hxxps://cdn[.]discordapp[.]com/attachments/1205999726923747448/1207009769873874954/Awaken_Source[.]zip?ex=65e750f2&is=65d4dbf2&hm=0e0a81443f0470119b0c98bca3e78eb2c42190e84f191053a54df737391ce0f3&

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1205999726923747448/1207009769873874954/Awaken_Source.zip?ex=65e750f2&is=65d4dbf2&hm=0e0a81443f0470119b0c98bca3e78eb2c42190e84f191053a54df737391ce0f3&

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
5752	winrar-x64-700b4.exe
5656	winrar-x64-700b4.exe
6048	winrar-x64-700b4.exe

Loads dropped DLL 2 IoCs

pid	Process
5804	taskmgr.exe
5804	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2200714112-3788720386-2559682836-1000\{090ABB3F-BC5F-4E63-8D5C-FB8A615F48BE}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 226236.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2904	vlc.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
440	msedge.exe
440	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
4996	taskmgr.exe
4996	taskmgr.exe
2216	msedge.exe
2216	msedge.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
5560	msedge.exe
5560	msedge.exe
5664	msedge.exe
5664	msedge.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe
5804	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	taskmgr.exe
Token: SeSystemProfilePrivilege	4996	taskmgr.exe
Token: SeCreateGlobalPrivilege	4996	taskmgr.exe
Token: 33	4996	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4996	taskmgr.exe
Token: SeDebugPrivilege	5804	taskmgr.exe
Token: SeSystemProfilePrivilege	5804	taskmgr.exe
Token: SeCreateGlobalPrivilege	5804	taskmgr.exe
Token: 33	5804	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5804	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
4996	taskmgr.exe
440	msedge.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe
4996	taskmgr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
5752	winrar-x64-700b4.exe
5656	winrar-x64-700b4.exe
5656	winrar-x64-700b4.exe
5656	winrar-x64-700b4.exe
5752	winrar-x64-700b4.exe
5752	winrar-x64-700b4.exe
6048	winrar-x64-700b4.exe
6048	winrar-x64-700b4.exe
6048	winrar-x64-700b4.exe
2904	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 1368	440	msedge.exe	82
PID 440 wrote to memory of 1368	440	msedge.exe	82
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 4872	440	msedge.exe	85
PID 440 wrote to memory of 2288	440	msedge.exe	84
PID 440 wrote to memory of 2288	440	msedge.exe	84
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86
PID 440 wrote to memory of 880	440	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1205999726923747448/1207009769873874954/Awaken_Source.zip?ex=65e750f2&is=65d4dbf2&hm=0e0a81443f0470119b0c98bca3e78eb2c42190e84f191053a54df737391ce0f3&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd45a46f8,0x7ffcd45a4708,0x7ffcd45a4718
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664
- C:\Users\Admin\Downloads\winrar-x64-700b4.exe
  "C:\Users\Admin\Downloads\winrar-x64-700b4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5752
- C:\Users\Admin\Downloads\winrar-x64-700b4.exe
  "C:\Users\Admin\Downloads\winrar-x64-700b4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5762040351386418638,13997806526445180806,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Users\Admin\Downloads\winrar-x64-700b4.exe
  "C:\Users\Admin\Downloads\winrar-x64-700b4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc269e776h2568h4c7fh8a7aha2f473f1ece8
1⤵
PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xe8,0x12c,0x7ffcd45a46f8,0x7ffcd45a4708,0x7ffcd45a4718
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,10828118735763395871,18291707869239967205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10828118735763395871,18291707869239967205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:5680

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\b5f43cce0ae14111804f1ba24cbf74a5 /t 1320 /p 5656
1⤵
PID:5532

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnregisterWrite.mpeg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91746379e314b064719e43e3422d0388

SHA1
65f1a2b5a93922d589142a6edf99b5b35d986dba

SHA256
0b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7

SHA512
a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
329413e2a5a67de0e5adb202e8652339

SHA1
58d0327a0bb2aff7c1f8cbfd244e5f5d50894206

SHA256
1804cb4421549d06a4a1087aff7f778065507dfe82fb3ca819bc33133353c8ae

SHA512
a02d9d7448dbb7c030819ac8965cac73098941e559a8c525567507cf4c77b6f83ea655483236483b269a187e07f472d9a3fa78364339367077b9781c8423aaf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccf8b7b618672b2da2775b890d06c7af

SHA1
83717bc0ff28b8775a1360ef02882be22e4a5263

SHA256
ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420

SHA512
eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8dae7517b37248a1ec14e37e5401a45d

SHA1
9266a43c3e92ccd60cac88f4643e166232a1e995

SHA256
4da034723e71e95abbcecb9f55c95ff7aa018b3aedfa436ce3eca80d073eca26

SHA512
4dc68c834f200a11969a16290059142ad4a5e0f2f612be86019b0a6af2b1fb6cb975fcd53931621b85ec4492e4b4d7fe575fc0aeb12e7c71c967c734755c2052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
822B

MD5
4f6218544e9ed667de0b8a2a72e45ba1

SHA1
ba851c4941ab86ebb90c2e714b13301868f5d1fa

SHA256
fd801f4f317c88c4764a82dded8eb009dbe31d81a1365a92a1caf756d849111a

SHA512
0b5d58f2323059bfd378626af4702d3c8e958ad83b59513e75c5d2074e8697c455d9875d0c9ea271ffca429d099a31c2e32f76d18fc2a1409d70e3724512c4d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
256B

MD5
5c3eb131e25d5c24fe6a5574ce36463c

SHA1
ab9bcad034ebf1357d309865947585d9442027e4

SHA256
7d625ddb932016d5d016641a2c70e26042477840ea13a793fe52c890416f1417

SHA512
5eee06fcb159f28e6dc3f423a1177158dad6c411231aa011c84a36c82cf8537f78793463728d82df8fb5d26ef96d2b04dfcf2f226f3cb4963061a7e40df136f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
912B

MD5
22c19ce1d5693ddc1a7471cd2644a7c8

SHA1
a2e3b5a2adc81a1d15c29c26a06579510e31633f

SHA256
5925639dc0ec3d7c609b632869ae831dbf9d0d7722b7335f3443e5a610092262

SHA512
b69decf27a264a73b181cc1b69569f010d6d26ce9b591983c106ed5839e219b49afd7c58acccd77e85c7e5255342156e52f0a661894e24390d109a1163afa291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6edfd06e1c974f49c4427125418376be

SHA1
2061a471ca94f18e54844709703dbe98ba5f63f7

SHA256
8d9f626f73cef73537caf21db3d42adaf54198bb6a3c0162ffccec86a8bcd2b9

SHA512
ec3e5a027f88a912473416d6424a7181d5c0665e2a21675e999314179fd428f4da3a7df2044fdafa6eec6833d31ca68916884dc4933da6fb481e1af988295e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ac8265aae9efa0058aaa2a7ae71aa612

SHA1
3c13f7e9e43523bf07e2b8250ddcad3f4a229abe

SHA256
c8b48e01680a3e0a1f6ae7e0f176d6fc8b14bac30b10ffbb29cd4b39c0b06048

SHA512
46f6124c1d05d5af9ce3665e57147c6c671594e859f9bccf8865a5b4e15ed899725b8d203eba4d675c5bdd5a7e94622bec9d742ebe91ff8dac539c79710c80e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
150ed2da4003cf03e82625b9c1943c5d

SHA1
8eeaac278612c3265adeb2d421527cfe5a3cb69e

SHA256
d35734a5a7cf2af22d341ca34d6a545966ffbae44bffd0aebdeef724732bbcbd

SHA512
2dad91ba8973078209dd1104ab66526ec442e69b582e7d1f73a1f8dcfa54f81380c952e7716f52a22668b64ad0372f5d56acc99077e8a0e4aace8e9e749780f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81fc8acacc2b4d059ac40005ee9a3b99

SHA1
fdc531843a5d81d9207cb4c7fa97e362bbb64334

SHA256
71a3df9ced3ed82cfc6d4f7d28109a6221d87fed800cad60e2095e91bfa4d002

SHA512
ca9abcfee829566923d138448e525228e26ca5352abd24adb45049f423bd248455a32d3c70f0b1606298156cc9745c33b667088c779b27e44eff6aafbd55a253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b2c813c83bc817c1000edce12f93012e

SHA1
096d5ef5435caafb075a2140e8e2f93a72764c7b

SHA256
d5a70636fa702283fd7fd0ec8686668ce2539a395ec26d0b277d811c6f02dc6b

SHA512
8bb032a1cc783d553ceb422d9c0c991424a656de9957712022415c9a8d948a7a7c6378a27508e8d6fcf6240d17d03fa8068403ea00e39991f90c3bba69f74b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cff33b2c0a3956299fb163ea5e5b6c8

SHA1
ff34ae285d2e2c8fa55489b6792a7587c3ea7fe6

SHA256
906c119bf25ca4ebfdeb05e7acc1e71b9673d552f8bd60ea35e104aad5f15f4d

SHA512
a05d492f0729077744c06a64d40988436e37cec2ef8321e0ba6ffd2d0d7fe29295cf934fff220ec46960e097b50cdcf15b62a4641b4c1a6e9742558a28ed9b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e807553b6f307f749c8fdffe4213feae

SHA1
e8c4a6c3aa506857f52c2fc04f0d102bd691bd27

SHA256
5db02e074c6f4e75e0d969b27e353ce2b6f4c5472e3229ff7af0efc217164eae

SHA512
ceffa2a2c02bab3ae45876db3e1bfa6cd77c6cacf85bca2984c76dbdcacf3e6c07f165aa20f93d2b50191c9e3280f9a5b456cd7b6750692636ab0940e0355ab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a284b2ab130e097b8d7cc64314ffbc0f

SHA1
99b77d0a4bcfc4d674be128e7734ece0f5bd2d30

SHA256
5048db8215dc856e13a27438081bd690e88ab18b31927684e2f21f8654f31d17

SHA512
7fe6fffffee5532d9411b49b7c0e5ed16b055528b0dd2528e0f6ae38ca94b12c0200ac9a5cad842c7b79d524b80ea55754d90525e3c5e2397f61b72a28c1c042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5897b7.TMP

Filesize
538B

MD5
b5944ac176855bc3d3082a1616db91cb

SHA1
54e46620c52497262868e048d3f1a6d0f817e82e

SHA256
ac59cc850d938fcb6f9c3c7181ca79e57b6041af93f0a0d53b076bc05d57dc3b

SHA512
456609e68194dde056796b50bafdd0b2b0c2b4c951337267bcada6b03fb14ce33820145fe15351bc665929ec67bb94b9114be89018210fd4fd280fc3a78d7981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8ab1bfffd59ee100ac7e540e825ac3d7

SHA1
2532dcbc803e23714648fa6d936bda2e4e9d3a48

SHA256
81994c7573ce2e86ed3629b2e4b9f2bace0e3162045341bb5e2b07681fb5ae44

SHA512
609007340bb2c58222270fc14278a9377c242977762656662dc2e926bdc24b3fa46d07143dcb70823b3491a0f0721a331c7b7aa050a0a9bbe783ce6aa68aaf42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2f79c9d802234edf15e0f3c1e864610

SHA1
9cec43c46e402f1dfacd59f49b358c400adac14c

SHA256
b7c50ab027e89ff43b39b7eace6b48860a60c6ff7ae6db01d083cf1d08003179

SHA512
a9fd02f787b9aa36be580d0a8a1e6af18c42849f28e7ea97d0a4d71a7f55eade01f69702b984388ac7d20645e7c425a76255691ca6362b239b160acd5876eb96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
03ad5c005dfad176315a9f4d24ec0482

SHA1
4c25bc41f64f26f6ca373d71483307a4b5b10b5a

SHA256
0a1d73c95aabf470832f10d82add3161b578a1ed44c2b34e62f3ceb5121767bc

SHA512
d6e063a3a99b6eae017768b74fb58743d8ca86441a6cb4c5a41f7421566ce74c4972892e5801622bc2a02ec91555545c812bfa022cc075ee4f1c1b7f2f240b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c4f51c1add1af427a3a8053fb5e6b2e

SHA1
f30b084d008916f99f79fb08bc88d04863788992

SHA256
7c6fffb6b102d7e1d092436cb99be5a6fb4729fd53971765184b9c29aa5a1d87

SHA512
41316de5e58068f43f59cdc15c8399cc9e1831e051a488ad4e8c2a1daed66de79ef4b4d0bbe2cc6579affbd551ef1aa68e3a29e63b485ee7a718eb9884f00fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
506b921f5f02bc63ae838630a98f6a8b

SHA1
d202506ae835fab7e8a08e33220cb56150bf1fe5

SHA256
99732fc7d45fbe5344654101d32e23d2f139241094fb2aea66bddb9038f3fc2d

SHA512
fa90394365ff70402511e8035fe8439b19611ca179d94e393d584cbe30a54e9a0be62479684d85ecf935caa5ed14ae11e290c2686c7ad9fe0af349426e1afcc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5450c6432cade4a8b48b11d04fb67480

SHA1
063cf5571a470c870ec481c6f5b5c61804a06845

SHA256
7c400d2267187512a86b51c910a0b0186a1b0cc37574b59adf04f78f8323d5e6

SHA512
b7ab9e5d469dda37c49c6d3ad8994a6e3dc022fc029d6c1afc61e4c9a63c2b351790bd209e043ec7f4e6ff02cf8af4ce4f40e9f2b2d853e54ff24b751d81960d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 226236.crdownload

Filesize
3.7MB

MD5
01ed710c6b64cad71cf0fd89d6998003

SHA1
c0b98f658ac2686c53bf24a5b6f7b0ea015020e9

SHA256
579451f9c9826475ee085d7dfa52aa50d2874b68c42fe4194b97e876f1abcb7a

SHA512
d920516b4db919bc0194067aa84777b06c39e0a01c04cf2641b8c22eaa4362d5b4bfe6e69aeeca92ef52a30dc14ff2d40877ad07448d96b4869d68c03579650d

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700b4.exe

Filesize
896KB

MD5
a4604bc6d045ea02c58774b10444fcc7

SHA1
eebfd4a9770c2989b69c5e274403d16ab9291df7

SHA256
08b71823b5e538e08b8c11f8cf645eea5770c3df8b73c2b73ebc69f49b4e8c12

SHA512
691eeb8ef2020cf110030334094385f5bd50e1df8f1601bdbe4b9c2ded96cc4265f8126f30d4157317eab349a56b206312d316e1e02f014969d75241de327aa2

Download Submit
memory/4996-52-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-53-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-54-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-55-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-56-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-51-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-45-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-46-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-57-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/4996-47-0x0000028335200000-0x0000028335201000-memory.dmp

Filesize
4KB

Download
memory/5804-407-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-418-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-417-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-416-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-415-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-414-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-413-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-408-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download
memory/5804-406-0x000001CE8A6B0000-0x000001CE8A6B1000-memory.dmp

Filesize
4KB

Download