595e2825095b12ddfba4ee6f98f4f6cb1ff1fbc37a3b3191b2fc203d486ba163

Analysis

max time kernel
1664s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

satan.exe
Size

184KB
MD5

c9c341eaf04c89933ed28cbc2739d325
SHA1

c5b7d47aef3bd33a24293138fcba3a5ff286c2a8
SHA256

1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7
SHA512

7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b
SSDEEP

3072:H8SIBtQnE7OhssdWJ5jy392aCmCbBq0ryEbh/Wl7hqU6Q4NJ15xgDbvSY5thfRb3:c7qvhssdu5jyYaCmCQVE6hqUI5sb9Rb3

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

afypo.exeafypo.exe

pid process

3272 afypo.exe
1804 afypo.exe

pid	process
3272	afypo.exe
1804	afypo.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{20B05F6F-23D3-741B-5056-89006DF8340B} = "C:\\Users\\Admin\\AppData\\Roaming\\Maafry\\afypo.exe"	Explorer.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs

Processes:

Explorer.EXEafypo.exeConhost.exeWerFault.exemsedge.exeWerFault.exemsedge.exebackgroundTaskHost.exe

pid	process
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
1804	afypo.exe
1804	afypo.exe
1804	afypo.exe
1804	afypo.exe
3628	Conhost.exe
3628	Conhost.exe
3628	Conhost.exe
3628	Conhost.exe
3428	WerFault.exe
3428	WerFault.exe
3428	WerFault.exe
3428	WerFault.exe
1804	afypo.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
2432	backgroundTaskHost.exe
2432	backgroundTaskHost.exe
2432	backgroundTaskHost.exe
2432	backgroundTaskHost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

satan.exeafypo.exe

description	pid	process	target process
PID 4948 set thread context of 4780	4948	satan.exe	satan.exe
PID 3272 set thread context of 1804	3272	afypo.exe	afypo.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1460 vssadmin.exe

pid	process
1460	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

sihost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

satan.exeafypo.exe

pid	process
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
4948	satan.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe
3272	afypo.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3240 Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEvssvc.exeDllHost.exeRuntimeBroker.exe

description	pid	process
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeBackupPrivilege	3516	vssvc.exe
Token: SeRestorePrivilege	3516	vssvc.exe
Token: SeAuditPrivilege	3516	vssvc.exe
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	4356	DllHost.exe
Token: SeCreatePagefilePrivilege	4356	DllHost.exe
Token: SeShutdownPrivilege	3944	RuntimeBroker.exe
Token: SeShutdownPrivilege	3944	RuntimeBroker.exe
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	3240	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

satan.exesatan.exeafypo.exeafypo.exe

description	pid	process	target process
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4948 wrote to memory of 4780	4948	satan.exe	satan.exe
PID 4780 wrote to memory of 3272	4780	satan.exe	afypo.exe
PID 4780 wrote to memory of 3272	4780	satan.exe	afypo.exe
PID 4780 wrote to memory of 3020	4780	satan.exe	cmd.exe
PID 4780 wrote to memory of 3020	4780	satan.exe	cmd.exe
PID 4780 wrote to memory of 3020	4780	satan.exe	cmd.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 3272 wrote to memory of 1804	3272	afypo.exe	afypo.exe
PID 1804 wrote to memory of 2416	1804	afypo.exe	sihost.exe
PID 1804 wrote to memory of 2416	1804	afypo.exe	sihost.exe
PID 1804 wrote to memory of 2416	1804	afypo.exe	sihost.exe
PID 1804 wrote to memory of 2448	1804	afypo.exe	svchost.exe
PID 1804 wrote to memory of 2448	1804	afypo.exe	svchost.exe
PID 1804 wrote to memory of 2448	1804	afypo.exe	svchost.exe
PID 1804 wrote to memory of 2524	1804	afypo.exe	taskhostw.exe
PID 1804 wrote to memory of 2524	1804	afypo.exe	taskhostw.exe
PID 1804 wrote to memory of 2524	1804	afypo.exe	taskhostw.exe
PID 1804 wrote to memory of 3240	1804	afypo.exe	Explorer.EXE
PID 1804 wrote to memory of 3240	1804	afypo.exe	Explorer.EXE
PID 1804 wrote to memory of 3240	1804	afypo.exe	Explorer.EXE
PID 1804 wrote to memory of 3484	1804	afypo.exe	svchost.exe
PID 1804 wrote to memory of 3484	1804	afypo.exe	svchost.exe
PID 1804 wrote to memory of 3484	1804	afypo.exe	svchost.exe
PID 1804 wrote to memory of 3740	1804	afypo.exe	DllHost.exe
PID 1804 wrote to memory of 3740	1804	afypo.exe	DllHost.exe
PID 1804 wrote to memory of 3740	1804	afypo.exe	DllHost.exe
PID 1804 wrote to memory of 3840	1804	afypo.exe	StartMenuExperienceHost.exe
PID 1804 wrote to memory of 3840	1804	afypo.exe	StartMenuExperienceHost.exe
PID 1804 wrote to memory of 3840	1804	afypo.exe	StartMenuExperienceHost.exe
PID 1804 wrote to memory of 3944	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 3944	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 3944	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 4048	1804	afypo.exe	SearchApp.exe
PID 1804 wrote to memory of 4048	1804	afypo.exe	SearchApp.exe
PID 1804 wrote to memory of 4048	1804	afypo.exe	SearchApp.exe
PID 1804 wrote to memory of 3544	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 3544	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 3544	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 464	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 464	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 464	1804	afypo.exe	RuntimeBroker.exe
PID 1804 wrote to memory of 4440	1804	afypo.exe	TextInputHost.exe
PID 1804 wrote to memory of 4440	1804	afypo.exe	TextInputHost.exe
PID 1804 wrote to memory of 4440	1804	afypo.exe	TextInputHost.exe
PID 1804 wrote to memory of 4392	1804	afypo.exe	msedge.exe
PID 1804 wrote to memory of 4392	1804	afypo.exe	msedge.exe
PID 1804 wrote to memory of 4392	1804	afypo.exe	msedge.exe
PID 1804 wrote to memory of 448	1804	afypo.exe	msedge.exe
PID 1804 wrote to memory of 448	1804	afypo.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2448

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2524

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Users\Admin\AppData\Local\Temp\satan.exe
"C:\Users\Admin\AppData\Local\Temp\satan.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948

C:\Users\Admin\AppData\Local\Temp\satan.exe
"C:\Users\Admin\AppData\Local\Temp\satan.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Users\Admin\AppData\Roaming\Maafry\afypo.exe
"C:\Users\Admin\AppData\Roaming\Maafry\afypo.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272

C:\Users\Admin\AppData\Roaming\Maafry\afypo.exe
"C:\Users\Admin\AppData\Roaming\Maafry\afypo.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_80d203c6.bat"
4⤵
PID:3020

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:1796

C:\Windows\System32\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1460

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3740 -s 768
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
PID:3428

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4048

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:464

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2bc,0x7ff9e2402e98,0x7ff9e2402ea4,0x7ff9e2402eb0
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1924 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:2
2⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3156 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:3
2⤵
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3176 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5400 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
2⤵
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5584 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3728 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3112

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4828

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:808

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4356 -s 772
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
PID:1924

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4296

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:232

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2952

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4280

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1872

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4856

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1676

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4552

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3540

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4128

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4760

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:280

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2856

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2276

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1820

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4140

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1100

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2348

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3308

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4408

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1292

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2368

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4808

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4756

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:720

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2636

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4320

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1884

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2336

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2000

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2964

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2172

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1708

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4216

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1196

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4320

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4768

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4024

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3448

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4200

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3536

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:912

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4216

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4348

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4504

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3004

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:940

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3764

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3276

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4472

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1288

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2324

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3428

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2336

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:284

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2164

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4128

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2984

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1628

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:308

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5116

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:284

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2432

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3932

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4004

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5036

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2172

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2172 -s 828
2⤵
PID:664

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1248

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5052

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:880

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2636

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1444

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2276

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d3331c9a320a00d31d6c4feb3a4e2e13

SHA1
710af12c5116c22bfc8c7fb9cd3551c70938c182

SHA256
ae08d671c13736ddd84827ed480eef6b2babe9cc4e2f7b6ccdcc380446c09f33

SHA512
1198cbf5bfce9282d136859a4ed1f3469c666c56aaca1a54d47674a1b752e5009a7ca409bebe31b2f17df04678451df1b61617b14ab288faeea3b7ca3393718a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5f49e32720ed8fef0f0622ba3e2a7046

SHA1
f1f5dcdaaa2fbbee7e956767a096ddc06ebc81a8

SHA256
e52d0527c6b436f800b431cf37c3d267ec965768cedb2ac208817c0648a2daef

SHA512
58b2f0dc6c13671af3a568b753352f58f419e94ac395b37140e03c8ad2da76ccdf7ac956efb5b0518d213f92a921f7b1fade73d55f769529598ed942c324968a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
d91d0e7aa95b108ecf9908c5eec01f57

SHA1
4db4739126bb9e6e5ae050bd0889cf72caaf6005

SHA256
e0ec269031eaa2112f058febf16fa4efdc857a444a3929fb40db7ee5b81f654d

SHA512
85514d07db35dff623950a39a7c935d21fb396235023cc3a6470485c24d4de1b9ba1a2e2cd900317242a7e7fe9b71044fc8e394de17e2cc082beccbd5ef5200e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
b518642c8be38f12e39ccf960b2a34ae

SHA1
1b2868070555146e7024cfa69c9ddf5db1dd2db9

SHA256
6eb5966c6a846bcec50ad2e19f671aa51ca36bc91c57b7bd8a866a3597ef194f

SHA512
aa7f079ae1828cacbcdb38be2ce7ffdbcf40a44cdd1153e1995545952d62a080d4c144a902bf8a69d4a0fad709dbea24870e2fbc5a86344dcf76c604b41fdb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Filesize
8KB

MD5
8eb9823e6a8fbea8e5605873757eea63

SHA1
df7b2c4863356942c7c9266f412fc7c72b5fae71

SHA256
dff2a52014fc2305bcad29799892de83dc0cbd9a18830512152af4d10e0ed521

SHA512
fdcdf9e8e907a46535f20af5b870977c62319379db32987e0677f14766a4f4b6ea6874dfd51a7d84bf03b981ebab99f42d2c23583803353b363ad236793ffd5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Filesize
8KB

MD5
36ac71534d12df5d3d5b0964cae0c97c

SHA1
d1b5483b4cf749e108912d4e17307edfa4329300

SHA256
eb02e72c14501a7ecdf2ff0aec61c38298958ee475fd02614714f64474c55d1c

SHA512
38649881ba8342e22de758b40c51f1da0e0db6844410d29b41c77a3b2126703c08ed5d0e6c9c0505fe1ccec113c495cde66e950669552d0938b8b3a711d6f957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Filesize
8KB

MD5
495b7dc38815628d2c9715ae822772d7

SHA1
22de7dd1893e4f0fb6143afebeb65b80aa5245d8

SHA256
b622aa2b93a0a77107bbebf01e5a9c2fdf2ed1d6075178558804febf6b422f79

SHA512
993f13590c1745711f0c0de61d0ad1b53d1a834bdd9cfe643641c7d1fb0b33e838882b328f8cdc36da7fd25db4ad917063fd49f70a5ea9316a17e85aee8a519e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

Filesize
512KB

MD5
909eb7a657ae76519c95a3b6f1801ce2

SHA1
b30a7b01bd8e282efd2a49a1e14dd1bf286081d8

SHA256
a21881a1e56ebc64cbf764523447049fee7208460b34468a699011e7c6836c0a

SHA512
c2d5ace249591d4db34a01b65c167cb84c475adc8b2d48fcc113c49b5f3f2b17e8fe6d5b9b62720f40d77cd1e6349098c6b0f9b8036633648e634b666f5aae78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

Filesize
14.0MB

MD5
0709026d490b5e90df6118629e2ca909

SHA1
dcf6dd7580f80bd4cc21df620b63cd9bfeb4cfd4

SHA256
942111da5ad6e1e722f11ab1969ff5ebe57117f80119ff667f8c70c382eaa6fc

SHA512
37d07179cc115597d618d20e4ca14b13e458b2fe6af28360867887b3d45eafe70228e8d92d6db3e2d810d199b8b9d3f7ca8e4b6b737d95f0dc81a8525556856b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

Filesize
14.0MB

MD5
183f952b22bb62be1530f9a84738f7c2

SHA1
5f3ec076f2006f387870b432bf0d156ead6ae35a

SHA256
7193d02c227fb8facbd333b851041e2a5c0de36a8c97463887a1956452301d6b

SHA512
603100f76c5babe38ee95a66c27486bc46ff896f02070ca356e71fba4b38ff985051b0ceb948469605b1eab5e89dec00c78bc57e50cc49c39ee8f42f35d60925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

Filesize
14.0MB

MD5
2180682da1a0258482bf300eeac49799

SHA1
da5ab5b93754eb0dd3ab251eb3ac208eae7b7032

SHA256
367c4e360002abd11019e5bb91d713ad16c389e8fed0e58a337ee7a2ce8d1622

SHA512
b7cadae487e8945988c21ca9925bd62a385a0462545431b000d6a109016cd57bdc02d50ef6ddb0e875f049ffaae1a9388ac5e945911c82aa7ea433bb6145d4c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

Filesize
16KB

MD5
50ed1301c001ee07a9946dc9ff837018

SHA1
9fc656f4438b2449daa26611240c329d4ae892b8

SHA256
1277023814582d81943fb817b6d5ad26630b514e0410829d8ca2a1f25956c698

SHA512
be94fa4670dd213157c7b119eaf53754891b25928ecc821b6c9432ee409fc5b0a0bd2dc643538d49cba771149b2815e50df051e1a43aadf88187f0aab03b2cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

Filesize
16KB

MD5
9e2184958e47d28dbf32af0620cde64e

SHA1
babc3a7c6ba9e608d88515669847d7736768fe62

SHA256
0bafec6636325f7fd03a805212fd4259fe76e191fca03d7b5cecfa6a5a5f8ab4

SHA512
7487ef715ab8d86c8e5516fa8292659b2e1ed2c11e0fa379738fad299a3bf23ab1b48ae7fc3f537ea6c7677b6fe4aae229710f12ac78d6df8681e39acbe83a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

Filesize
16KB

MD5
d097cc92fa56d8931cf67e7a93dc9ba9

SHA1
338f556d68c17d8c512dd7cd5d18a3174d7eaf46

SHA256
476f92dc32f8ee08c995b8674b7409218f6cb11654769ceb88f84b822b4b3e86

SHA512
23952c3284e8962e118097b69ba41c28ede986459d19b7228f336c899f346aeba6ba182ec4753e4d5e056a0cd9037088633ae1c3c62ec672d846de2803445e4d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133585940239738864.txt

Filesize
75KB

MD5
4196838d7bcf8227fd58a6508516ef85

SHA1
1a2071b13fb16522f77ef8e199026a709296598c

SHA256
07846a4a0a81eef717d83ed2943465be5d8bdf7f19a6eb46515f0130b5d91599

SHA512
04fe74499f358faeef7acba6303626c29a8f2ec66d08add86852208fdf9ad112831e798b338bbee388832dbce3d40120cfbc6e966d303fce7547ee58abf554a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
23KB

MD5
802d86e18f1986804a1bef86b603573e

SHA1
46de436d11f0215a1f91018a6474687559cde224

SHA256
37efb463add119afef22725824600ff5732f54d1dfc900f1d6184764d697eb0b

SHA512
9a44e9bbee3dc95c64e27d2a2e88466656e864a4f3842ce918bd6943356729e1c98b096c4b16cc0d3df4f7078e553890eab0c00657ac21b4a394ac49bc323cd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_80d203c6.bat

Filesize
190B

MD5
e513a61e1545c037da58191930e39fa2

SHA1
d37b14eb5bd684a73f37fbe5c877a10fc967b8d6

SHA256
9454f607099ab3ac16f10088b3a2b7d4fe7b95ee5aa68bcdeeb5cd9f1dc121e7

SHA512
e8ff253f13d681ba03a830663c901fa364ed5f1cfd336da6cc11c4e1a5e93606092564112152c52ef669c18e7da5ab5ec0c673570a54094a3af2538931cd241d

Download Submit
C:\Users\Admin\AppData\Roaming\Maafry\afypo.exe

Filesize
67KB

MD5
f1545678a360375d25164d52c33789d9

SHA1
698371dc7a1dc05f13a9b811fc44bde39a95a5c3

SHA256
983e9601a3d8248948ec6bf514b7e94ee90d851914ce04c4649aab2ddd2e4e6b

SHA512
39a1d2991cef8b87c44b693fed27b931543d97df1efb81b1686af40edc6688a275646b30fef6d04323667786139e8c3dea618ce2c4025b0b005732f73209b5d1

Download Submit
memory/464-58-0x000001FBD39A0000-0x000001FBD39B7000-memory.dmp

Filesize
92KB

Download
memory/464-69-0x000001FBD39A0000-0x000001FBD39B7000-memory.dmp

Filesize
92KB

Download
memory/664-4558-0x0000023763A30000-0x0000023763A47000-memory.dmp

Filesize
92KB

Download
memory/1252-5564-0x00000235A6D00000-0x00000235A6D17000-memory.dmp

Filesize
92KB

Download
memory/1252-5574-0x00000235A6D00000-0x00000235A6D17000-memory.dmp

Filesize
92KB

Download
memory/1460-75-0x00000165CAE10000-0x00000165CAE27000-memory.dmp

Filesize
92KB

Download
memory/1460-68-0x00000165CAE10000-0x00000165CAE27000-memory.dmp

Filesize
92KB

Download
memory/1796-72-0x000002495F110000-0x000002495F127000-memory.dmp

Filesize
92KB

Download
memory/1796-63-0x000002495F110000-0x000002495F127000-memory.dmp

Filesize
92KB

Download
memory/1804-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1804-84-0x0000000004B80000-0x0000000004B97000-memory.dmp

Filesize
92KB

Download
memory/1804-87-0x0000000004B80000-0x0000000004B97000-memory.dmp

Filesize
92KB

Download
memory/1804-88-0x0000000004B80000-0x0000000004B97000-memory.dmp

Filesize
92KB

Download
memory/1804-238-0x0000000004B80000-0x0000000004B97000-memory.dmp

Filesize
92KB

Download
memory/1804-18-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1804-89-0x0000000004B80000-0x0000000004B97000-memory.dmp

Filesize
92KB

Download
memory/1804-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1924-278-0x000001F46A390000-0x000001F46A3A7000-memory.dmp

Filesize
92KB

Download
memory/1924-293-0x000001F46A390000-0x000001F46A3A7000-memory.dmp

Filesize
92KB

Download
memory/2416-16-0x00000213FBF30000-0x00000213FBF47000-memory.dmp

Filesize
92KB

Download
memory/2416-23-0x00000213FBF30000-0x00000213FBF47000-memory.dmp

Filesize
92KB

Download
memory/2432-4359-0x000001B3E98E0000-0x000001B3E98F7000-memory.dmp

Filesize
92KB

Download
memory/2432-4290-0x000001B3E98E0000-0x000001B3E98F7000-memory.dmp

Filesize
92KB

Download
memory/2448-19-0x0000026DE1540000-0x0000026DE1557000-memory.dmp

Filesize
92KB

Download
memory/2448-26-0x0000026DE1540000-0x0000026DE1557000-memory.dmp

Filesize
92KB

Download
memory/2524-22-0x00000278E3810000-0x00000278E3827000-memory.dmp

Filesize
92KB

Download
memory/2524-27-0x00000278E3810000-0x00000278E3827000-memory.dmp

Filesize
92KB

Download
memory/3240-39-0x00000000023F0000-0x0000000002407000-memory.dmp

Filesize
92KB

Download
memory/3240-31-0x00000000023F0000-0x0000000002407000-memory.dmp

Filesize
92KB

Download
memory/3240-36-0x00000000023F0000-0x0000000002407000-memory.dmp

Filesize
92KB

Download
memory/3240-33-0x00000000023F0000-0x0000000002407000-memory.dmp

Filesize
92KB

Download
memory/3240-30-0x00000000023F0000-0x0000000002407000-memory.dmp

Filesize
92KB

Download
memory/3240-24-0x00000000023F0000-0x0000000002407000-memory.dmp

Filesize
92KB

Download
memory/3272-40-0x0000000000B20000-0x0000000000BCC000-memory.dmp

Filesize
688KB

Download
memory/3272-43-0x0000000000D10000-0x0000000000D32000-memory.dmp

Filesize
136KB

Download
memory/3272-50-0x0000000001150000-0x000000000125B000-memory.dmp

Filesize
1.0MB

Download
memory/3272-20-0x0000000000170000-0x0000000000200000-memory.dmp

Filesize
576KB

Download
memory/3272-15-0x00000000005D0000-0x0000000000899000-memory.dmp

Filesize
2.8MB

Download
memory/3272-49-0x0000000001020000-0x000000000114A000-memory.dmp

Filesize
1.2MB

Download
memory/3272-47-0x0000000000E80000-0x0000000000F1E000-memory.dmp

Filesize
632KB

Download
memory/3272-12-0x0000000000510000-0x00000000005CE000-memory.dmp

Filesize
760KB

Download
memory/3272-46-0x0000000000D40000-0x0000000000D6B000-memory.dmp

Filesize
172KB

Download
memory/3272-37-0x0000000000970000-0x0000000000B11000-memory.dmp

Filesize
1.6MB

Download
memory/3272-52-0x0000000001300000-0x0000000001400000-memory.dmp

Filesize
1024KB

Download
memory/3272-55-0x0000000002BE0000-0x0000000002C11000-memory.dmp

Filesize
196KB

Download
memory/3272-48-0x0000000000D70000-0x0000000000E0B000-memory.dmp

Filesize
620KB

Download
memory/3272-60-0x0000000002D00000-0x0000000002D34000-memory.dmp

Filesize
208KB

Download
memory/3272-51-0x0000000001260000-0x00000000012FD000-memory.dmp

Filesize
628KB

Download
memory/3272-64-0x0000000002D40000-0x0000000002D67000-memory.dmp

Filesize
156KB

Download
memory/3272-53-0x0000000000E10000-0x0000000000E40000-memory.dmp

Filesize
192KB

Download
memory/3272-57-0x0000000002C20000-0x0000000002C38000-memory.dmp

Filesize
96KB

Download
memory/3272-73-0x00000000030C0000-0x0000000003143000-memory.dmp

Filesize
524KB

Download
memory/3272-70-0x00000000030B0000-0x00000000030BC000-memory.dmp

Filesize
48KB

Download
memory/3428-99-0x000001C3C2B10000-0x000001C3C2B27000-memory.dmp

Filesize
92KB

Download
memory/3428-122-0x000001C3C2B10000-0x000001C3C2B27000-memory.dmp

Filesize
92KB

Download
memory/3440-5480-0x00000260CEB00000-0x00000260CEB17000-memory.dmp

Filesize
92KB

Download
memory/3484-29-0x00000216CD1D0000-0x00000216CD1E7000-memory.dmp

Filesize
92KB

Download
memory/3484-34-0x00000216CD1D0000-0x00000216CD1E7000-memory.dmp

Filesize
92KB

Download
memory/3544-56-0x000001A9B3470000-0x000001A9B3487000-memory.dmp

Filesize
92KB

Download
memory/3544-62-0x000001A9B3470000-0x000001A9B3487000-memory.dmp

Filesize
92KB

Download
memory/3544-65-0x000001A9B3470000-0x000001A9B3487000-memory.dmp

Filesize
92KB

Download
memory/3628-108-0x0000025719F20000-0x0000025719F37000-memory.dmp

Filesize
92KB

Download
memory/3628-90-0x0000025719F20000-0x0000025719F37000-memory.dmp

Filesize
92KB

Download
memory/3628-85-0x0000025719F20000-0x0000025719F37000-memory.dmp

Filesize
92KB

Download
memory/3740-32-0x0000027F7FC90000-0x0000027F7FCA7000-memory.dmp

Filesize
92KB

Download
memory/3840-42-0x000001F312D40000-0x000001F312D57000-memory.dmp

Filesize
92KB

Download
memory/3840-35-0x000001F312D40000-0x000001F312D57000-memory.dmp

Filesize
92KB

Download
memory/3944-38-0x000001BE740F0000-0x000001BE74107000-memory.dmp

Filesize
92KB

Download
memory/3944-45-0x000001BE740F0000-0x000001BE74107000-memory.dmp

Filesize
92KB

Download
memory/4048-4903-0x0000023990350000-0x0000023990367000-memory.dmp

Filesize
92KB

Download
memory/4048-4968-0x0000023990350000-0x0000023990367000-memory.dmp

Filesize
92KB

Download
memory/4048-54-0x0000023990350000-0x0000023990367000-memory.dmp

Filesize
92KB

Download
memory/4384-5484-0x000001DFA5B20000-0x000001DFA5B37000-memory.dmp

Filesize
92KB

Download
memory/4384-5504-0x000001DFA5B20000-0x000001DFA5B37000-memory.dmp

Filesize
92KB

Download
memory/4440-61-0x000002601FBA0000-0x000002601FBB7000-memory.dmp

Filesize
92KB

Download
memory/4440-67-0x000002601FBA0000-0x000002601FBB7000-memory.dmp

Filesize
92KB

Download
memory/4780-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4780-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4780-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4780-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download