce64d2f0bf139f9cbfd4e6521418009baebe6a0a9014b541a4d73a7ad2e8d2c5ca005ffda45b69563a83b0b0

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca00d4ce-02ba-4b20-9958-9f75689860b7.tmp

                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        75ca0678b76bd2ba164ea12887885a4c

                                                                                        SHA1

                                                                                        1ff01154e27ed68b9d97bee683f61d28fd5dfade

                                                                                        SHA256

                                                                                        f139b3e9c8dae496cb1b4bf573f85c454c7f325dafb44fd40e9eb1a9e28a6dc2

                                                                                        SHA512

                                                                                        d43a6c7e02b73308bb4fc2f908d032ada00a74561c37228a80626c4d0adb030b3c02576648bb3b6340e0f3f479e2f37461a6138339324b3b20a8504bfc30cbf6

                                                                                      • C:\Users\Admin\Desktop\setup.exe

                                                                                        Filesize

                                                                                        422.4MB

                                                                                        MD5

                                                                                        358d1bde6ec08a262e7cc121cda91fb3

                                                                                        SHA1

                                                                                        bf49d196bd77a897eea404e4b371c90c47edbc64

                                                                                        SHA256

                                                                                        cc6166ff8efd299688107802cd339dacbf67c311a7532294294222af6e2ac671

                                                                                        SHA512

                                                                                        2d52b65680cf2d6eee3a8f32e7fb3049427f1225d36c5143deb54316ad1256be37484b7290fc5aa779136857e82eef313a3999b6a334ce66a718f01ac2b63e21

                                                                                      • C:\Users\Admin\Desktop\setup.exe

                                                                                        Filesize

                                                                                        422.4MB

                                                                                        MD5

                                                                                        358d1bde6ec08a262e7cc121cda91fb3

                                                                                        SHA1

                                                                                        bf49d196bd77a897eea404e4b371c90c47edbc64

                                                                                        SHA256

                                                                                        cc6166ff8efd299688107802cd339dacbf67c311a7532294294222af6e2ac671

                                                                                        SHA512

                                                                                        2d52b65680cf2d6eee3a8f32e7fb3049427f1225d36c5143deb54316ad1256be37484b7290fc5aa779136857e82eef313a3999b6a334ce66a718f01ac2b63e21

                                                                                      • C:\Users\Admin\Downloads\Unconfirmed 448066.crdownload

                                                                                        Filesize

                                                                                        734.0MB

                                                                                        MD5

                                                                                        9ca986be3ddcd99536bd9cca76ce7689

                                                                                        SHA1

                                                                                        c8478095373808d431c2ef7715e8b7d8e043aea0

                                                                                        SHA256

                                                                                        ffeb5b7a8cd4091104b79b738d5dcf9b0346336e1d6c735432a439b7cce05c0f

                                                                                        SHA512

                                                                                        220135b935004aa91872023ac09517a0e4d91d8620532d820276892bcc0d4f393b3d9c270026e272333f200dbfd2e9245c765ee315781bdc096d5467cd7aeebd

                                                                                      • C:\Users\Admin\Downloads\file_ver_9.rar

                                                                                        Filesize

                                                                                        9.8MB

                                                                                        MD5

                                                                                        fa4d5ba8567bffbf8ac098079ef8c25f

                                                                                        SHA1

                                                                                        fba4a16e4b2cc027c44be2553488452d136e28ac

                                                                                        SHA256

                                                                                        cd1207e5e78c68c0ae2e3b6874c53810b19bf4aaa67d51ff67a9fda8837ac846

                                                                                        SHA512

                                                                                        0c57f09ef8a26cbc9d9d49e01aa75dac3813969c7916ca7d6c46a8965d5c398dd81bff1f0b74181d689de61bacbab16fb744bc5f5d496b7a30833ab177ef055a

                                                                                      • C:\Users\Admin\Downloads\file_ver_9.rar

                                                                                        Filesize

                                                                                        9.8MB

                                                                                        MD5

                                                                                        fa4d5ba8567bffbf8ac098079ef8c25f

                                                                                        SHA1

                                                                                        fba4a16e4b2cc027c44be2553488452d136e28ac

                                                                                        SHA256

                                                                                        cd1207e5e78c68c0ae2e3b6874c53810b19bf4aaa67d51ff67a9fda8837ac846

                                                                                        SHA512

                                                                                        0c57f09ef8a26cbc9d9d49e01aa75dac3813969c7916ca7d6c46a8965d5c398dd81bff1f0b74181d689de61bacbab16fb744bc5f5d496b7a30833ab177ef055a

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\2rdjYYkts3aG3lQMgSG0OMRG.exe

                                                                                        Filesize

                                                                                        207KB

                                                                                        MD5

                                                                                        72ff1a0979f2db84d51cc0b9806ea2e2

                                                                                        SHA1

                                                                                        6dbf1a85876359ce8746860817eea4bde56c6450

                                                                                        SHA256

                                                                                        93332b06dbc2a5b150c21e002c830cba728beeb29356b7b473e025cd4c8ac8cd

                                                                                        SHA512

                                                                                        41b6a1bfc103b991942c41297f92e9660d77614d3f7d0c29070f257afaa52e40ce6a7ef1751bdd2faaf861062d6b535a50700d9cda8ed33dd2d755ec445d6d7b

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\4TffaLgcvwZ7LjadTHwY5Ot8.exe

                                                                                        Filesize

                                                                                        207KB

                                                                                        MD5

                                                                                        6236701ea29df7e27122613352beacdc

                                                                                        SHA1

                                                                                        0c2b047812abcab35e3a78d3d8dd3323f52a7d23

                                                                                        SHA256

                                                                                        00b4d8c7e037d9851932a1ad6775973a7b39eef7fbb0412c7443708cf53d7312

                                                                                        SHA512

                                                                                        d286ff907fecc1832c1d7cb5d1cbeef4d35c3a8e560392c8f860a20df569e697a8ba957174ed5ce3953575e0e1956153d753075f300b0991d8b59358bf95da7d

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\M2_JlR4wTs55CcvJ0KzVH360.exe

                                                                                        Filesize

                                                                                        320KB

                                                                                        MD5

                                                                                        1ddd1bcb548e165f425aea4f8f588033

                                                                                        SHA1

                                                                                        dd3661e41749304a90ba9c8734a145eb7e9e9b11

                                                                                        SHA256

                                                                                        e71f9ace11cda5f410a79b132c59c2f09777f7e2df936d7f252a9784bb87603a

                                                                                        SHA512

                                                                                        d8986972b4272b224d82000c2034ef47168872bd9b5f978515d408743545db842c1f28e439061c95ec8e9d69e543afb05a5e26d68fc62d230bdec7dbfed9de9b

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\MXi5SZBR_vkuHdBHBwEcJJx6.exe

                                                                                        Filesize

                                                                                        103KB

                                                                                        MD5

                                                                                        2a8552c70ce830baf75d1ee2a5217010

                                                                                        SHA1

                                                                                        c37fc8d7ad0567b5f7d7d735ca18acb59ced9b56

                                                                                        SHA256

                                                                                        67d528420503e6d8992c77565586e3027728bddc7487e7d0cb3b6c0bd28e2cf0

                                                                                        SHA512

                                                                                        0d9dc94eb95af40438bbf8fc9c7e56acb692886b942d11ac0ddd6939ca6662cbe4e9ebf88905ddd507893b5ee72456744ebead9d8699f8af5e055afa9bc10c0b

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\R9o0wno9r79FOm2UTLaF4rGS.exe

                                                                                        Filesize

                                                                                        64KB

                                                                                        MD5

                                                                                        32a1137a619207777942b2ec6938c211

                                                                                        SHA1

                                                                                        bc63126045d34cbc2e84c3b5cd310ddb4876237b

                                                                                        SHA256

                                                                                        ea6a39ed9e8e3ab24d9b6f92ed24c661817924d6cbed9ab6f23ef0970c8d308a

                                                                                        SHA512

                                                                                        d2589c40bae34da8bb90c64059e8c19615d24b21c4471c78b03ede6336a44259932cf54f5ea17c1c14535593c39eab19b195fa50fac2e08941bac47b9fa15d12

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\UGu366WhAufowkJdnYBe9eWt.exe

                                                                                        Filesize

                                                                                        320KB

                                                                                        MD5

                                                                                        f891c2dc78d2ccd6551f958ed1db1d2d

                                                                                        SHA1

                                                                                        22886b33befd7b548ddb504a8823e4bf3294cd57

                                                                                        SHA256

                                                                                        17b96d2ab2a4a2c5ba1bade194243ccc3026a0950d926e979aab0d3ae6c242e6

                                                                                        SHA512

                                                                                        8fd4f85425f7bab21b8ee8880db76f34348a434d1fdbae775f14fe38d651b89095a43be819baf34010e9f4712d301d0a38a70d0eb5a3d40c24e03a6323e0391b

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\Ui2yTvmXvWu8rarjQYPvlEYd.exe

                                                                                        Filesize

                                                                                        2.9MB

                                                                                        MD5

                                                                                        9fa9314623b44bf818b300c594059c49

                                                                                        SHA1

                                                                                        fee6c0ef0cd01d695284447baa52483c970ce6f0

                                                                                        SHA256

                                                                                        6e374870a01d3dc74357c7fc4fd3c31ef386b9ecfa7b076a39e37d8812f380de

                                                                                        SHA512

                                                                                        4d200f61aff1c89cbd1ad49ae587ff2045f8e04dd6e35fed3ba1415ee387fbd33ef92221c0211cd9204cb8ea1acd32c88a24a9664efd9d5024b18e87db03cea7

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\XNygK3f_Ui8YtHjrwrxmS5h8.exe

                                                                                        Filesize

                                                                                        166KB

                                                                                        MD5

                                                                                        c2467c0757832f860007fb1ce228fc42

                                                                                        SHA1

                                                                                        d1e8f1ec78b19a98e5bcbfb0888c16e5fd1c9d50

                                                                                        SHA256

                                                                                        f421c256d4de1a3dfa74bbb4b48e0376bdc2ee18fa3808dcca085621fdde46f4

                                                                                        SHA512

                                                                                        42f8a6947f29d4dce4118f7cc917f40222595c0df5498f2a2fba8a10fb43a285f8e6a2fcc31d6583f79c4d196830d2bc005bd6da81508f2ab8f165f3845990bd

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\jZPYws7fchcK_G5U0nxQlwb2.exe

                                                                                        Filesize

                                                                                        315KB

                                                                                        MD5

                                                                                        0e92a8764b8f3e3070b0ba90f7201e72

                                                                                        SHA1

                                                                                        aac31e91efda884b2c90a35fd8fec0331aebae20

                                                                                        SHA256

                                                                                        2291965dc164bcb583972b38ed7624e00da9624fae8a8dbd923b291c0e16ce5c

                                                                                        SHA512

                                                                                        40d5f91d70bbdbb7144be140b2a3752f8857f42c8f5bf3c7d362c5c0da5ddf5b26f8cf96c6d2512a95711bd13b6f7e5d0985f0588efec5ece9e4ed039d2526a7

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\mGQb8kgBUBZGM4XX94s5UaeO.exe

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        4fa22c00fcb52b1ca8c1a98129598dc0

                                                                                        SHA1

                                                                                        969e16fc4f57f63436c386bb818105842775f38a

                                                                                        SHA256

                                                                                        41cde2045ee22f3653af266c7e0eb384cef5f532f55c375a7550821679cd3f89

                                                                                        SHA512

                                                                                        3994f0a6db3f0b026b8d7187dee30c5a1954a545b1cfed4c62571e937819a74d25193292cb773b902e4da560fcd34eac1ddd6cece3021d5efaa508415511c5b9

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\mGQb8kgBUBZGM4XX94s5UaeO.exe

                                                                                        Filesize

                                                                                        64KB

                                                                                        MD5

                                                                                        63e3d9b34142e55125441e717fe4e6f7

                                                                                        SHA1

                                                                                        a06e38098089e495293e6088f076b4202bba3633

                                                                                        SHA256

                                                                                        485ce554fbd74e7e2815d76c79dc91cbbcebb5ee2d59f76dc79ab79de84c0ca5

                                                                                        SHA512

                                                                                        29bb03094fef2baa96aa39b424d90ce327d1d63217ea627ca7587d0a137eee58278e424bdcd01704971a737c051b886e2bff3f2015a2e04ad115d4d8cbb8cd68

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\qzvo3q0DFiXKkhfWIvjTO9Cf.exe

                                                                                        Filesize

                                                                                        303KB

                                                                                        MD5

                                                                                        34b781b9198150f170186ab0d9609963

                                                                                        SHA1

                                                                                        20fe73fbf9ff7560a2f799e1969253cf192033ca

                                                                                        SHA256

                                                                                        aec1e6e5c3d2f77eebacdc0e1934133c10ee06cb633dfcc15ac03c53fc7e9121

                                                                                        SHA512

                                                                                        88bcc956c59a2b3aa4e7173216fcb14e692af2c25a70b8eee9d34733262bc57f41000fa85072d70cef171886d94278e5e3a7b161a1a76f3585ccc66cd6580923

                                                                                      • C:\Users\Admin\Pictures\Minor Policy\tvo7mxGsFtKybaZmbh5wmHeN.exe

                                                                                        Filesize

                                                                                        288KB

                                                                                        MD5

                                                                                        4e4c1e82295a9b072596fc514f4d3711

                                                                                        SHA1

                                                                                        4aa80e7543d1e20380d0d0e7efd8341ad6231d72

                                                                                        SHA256

                                                                                        4906f727709a2acc63c9a01b56a66e1a29703e259d26f8dbde9b40426385c0bc

                                                                                        SHA512

                                                                                        f616a1582af6d7361ebeaed6a6629e6cd25e0bbe66069c2ce822fc7d181023088906456313a3ae0a2088ffa9b9e92560ddc780fd480752a565a9d70ceaea9789

                                                                                      • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                        Filesize

                                                                                        127B

                                                                                        MD5

                                                                                        8ef9853d1881c5fe4d681bfb31282a01

                                                                                        SHA1

                                                                                        a05609065520e4b4e553784c566430ad9736f19f

                                                                                        SHA256

                                                                                        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                        SHA512

                                                                                        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                      • memory/1848-676-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-664-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-674-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-673-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-690-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-672-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-671-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-670-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-669-0x00007FF906890000-0x00007FF906C04000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                      • memory/1848-668-0x00007FF900030000-0x00007FF900031000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1848-742-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-667-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-777-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-675-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-788-0x00007FF909160000-0x00007FF909369000-memory.dmp

                                                                                        Filesize

                                                                                        2.0MB

                                                                                      • memory/1848-789-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-790-0x00007FF906890000-0x00007FF906C04000-memory.dmp

                                                                                        Filesize

                                                                                        3.5MB

                                                                                      • memory/1848-797-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-666-0x00007FF900000000-0x00007FF900002000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1848-665-0x00007FF909160000-0x00007FF909369000-memory.dmp

                                                                                        Filesize

                                                                                        2.0MB

                                                                                      • memory/1848-663-0x00007FF9080E0000-0x00007FF90819D000-memory.dmp

                                                                                        Filesize

                                                                                        756KB

                                                                                      • memory/1848-662-0x00007FF9080E0000-0x00007FF90819D000-memory.dmp

                                                                                        Filesize

                                                                                        756KB

                                                                                      • memory/1848-657-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-656-0x00007FF7402C0000-0x00007FF7414CC000-memory.dmp

                                                                                        Filesize

                                                                                        18.0MB

                                                                                      • memory/1848-854-0x00007FF900010000-0x00007FF900011000-memory.dmp

                                                                                        Filesize

                                                                                        4KB