46c4ce58241ddffd9c6576189339bac41b800264ff215547aa8fd31c21b932c4

Analysis

max time kernel
1800s
max time network
1160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cwmrecoilcheat.rar
Size

406KB
MD5

b3a09a1e4cbd62b2fc20c20ba87b2136
SHA1

4e4d1be7eade43d7940ede0bc30d57e4ef209412
SHA256

46c4ce58241ddffd9c6576189339bac41b800264ff215547aa8fd31c21b932c4
SHA512

55bf0197e525c32eafad11e56f503454b29d807658628637e36c042667734c7e4146f51eed77da9e4e5bc613e5e87b908f9dc2a5c1e2c05ad0d980d0b3380718
SSDEEP

12288:djW8DC9uSNsZVkbMuZxa/1gg8aD67tDfxBvb7:dXe9uSNo6JZQ/156pl5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2936	unicoil.exe
4816	unicoil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0 = 4e003100000000005458bb99100054656d7000003a0009000400efbe8f578f5b5458c6992e000000a9e10100000001000000000000000000000000000000af2a9c00540065006d007000000014000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1815711207-1844170477-3539718864-1000\{FED6FF7C-60AD-4861-9663-12DA77DBE218}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0\0 = 660031000000000054582b99100043574d5245437e3100004e0009000400efbe54582b9954582b992e00000011070000000003000000000000000000000000000000a0c11201430077006d007200650063006f0069006c0063006800650061007400000018000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000e693d8d3492fda01257772a2502fda013d54ddf13064da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0\0\NodeSlot = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "13"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1 = 50003100000000005458bc9810004c6f63616c003c0009000400efbe8f578f5b5458bc982e000000a8e10100000001000000000000000000000000000000141eec004c006f00630061006c00000014000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4500	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4124	7zFM.exe
4124	7zFM.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4124	7zFM.exe
2936	unicoil.exe
4032	taskmgr.exe
4816	unicoil.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	4124	7zFM.exe
Token: 35	4124	7zFM.exe
Token: SeDebugPrivilege	4032	taskmgr.exe
Token: SeSystemProfilePrivilege	4032	taskmgr.exe
Token: SeCreateGlobalPrivilege	4032	taskmgr.exe
Token: SeSecurityPrivilege	4124	7zFM.exe
Token: SeRestorePrivilege	5056	7zG.exe
Token: 35	5056	7zG.exe
Token: SeSecurityPrivilege	5056	7zG.exe
Token: SeSecurityPrivilege	5056	7zG.exe
Token: SeSecurityPrivilege	4124	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4124	7zFM.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4124	7zFM.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2936	unicoil.exe
2936	unicoil.exe
2936	unicoil.exe
2936	unicoil.exe
4816	unicoil.exe
4816	unicoil.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4124	1060	cmd.exe	85
PID 1060 wrote to memory of 4124	1060	cmd.exe	85
PID 4124 wrote to memory of 2936	4124	7zFM.exe	101
PID 4124 wrote to memory of 2936	4124	7zFM.exe	101
PID 3420 wrote to memory of 2460	3420	msedge.exe	113
PID 3420 wrote to memory of 2460	3420	msedge.exe	113
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 2756	3420	msedge.exe	115
PID 3420 wrote to memory of 4344	3420	msedge.exe	114
PID 3420 wrote to memory of 4344	3420	msedge.exe	114
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116
PID 3420 wrote to memory of 4596	3420	msedge.exe	116

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Cwmrecoilcheat.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Cwmrecoilcheat.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Users\Admin\AppData\Local\Temp\7zOC1004AD7\unicoil.exe
    "C:\Users\Admin\AppData\Local\Temp\7zOC1004AD7\unicoil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2936

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3060

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC1004AD7\settings.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:4500

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Cwmrecoilcheat\" -spe -an -ai#7zMap9664:108:7zEvent19420
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Users\Admin\AppData\Local\Temp\Cwmrecoilcheat\unicoil.exe
"C:\Users\Admin\AppData\Local\Temp\Cwmrecoilcheat\unicoil.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffced5a46f8,0x7ffced5a4708,0x7ffced5a4718
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9079382795537760447,2613340733782830025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
29KB

MD5
df217f862f4073ce4585999df73a53fd

SHA1
8f39eb965e90eee20c2e94f547acf0db9aec24ae

SHA256
dfc2a82c870fd4c1a5b67929c316aebf1bfe0e8fdb90d64158a111feeae9c0e3

SHA512
f52da493abb8eeae24642e958cfa6ecf50101cdb0038ca7b952a19f0df0531e44828e4d2b9e365fd08a73a3f78009fd76af37a1ae58b8ec526720356c2767738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
eeb2da3dfe4dbfa17c25b4eb9319f982

SHA1
30a738a3f477b3655645873a98838424fabc8e21

SHA256
fbfee0384218b2d1ec02a67a3406c0f02194d5ce42471945fbaed8d03eaf13f3

SHA512
d014c72b432231b5253947d78b280c50eac93ab89a616db2e25ead807cab79d4cb88ffe49a2337efb9624f98e0d63b4834ab96f0d940654fc000868a845084fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
194KB

MD5
ac84f1282f8542dee07f8a1af421f2a7

SHA1
261885284826281a99ff982428a765be30de9029

SHA256
193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

SHA512
9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
7231891ead4126476eca03690f10785a

SHA1
b4579a1c74893300010440fda2dac537f8ff398b

SHA256
684b807f6a8b4eafec53e7e5bf9f357b50c4fccca972c3db1057f9e348943c06

SHA512
88244a288352e19b44926c02a9a07f7e2a604ed2452308268a313b7bf898c52aa19a4949c052210ed9e5bf89b5c43f1b55ca7c0916cc68a8ba086fdcbacece2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d7a857081e200b6cfe3ffdb24f5bd16c

SHA1
10f42c8f837ebe2a19780bc5e7d687d206d243e6

SHA256
e55d09cda7b049bc44b438fdf134337a2ddb39e5e08e0b5aae835fa63186f3e8

SHA512
4337612898f2a3e4fbb81e1e33c06346573e7f35b7e6213ce896e31376d39eb1547d6a93370d476fd73318096f6e64e8c7fea6273dec7c2249fd2dad13b1c917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2ce8b73c395798cc63b5dd4c7feb3d60

SHA1
867849b06637ee7be93dc1f71f1c3036f0433504

SHA256
b366c43ca313e36fc01cbcb831625d89b2673c605db0583423844ef55cc81fb7

SHA512
dd67b0eff6eb05c3e4a93640ac79e9fe1251ff60d1d475198c54f0754981651f54061013b90c3be080db4b82e3ccfa9a3e7af079051779835c0cd6086ff64b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
964f618bf08c543730c63b1d7c632e38

SHA1
3296adef7bab1f80c3f2afda64aa1adeb46f7d4f

SHA256
483826070face70bb80c0ea435583d15628a039d2329074eb7be63f682ca464d

SHA512
b66dc56b433d6584aea016e9fe9b5016cbd152b9e87235ac3ea59303b50a2aa691b8f68a8f13b4b5387987fe1f190255d960a76caa02a4c2ec605b3ec097a47e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
73c128dfa88fa6711ec64584720958e2

SHA1
e92311ffc05bbe6a01044f550063c717c5506c37

SHA256
ac5d9a31e54c70ae0c0d1b2ec4fbfb55f4be8f7332ae7467f0b65d5ee7db8a5f

SHA512
11f89bdfe26352684e90b188839ea00849b0dc4df10260e220753a6c8559c656a5bf809932d59c31005fee5b08c36276d275f977b821e0d5baef442069954ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
96fc46b5e4498a225b203d2ae99d975e

SHA1
b80e4c46a3668fb6d2462fdd1529ac49e02eefa7

SHA256
eb4ecdafb21677cdea4955ddaa25e51b564b75a53389dc7a99e7b6bf2355b6cb

SHA512
7d538066f5e662ddd5766fb514dae559a82d6087190228db3c568eea20ba6436a41760641e5164598fc0b58a2b7d2b9e2f439100dc6cb4f4e72598d4eefcc57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6d2b91610b1cf64ec4ddda58e39a2561

SHA1
ebeb85a5e2cbccd6fde7ea1dfa7d1f66712ae4fe

SHA256
131a06436f7cf778064661eee89c3824d943c3458472e51dac49e950f603102c

SHA512
e9a557694125834d88d7cafb4692aafee92eed2b43affdbea0a6af16b5ab756b0aff9f918acd232fe054287b30308e1426b845f7b0adc13acb7e70a47eeb693a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f5fce4de0214049403357d19573c9bf7

SHA1
7092f8b564ae668bcb5fa25eb7ad2baf79a4c0cb

SHA256
c3eefcc7077faea0c52c835c68940e9d9db7d12d7b8fdcbcd6f56b8feaf8f9da

SHA512
10d53d729da44e1b087d637264e776c39d2b8e145c1fff4832336a6a14e08726dd691cdc497137dfcd1f0e1ead5dc6854bf13fef5f96188d76b90c78db4c4e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2f6bbdd8564536d9eecab4f5acfb785

SHA1
e1cbfba50de81e9062ad738eadabc7393adf8b2b

SHA256
c5af3e803117fe5872f6982d6d82a7141cad068805f2267d63360f24007f9240

SHA512
70cabcd911c2bf84d3b0f57793ed543f7fdf9faf7c66943bf35990ff440c71e5ce75c1be8320a4b062726decaa3430571f0f281a116baa79756e09657b994c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
980be7b0a439c90f880e48e31063d7ac

SHA1
3dc3c5f7e613d2864ab44e3e05e8573866903d2c

SHA256
c23df12a1bbca62d80f5893c4676cba5d90b103da09501468e315ab7bac56125

SHA512
f3d513e17d7b2e3a56a5aff20e0aa0d3c2893f9b9448bac499040dfcdf992558d1119503c0e8dedc33427b376c68cf672b4058979d571d14b3576362d756c58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ef1cba102c3332c5bd3c12da451bac4

SHA1
23e1456ad0bcbdf82ae49bc4fb045203f282e6e9

SHA256
566ab0e97bd9054d4af529b37eef6c546cc09002f9e19141aabcf610abce236f

SHA512
5e860834c6b2dc69f0f6b698cce1ce6c284f080070763fb3462ffd64ef6d4ec8616310408a284b41f74df47c97600380979d09cf3704cb9ff7bd999a5ac8b7db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7db0e67d55f38152c23b46a0dde9b01f

SHA1
02993c396755a09cb8eb22ecd9c16ac1fb9ad536

SHA256
7591cbcd25d891f0b9bef678f8327c4ce4b6d252dde6a24e1d1e68a5de59fa1f

SHA512
f097ffcdebc0c2e577d5fb838c1fa7fdc9f16d83fb87ce0fd4cdaa9bd4b23cc6975921a3c8e857aa9ee23c84a372350cd0be7eadeb97accded2a3539b947ab9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9981253654403e201f08685a8b8aa643

SHA1
d131dbf6eca941ce6dbbb4fa7a015dd39ca317fb

SHA256
7f8ca5af5eccac92a776ca6638973f0ed90c2dc49b5d51852a565c38d21e06a0

SHA512
6ed45caa3863e1b2d21ff405607363aa4199b8e1713ad4f1a86dc176499a530583e8f7ddcfd52d7156bdab16d43a315d4ad679134fdcc88e5f4fe7a9ab4e0021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
693e9f5d5b9bad20261492d788dbe8d2

SHA1
9299d629eeac9b51dcf7f60db026224086d2c13e

SHA256
62e0be33666f33054930fdb4452b69874a35618e90e9511f6676853f6be7349c

SHA512
3afdd65e2c2ddd3360e4d0eb5ab9cced9fbeea875a92abf4f97e804ae322558f36c68cb2fe01690e81a8b157dfc3112fb127a06f2708a220907398219bfc27a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
746ecb72fb62a2919ead5f0e314276f4

SHA1
fc4677e6193ab5308ca7d0425a2b40dc546aac05

SHA256
649bd2f83937f65ae126ed1dd6e4fa71d631a58d21270fcb1c81826cd27f7e26

SHA512
4a7d5b035ceaf98be46e09eb3beca38268c9d08d4d67b04a6dee1707ecc8ba4d4976b5d13aae060f311bc7415a0e3a53f3e936b7dc322f07d4ee55bac96034a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7db6ab752fcab8ce2b60b3f7488b5caf

SHA1
c9368ff845051373226a791604ebe5b5f8fec6f5

SHA256
91f1bbc62729a4f4c1ebcd48a9d730e3c8b1f0a7c2a042bee592797c74e690a3

SHA512
e1feb5940189af52ca225ff35f07c8fe84689e2ad9b248fbd399aa9c2b4313b1f83136039871e53047832da19e4ceae29b5a5bca4699905cb5605e162a4c1b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f4dea.TMP

Filesize
48B

MD5
945356b92c1fd937a48d31086e11df0e

SHA1
07f682bf861d5c13dccae665594df867b5465e39

SHA256
80aa2b3c49c2477cfc6482205e5bcdf796ba52198cffc44feea50f3cbafcb58e

SHA512
e22191c1fc3640c07d20de1229dfee13583c8e77a2dbc4c41ed7af8a6daa3a360604f9a80e3c87daeb744a6e5094b9279712df60b2674dbc5686b9454b4c7a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a1678a00c020e3dc77b6c1c381db3b3

SHA1
e01c44bd88d364359ac2431c5a504e6a516dfc24

SHA256
9a928819fbc22aecd45e006975365a86cab7aec3bc31bc5a05fdbe4815df9746

SHA512
faefe59602e453c7312a8cb762d7271221dd5a268d3bc1c46e517425da824d40c170d33df17552edff5fbad2f814598edfbe3e65b9afde46f4477b69f400859f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c8160e0987203e3fb6b925d7360d659

SHA1
6930c0e0c7ce31f8de84942e3ed6ce4c2336863b

SHA256
04969f3672155e503c98ad6722b2fdd8823ec28d9e8c6f8fc07473ea4255f3ee

SHA512
ebfbb7db752a0c5768f6cec31838cbf595e04f3ea06ad416bd0b580124ddf28d24b6eb230245b8c174a3c9bee6e1c32a2e1e0ed1b9ec402298d2449a57782196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
45d2edac106a270142a9c85107ced8fa

SHA1
7979b268ac2ec8473f869470eebcc82f5acf49c9

SHA256
bf009a16b19645cfc5d6c35586fa69d777da18d0bef452a73959803b279fbc8b

SHA512
a5a56ff4bf488292f3cd20ee796ccc2ddf10131e08aa56a45431ede7bca8dc90cacdecc6108da92ea7b450a32e7eedd7b9820dc1f95a8d345b7890fb18202dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5f34d4.TMP

Filesize
870B

MD5
2cf97136798141a7cfcfa199bc710396

SHA1
e71765fa6278912a43236761c1b7680485babf44

SHA256
ac46edcda5ad5d3f6d58d0e42ba508b1b9553b2398f20be8f379b5bf9e0f64a3

SHA512
56d8d22d794d9ad3925ef68110842e195e45abfa5b55380e56c865a9bcf5b4f18600c3847e012556fddee1ba661832be433d8db33e2af1d5f87bb6aecdb55d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
39560d38df34cbe01d8c3d48610905c0

SHA1
2ad3cff8853fbc4a228d236353bef1a90406c589

SHA256
edcd2ab0d9c3f7d74abbc9c5fd1614549b39ea491e8e0d5b5f4cff345a606413

SHA512
d8a369467210a5059149a1fba5c2a708c264db54dfb12c3c3d1ada7f22960f6ee316521e81395a2a9b698c7d342def4a852edf6eef043f9df319a9c05fb9e774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
592263c913069574f2d600dbd25f1072

SHA1
0eea45e87314a4d140dee96765e4db5706bade73

SHA256
752fa13b7b43ed971fd00a830036441a2b41e7f4ca90b7750f46a741736eff30

SHA512
98b1d9edbfbd6565f7c644d6f8943a2c8d9e74ec1511b7eb0ba00fd95cc10009431a4eb53d218a88741a319e9f48835d04f8ddb93b8d3b8b6828dd3499bf714d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
044acf4f79b9f1730cd083876b94731a

SHA1
0bec0f49825af04235526a36421321179d37641d

SHA256
4601f11df4262c141bc6e9a12b71cdf69819ccdb23be8dce952f38761f588f59

SHA512
f5761a81dec3e3f95070c4f284a257fb6376d28f80a22a5491f474fba7740c60754c5a766dbc4251299d0e9c9459fd679627bfd1f8f76e9a44b6d061c018e1f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fcd8d902079d3d75c8c5809cef8e5bb9

SHA1
a4737c50761defc1fb55a4b96d88bbcd9bb3f462

SHA256
4b9f15453a64fd600bcfe1d1dfa834158eff7774c393d45987363df0439df91b

SHA512
b59cabbda9ac0fff1a3ef3614037c5deb3bd1a9c4302e56c671f4e53cbc962fa3d68c7f46bf0df955ca1251f6830c8b8de4446f4ae0b460485bd77efea0d8466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fa0e5efb27fd1cc2245401c90ae069f9

SHA1
0cf1ccc756317a742337ea1932aad7fa42bbb31f

SHA256
d33ad65d555618301579fde5fa7589d5a7fc0f46413f05d353d02b00b465f694

SHA512
d52fae36e0a1b9f722e521f4aedf6199bd82f7498b37a67c2bddf0ab2c3973a05d054526743f3a0831e51c7d6d0ee3429845800ed51b611564a31f1267e3e328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a821c145-8549-4e13-8b7d-62c19907131b.tmp

Filesize
10KB

MD5
a3647d1c1d235c16cc65f23c7f9ee88a

SHA1
fd4886a94ab2ce0fe297985ee0e3d16f2300d9e0

SHA256
1422de1ff481f28f3fcf5631f833e989f0e0f2a297b4313ca7a59b96c8fa6e3d

SHA512
4faabf151571001a75511bb8f16693005c1f2517389b1f2cb3fede407d847b54826daf0669a8f21e14bb6d81775daa712b1ece3d8e88e9b6fe2fa1e143d8950c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC1004AD7\settings.ini

Filesize
503B

MD5
0b31f1162fa770d036278e313741e88a

SHA1
358e50673c9d1d40769265ca11dd0b044d13a017

SHA256
3838a086a68d2b713f33f0c00acc019f5c3aafd7a23b2faffa876a6d3702a118

SHA512
b064ebfb16a90b123c3108b25902114ac4d8d2a18a4aa3e4e221f7f125f767f9d80bd04ecbc4ea49cd8ac5e2ac47b5756841b22a6441630dc5896c5cea42d3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC1004AD7\unicoil.exe

Filesize
904KB

MD5
73ba1b093985d6b09ff3107b9f635630

SHA1
a8528462159913b96bbb1e870f0a738f363f2fb9

SHA256
c6874a0e7add4cc916b6dbe67326898f48ccd6cfc3f47eb15cd7545b409b7ef4

SHA512
9391130aff46a4fcfccb17d9bcfb220d4cab55958e66008d8d4691ce3aa3d13e963cfe8485a2400d915052da31233b84e02f1d547965a626f326a6c533624fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cwmrecoilcheat\settings.ini

Filesize
508B

MD5
e11b1e7d46795a31edf460ca3b858092

SHA1
98e53c45e03fc36a17dd37ec17882cb59c857c3c

SHA256
76b48d9ea162484c5ed4b07996931feaf8d2e17e6fbf781ee6b82b6e26880b33

SHA512
f0b7f12eedb9137c4809573cf4de6ebd92dc692e27beab4c751a4b32b3597c0f82325b5a95cb6f4d2e23034ffdbf8e7297f65b0571493a791d076a2d29488a85

Download Submit
memory/4032-11-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-10-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-9-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-8-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-7-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-6-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-0-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-12-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-2-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download
memory/4032-1-0x0000020A527E0000-0x0000020A527E1000-memory.dmp

Filesize
4KB

Download