f4ecb70a985f17fa98b0a3126322a643c6593e668f162c5cef5a5f0543eb6702

Resubmissions

25/04/2024, 08:01

240425-jwxgdaha26 3

25/04/2024, 07:59

240425-jvpedaha3x 3

Analysis

max time kernel
618s
max time network
623s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arv.7z
Size

1.8MB
MD5

827dd9c7c3db541f6a5fd098c6c1c692
SHA1

e624d8984b2bcb8f040c8ce90388aa72773905ef
SHA256

f4ecb70a985f17fa98b0a3126322a643c6593e668f162c5cef5a5f0543eb6702
SHA512

3dcb48e5ce0787fb6271608a8a1056ef06958d7a9503cd526e929504f34349c08e03b6f6ded71dc60fd235bba55499f2bb4a238ce0b1cc2165e48aee7531c83d
SSDEEP

24576:lvxU0pCdeSjiN64hRxKG4le/H+S5lg9vZo1+gpoBNmTF14FcKbfzc4gMsocX29fD:lvGM64/xGqd5+9ZoELI1Ez5gMfe2dj7L

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\NodeSlot = "11"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	cmd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0 = 50003100000000008c58bd5d1000372d5a6970003c0009000400efbe8c58bd5d99586d402e0000002d29020000001c0000000000000000000000000000003beb300037002d005a0069007000000014000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\NodeSlot = "10"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Applications	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 = 8c003100000000008c582e67110050524f4752417e310000740009000400efbe874fdb4999586d402e0000003f0000000000010000000000000000004a0000000000215c3b00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
4732	msedge.exe
4732	msedge.exe
3952	identity_helper.exe
3952	identity_helper.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3948	OpenWith.exe
4264	7zFM.exe
3300	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	4264	7zFM.exe
Token: 35	4264	7zFM.exe
Token: SeSecurityPrivilege	4264	7zFM.exe
Token: SeRestorePrivilege	1632	7zG.exe
Token: 35	1632	7zG.exe
Token: SeSecurityPrivilege	1632	7zG.exe
Token: SeSecurityPrivilege	1632	7zG.exe
Token: SeRestorePrivilege	3888	7zG.exe
Token: 35	3888	7zG.exe
Token: SeSecurityPrivilege	3888	7zG.exe
Token: SeSecurityPrivilege	3888	7zG.exe
Token: SeRestorePrivilege	4304	7zG.exe
Token: 35	4304	7zG.exe
Token: SeSecurityPrivilege	4304	7zG.exe
Token: SeSecurityPrivilege	4304	7zG.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4264	7zFM.exe
4264	7zFM.exe
1632	7zG.exe
3888	7zG.exe
4304	7zG.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3948	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2672	4732	msedge.exe	153
PID 4732 wrote to memory of 2672	4732	msedge.exe	153
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 4864	4732	msedge.exe	154
PID 4732 wrote to memory of 2352	4732	msedge.exe	155
PID 4732 wrote to memory of 2352	4732	msedge.exe	155
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156
PID 4732 wrote to memory of 4792	4732	msedge.exe	156

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\arv.7z
1⤵
- Modifies registry class
PID:4480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5016

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\arv.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4264

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap4827:410:7zEvent4118
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1632

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3300

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\51.436\" -spe -an -ai#7zMap32402:70:7zEvent10417
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3888

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\*\" -spe -an -ai#7zMap571:342:7zEvent23063
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8be3146f8,0x7ff8be314708,0x7ff8be314718
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14142612883749284105,15249275430124219479,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
72KB

MD5
b8bb7001c84392a5687ed155a3603dd5

SHA1
330b4be329d6818775e4c8d7b1b64e0e678983ae

SHA256
c83a78a026ec16d67e2d4299815487b67b848be18acfd187de061f1135b8d848

SHA512
66f1f34368780dfdd4b5032c0bb68a0460a7297dadd18dc8e4a1c9bc898ab741ea3fbc404a5e041d53345c87e577929725a2a2b6dc3247e71872c02414345b8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
90KB

MD5
740ab428147629e4f1a522dbf044e59c

SHA1
043f15836bc854bb563b31a72efcb7fcc7af71c9

SHA256
fc27b85fff7deff1d52e05e3cf8e65b835e70521dd0a18d5da95a5026d196ed2

SHA512
9781faeac7b7095f4d42dff80ac36adfb1f2f103600ed22ea2313b00605f0be474f717c106445df8af91496c1d0f4384eae5e400e72d9bee3ee1a739d050cce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
1.4MB

MD5
f18ab8b07020a44651163442ccaeb49c

SHA1
325d6eecefe355cbb43f5000dacb7ffff3d47aed

SHA256
d9862666c584451eda2acb025651978c4396f100c04fec27c5427234b198a841

SHA512
ad5f30b50a9af8a9e9cf3665f1df4ed3eeb31401f48541eab4cfef606e244c56538878468e4e95cb7afd23afa9406afbe22bb59456ae6ea330af3de533b2b6ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
90KB

MD5
370e8731618177716346a56e17e212ca

SHA1
cf78f77ad6eb47d45636f3797210b04937f0508c

SHA256
8f8579340f7971fb3364e926be5bd589308d1d4209f3c5d736636a16d63cd17f

SHA512
ea100d6885adb250df8602335d8fd75b5fc81b06d62e95d34fb466eaae4a50ec14c4fd2035a07a216eb06d977c9429b544dcae6a18e41984d764a4a3d609b6d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
32KB

MD5
37396524110d78430d1e97f3543fe15f

SHA1
59d4f83463be5bea9d101b5a78903a13091323f0

SHA256
fc6cb7f16eedf709a4227f4e5c1af4970a158edfde64381df52eb0e4846981bb

SHA512
17906568904144d502abdcdbfa5f6f6f98169b2e18efb5f62feae1117c81bf62e4d2089c125f0795bb27e19347a9c4082c2d925750f049ff2561d3d0eed7cfdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
78KB

MD5
0f9c7a7f1886c33c014c70e78e3ab3ad

SHA1
537b50f566cc503267239ec9c2df32aef6948bd0

SHA256
28de20369f56decba7e4a6516e7eca56d809165fa4faba1c0c309c11f18237de

SHA512
ac8ce4dc89264cf2f5d92992d2cea7611611376007f1f08e8686271d6aea473707a902feccf4023749d674d1f170c3af69d41bfc18d499d6836816c06d3006d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
24KB

MD5
f782de7f00a1e90076b6b77a05fa908a

SHA1
4ed15dad2baa61e9627bf2179aa7b9188ce7d4e1

SHA256
d0b96d69ee7f70f041f493592de3805bfb338e50babdee522fcf145cb98fc968

SHA512
78ec6f253e876d8f0812a9570f6079903d63dd000458f4f517ec44c8dd7468e51703ea17ecce2658d9ea1fdb5246c8db5887a16be80115bbf71fe53f439d8766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
92KB

MD5
f8e3fe37b81632a17e72ffe2a34346ba

SHA1
cc6264cc934cebb20a055432c4aff3644874f121

SHA256
ff70b582870752f8adc7b2149519418e0b62b62c2e04a2f27c22cd3e3841b30e

SHA512
1e41b20d30c6e2e947a2bc0f3bd430579148d2559f44f05ae6ebc5ea71a00a84803cfdecf47eec21af0c49c767bb0a52bd31ada8298d0c228f3366cb9915b560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
125KB

MD5
53436aca8627a49f4deaaa44dc9e3c05

SHA1
0bc0c675480d94ec7e8609dda6227f88c5d08d2c

SHA256
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

SHA512
6655e0426eb0c78a7cb4d4216a3af7a6edd50aba8c92316608b1f79b8fc15f895cba9314beb7a35400228786e2a78a33e8c03322da04e0da94c2f109241547e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
5a245fa50f05f63963639b77a7de162d

SHA1
0a3dc0bd3431a9ff5f2e3489a086e976133f2223

SHA256
3fd13aa5309882955edefa1157aab289e1542b6cac5b258f7a486ef88ed1d876

SHA512
f9ee7d251d38795aa338d94d6cabe62652cced696530e8c0c734c3b08c7893b4f3f857459f5905f6551e5a08b49b62589e9880123f1c07bfbde323fa3bb09247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
34KB

MD5
4289d0a4a3e569192a30e34c94b2a1a7

SHA1
e7a967f3776e8228d1a54e47f243169fb5ded677

SHA256
fa50047e93df37d3cffc656692825be945bc1d405118fe29abf0f5dfc53b32d4

SHA512
25d714e9c63140cb91376e561c70a9e84abc4cbab18a3b21d5aa9e8f212e805d1e308a522e49945e51ddab5054c3966dd3e0b4f03fa39a5f4b5a1d4d2f02d57d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
9aeb3584b3f24ecc27aa749a2d4038ad

SHA1
09a855fe393988192d96114686ded205dce852ae

SHA256
a207ad44d22b8238b229dae3b20f86aa7dd65ad01a4e4964bac01ffba1ed7a47

SHA512
fb7d1766e115266a3a1864e2e0f9c72afd81f013a9d414c16ac7c94cc535fd614cbc6d82bbe8326f9e1b6c10d727384f00ea290b18cb97e32da27c4aaaf9da39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c2da9d156be7bdf6530f36513a68a042

SHA1
561bb4ce1f85467edee4c3d84a0780db211112ce

SHA256
3918058b56f0bdeadaa884ab38dbf0fe32c64654aafdf05d19f015656426a556

SHA512
21f8eb34816aa5157c4dec07c145f942883cefc267687c317de0f4e99e9f475e3be9db345c42f9aa95f2b917d4599fb48edf818e8dc9db14114ff4384073578b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40e2ab130de7ace7073ef0e86b787eb4

SHA1
2e689eec7b9703cab70925c9ac93878cbb46bed5

SHA256
8e35216e7e2392dd7bbdbf4bfa66d566dd83dbc3e7238973cebf54cda1fd6dd7

SHA512
ada7438caf5d0f291e28ab847f80db709d1b6494298c51b3cd7aba2df91d04ce926c0787e68032bfc15ea7e2b9083ba962bed7b78573a31f5e8275b865f3e774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8dce70dbfce9dfef519ad1570011d3d0

SHA1
88efa0d3b8a1677a18aa348ee360ecd0371b7a89

SHA256
efb29656c3d983b05b7bc0692969f02e5d26f55a0799fa5ee199aa053be19465

SHA512
78722d9f9b7097b1919a0a6bb6edea5218c25a7f5b70d128d8c17117dbf4c448aa0edbb2263cff5565a2468b59d3e5d159076b26322491ef01d8894ff04a32cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
971803dbf9613da3fbd9c7bd24cd074a

SHA1
bee00db0986c91426f1d20f1eab148d57a56ad0d

SHA256
77af14f2b8e0a51b1fd2b9b2a8c98e99ac0d4a7948a0246d6850a42854463c26

SHA512
20ac734326a42664a6aab985124e9ab41c3d5c5f7f692b5d5ccd9742d28eec5e0db25261f268788692fedf289acce5fc46d5a8e5808c94fe8dced24bdd9d7d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a248590ea2eadb54200f602f528fe6d

SHA1
e238bfe08e3b967d61ce3a56b7e47d187bf6c62a

SHA256
05227de69455cac09a644bf41bc4ba60b27466cc59b60ddf0ce0981f775c6ae1

SHA512
2b9fe2cc358be7249d344655a35a8423d8eb4b4c7a958e36b35885ebbb5e447cca90e6223480d98a81097806fb6756179d5a03d4598241fcef5dc4e7942eb3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a0caaadc0fe28eba42e0183a9ef872c3

SHA1
2e44083f7d906771085c5d3735f081a3892d3006

SHA256
8faad893043127fb688af4826533200efaf2f64d1f0904fe9de0b3243b8c3c74

SHA512
4e3df9715876036bbbbd40580de0711b7c3ea9e5c643240083af18dcfe46fc40477f8d23936bb5a76802d5cc1bf69e19b4102945c7cf676d0bdae3a8c1d7b8ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
40ff268e40953ba6f637563b73760f84

SHA1
a46c617ec97fbb2cc4af03fb87c1e195ef3a634a

SHA256
1a3cddf49a80c6a5799dcc8dadf2e71749a6d0ff43d86b29106e414b65bb7e87

SHA512
215f31b9e128a0dda21094c6598174e2ea9ac0530e3784c1444ff5e7e91027acdd047a835f02d4797c6b54907098a42290d688e7435702c920e01dcda9cc51f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
aa2ecc4c1993968b838b211714d8d001

SHA1
56065e69dfa991cd59134993c2ce5c3688c8d7ef

SHA256
f0c75bf6b46cf0ed7223d97f72c318fdf9af64ef0a26896282f222be7116c042

SHA512
528ab822375cc7af1a80c0ee501567cd049d37a7210ab05cab51d3e73bedb86d8f49117c4af6670b4d1cee03ab189d67de14a07c7eef73582ac85af9963eb41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f86ad.TMP

Filesize
48B

MD5
ce438d13af7650de1e7491463552ad7e

SHA1
180c0631351c45e2f2bd9fa7d8cc9c3155aa343d

SHA256
6665830186d34a20b34d6b7df19c184930042dfec40372a0c281d94f73f2915e

SHA512
fd5a607aa05fda931daa0b447a07d6b7f6f66020796464e08698a427b1db0adbffa64fedc2dc0724276e21b99cecbd84b9b75a3c13c55d611f237670379eb294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
99be27d62bb419a6371c40ebfb4360aa

SHA1
0683dda93bc78c1412df30e55b8ad5766d78c23f

SHA256
72719e2f477a2d284d12d29ca8750e84b65e888b177cb7a7d96196addd8ae82d

SHA512
9608b581cd0a4f7178f91dd8cfa0d23576a0eee15d588d06465ddd0d3852e831c0e6f233e4aecd77783670c9b19b09377188ee52ed591c92d4fefd7e6775782e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bc63c87327d7b47ad1a333731486e774

SHA1
7b793db7a18434deb4ffc3779b6abadb70b56812

SHA256
34cd5a4f15c0bd8dc479e4786835c568ac9dd4fb448156f088fcef5e066aaabd

SHA512
22fb060627168f9ead9f4f22279096203efb55b26e39f40212d14f4c6ad191b86ab0d8d3d11a72732aac413e0e1b22c51a82e010c33d031fa76d4132564422f4

Download Submit
C:\Users\Admin\Desktop\19.699.zip

Filesize
74KB

MD5
ed7610871a0974048a7f91adb8c3023c

SHA1
330e8f0edb5758af522fb9343869b1a8ed35d146

SHA256
fc784121d16b6ab460cb6831c9dc75152373dfe5627c8c6cf19ecc74689f3ee5

SHA512
20b92f790100f38fce415ae0bf0c20eee39874e7c1763d9ca1e89943406e73e1d5c77a3238cdc213807973d94ed8bfaa7c4cb2c529be2097304ba0cf314e7ffc

Download Submit
C:\Users\Admin\Desktop\19.760.zip

Filesize
21KB

MD5
29f7a1fd67e28389005ee04a9dd99c94

SHA1
bfe011aa9bd5e1ffaa8d05e29868752afacec243

SHA256
876c1b4aa8a8dfce5962e8822352fdde71093ed77e66eae31fa7c3af2c3a64cd

SHA512
7cc568434d2b2fc06f4d24966fc85a1b5adc6e6e59d1ae0066a3c8c7bd8cac5422cf92a6cdc2f5a639e36f7c3d3cd1823edcfc6e2dddde3302e2240a2ac7660d

Download Submit
C:\Users\Admin\Desktop\20.366.zip

Filesize
40KB

MD5
799fa024267c2158de516894406f7adb

SHA1
4f36fffde96dd232467d13792ca2b666e9624268

SHA256
f48a859e2ce6dfc83d59811332a5bbb1ec4f7f93c5c97dc19bf7c1d50eb669ef

SHA512
b55a4a2862767dd56b68247f80cc122500dca280fc10ceb397a76b1ccfa48869d42c01dc0010023713ab77dd7944ea17706fbb9eb56d9c57df29880271d28157

Download Submit
C:\Users\Admin\Desktop\20.518.zip

Filesize
264KB

MD5
cccd136a0157f3e2dff3038d176ce2bc

SHA1
ee2bd8c5774d8601a19b95d76bc0f285583af22b

SHA256
7eb8aa88375a824182fdc5db3eddcabeb295fa2c1812ee751f23595fc7843cee

SHA512
8d83e3ba396b09a71dfaa91dfe4ddda4d94bd8857fd27ce703c7fea341f9310cb1b526f4c613a486923cba22b6644c1ff484e7642b3b999b439e568ae8532cd6

Download Submit
C:\Users\Admin\Desktop\21.542.zip

Filesize
740KB

MD5
cac9117a391b35e78597b54c8ddea781

SHA1
c07ddb507fd56a50ae45df51afe436e2c4fd2feb

SHA256
553b5bf6b06f045ca107c391967617cedf1bd5d12e018d971c42e5b229a56e69

SHA512
c0ac7f1abca69646893c15e69700cf4e46c7da4be8463bb3cc727c16bf8d85e41594067371d57ac3588d2108b671e1b65e9709889d43680d9a6a39ebe412e7f9

Download Submit
C:\Users\Admin\Desktop\51.436.zip

Filesize
737KB

MD5
e4bf9bea9a3b7b3cd125fcca60112deb

SHA1
18141da357b7f3e75558869c47c7fb8631860746

SHA256
eb5e9d154cf6e55746fae9d0d07a9cbb1b90dadb56a0d25e78584c83e64d6cfe

SHA512
244aa940f3ddd57445bbca073c4e138e608e62845b5c031a8ba54111d51e883f9cf575f5bceadf62801bd685d9f07999c0be4ae3a6cec5d2eedb4eba46a58525

Download Submit