Resubmissions

09-05-2024 19:03

240509-xqb55saa7z 10

09-05-2024 18:56

240509-xlf9ashg5x 7

Analysis

  • max time kernel
    457s
  • max time network
    460s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-05-2024 18:56

General

  • Target

    SS11V2074FMIPX64.rar

  • Size

    46.8MB

  • MD5

    bc2c8ca40ecc7191f7b08b6474958191

  • SHA1

    0eeb71df67d9372dcbfcb7ef87defd1180fef42e

  • SHA256

    43202f9f96310b7a41a1b93a4ad394ed58657b440304fb5f94f2da6155d8e965

  • SHA512

    1044ef796ae99bbba1bd45e7303731ee892b64d766d2959c1d1a21c50cc91db25721bdc099a6992972ae0de9f7b874c44a14b182fd05cd338c7a6cc4cd0621f1

  • SSDEEP

    786432:ILz1/rRwSxUpc3M1YVoUQX34K+PCOzWevESta+cF4JJwTDcyQuZK5r31/gLv0mpl:8/bH6sofwPkQESJwPch5BcMm/Hmq1

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 25 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SS11V2074FMIPX64.rar
    1⤵
    • Modifies registry class
    PID:3880
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:32
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa11773cb8,0x7ffa11773cc8,0x7ffa11773cd8
      2⤵
        PID:3736
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
        2⤵
          PID:256
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2944
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
          2⤵
            PID:3140
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
            2⤵
              PID:3840
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:2076
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                2⤵
                  PID:548
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
                  2⤵
                    PID:248
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
                    2⤵
                      PID:3448
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
                      2⤵
                        PID:2092
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2732
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
                        2⤵
                          PID:3560
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                          2⤵
                            PID:4368
                          • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2104
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                            2⤵
                              PID:1756
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4736 /prefetch:8
                              2⤵
                                PID:4012
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2032 /prefetch:8
                                2⤵
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4596
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                                2⤵
                                  PID:5024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
                                  2⤵
                                    PID:4636
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                                    2⤵
                                      PID:2300
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
                                      2⤵
                                        PID:5112
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6428 /prefetch:8
                                        2⤵
                                          PID:4092
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6564 /prefetch:8
                                          2⤵
                                          • NTFS ADS
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2408
                                        • C:\Users\Admin\Downloads\7z2404-x64.exe
                                          "C:\Users\Admin\Downloads\7z2404-x64.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Registers COM server for autorun
                                          • Drops file in Program Files directory
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1176
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
                                          2⤵
                                            PID:4800
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
                                            2⤵
                                              PID:2032
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                              2⤵
                                                PID:4312
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
                                                2⤵
                                                  PID:3100
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
                                                  2⤵
                                                    PID:724
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
                                                    2⤵
                                                      PID:3660
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
                                                      2⤵
                                                        PID:1456
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6828 /prefetch:2
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2292
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
                                                        2⤵
                                                          PID:548
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
                                                          2⤵
                                                            PID:3108
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,15698666660922826286,722459502514992018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
                                                            2⤵
                                                              PID:4036
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:1100
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:2164
                                                              • C:\Windows\System32\rundll32.exe
                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                1⤵
                                                                  PID:572
                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D0
                                                                  1⤵
                                                                    PID:4496
                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                    1⤵
                                                                    • Modifies registry class
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:3084
                                                                  • C:\Windows\system32\OpenWith.exe
                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                    1⤵
                                                                    • Modifies registry class
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2036

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Program Files\7-Zip\7-zip.dll

                                                                    Filesize

                                                                    99KB

                                                                    MD5

                                                                    fe487725998a00de2ecd41b1357ca0bc

                                                                    SHA1

                                                                    cffe7d83767b3334533f9525bea67e34dcb2b632

                                                                    SHA256

                                                                    e0625e017c02038cf25b60d03f3c46da44b4232bf9c664cf30bcf67af81229b1

                                                                    SHA512

                                                                    173191f2678a4e73457ce4a4008c432080e050004fe034f93cf05281be6be670c54e0c37f23b90d4f9f6cce4de82fbff71cec817bf301d4d84405ea238f1c730

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    046d49efac191159051a8b2dea884f79

                                                                    SHA1

                                                                    d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

                                                                    SHA256

                                                                    00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

                                                                    SHA512

                                                                    46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    34d22039bc7833a3a27231b8eb834f70

                                                                    SHA1

                                                                    79c4290a2894b0e973d3c4b297fad74ef45607bb

                                                                    SHA256

                                                                    402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

                                                                    SHA512

                                                                    c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b28958d-7c00-4b64-ad73-2c6ccad80b0f.tmp

                                                                    Filesize

                                                                    481B

                                                                    MD5

                                                                    49489411c71733a27c4308154c752d7c

                                                                    SHA1

                                                                    ff222d92143d456f8454780ce5e8ac73cd9d1d15

                                                                    SHA256

                                                                    0c89277b18e6303a949df139ea53b0233bd720e74469039e8a4711b8958b2ef9

                                                                    SHA512

                                                                    c118125e3a83bc22a298e74818b6a5ca957789485bfe1c2a438e8e26b9cf1e7549958ab79655a639a9753a32aa48b2195e06db10e5a3ab1e08c9e831366112f5

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                    Filesize

                                                                    67KB

                                                                    MD5

                                                                    d2d55f8057f8b03c94a81f3839b348b9

                                                                    SHA1

                                                                    37c399584539734ff679e3c66309498c8b2dd4d9

                                                                    SHA256

                                                                    6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

                                                                    SHA512

                                                                    7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                    Filesize

                                                                    64KB

                                                                    MD5

                                                                    d6b36c7d4b06f140f860ddc91a4c659c

                                                                    SHA1

                                                                    ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                    SHA256

                                                                    34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                    SHA512

                                                                    2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                    Filesize

                                                                    37KB

                                                                    MD5

                                                                    472ec32677a453af2c74692a60147dad

                                                                    SHA1

                                                                    d88b5e900d82c9bdac5cecdc1104ae46888f9e89

                                                                    SHA256

                                                                    28f495a706bbb9a09ca286ecba0123bde6bb8e1e0aece749eeea7c8d62fd52f7

                                                                    SHA512

                                                                    4140bdd439121c889e8ca3824b2aa6783318d0ed28557ad18ec8469df1cbcfa4b492f37b27124f3ec12300e3e32247bc1bd3aa9e89936228e6fba84e975beea0

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                    Filesize

                                                                    19KB

                                                                    MD5

                                                                    2e86a72f4e82614cd4842950d2e0a716

                                                                    SHA1

                                                                    d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                    SHA256

                                                                    c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                    SHA512

                                                                    7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                    Filesize

                                                                    65KB

                                                                    MD5

                                                                    56d57bc655526551f217536f19195495

                                                                    SHA1

                                                                    28b430886d1220855a805d78dc5d6414aeee6995

                                                                    SHA256

                                                                    f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                    SHA512

                                                                    7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                                    Filesize

                                                                    84KB

                                                                    MD5

                                                                    74e33b4b54f4d1f3da06ab47c5936a13

                                                                    SHA1

                                                                    6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

                                                                    SHA256

                                                                    535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

                                                                    SHA512

                                                                    79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                    Filesize

                                                                    1.2MB

                                                                    MD5

                                                                    be529a907c265364aea60b32d2a6b43f

                                                                    SHA1

                                                                    4e36681dc58aaaa130238083d0aa43d4604019e8

                                                                    SHA256

                                                                    1790bffabda47de3ac63c09728874fec01d03bd240361e81dbef964f8ed179bd

                                                                    SHA512

                                                                    37e65201a514127811d0f92dce4ca096401af92b4c90441d1e0673c1829cdf5d47f513a63f8ee1593987ac3dd542f197654423b0fe24d50aea4794001356004b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                                    Filesize

                                                                    32KB

                                                                    MD5

                                                                    bbc7e5859c0d0757b3b1b15e1b11929d

                                                                    SHA1

                                                                    59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

                                                                    SHA256

                                                                    851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

                                                                    SHA512

                                                                    f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                                    Filesize

                                                                    75KB

                                                                    MD5

                                                                    cf989be758e8dab43e0a5bc0798c71e0

                                                                    SHA1

                                                                    97537516ffd3621ffdd0219ede2a0771a9d1e01d

                                                                    SHA256

                                                                    beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

                                                                    SHA512

                                                                    f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                                                    Filesize

                                                                    35KB

                                                                    MD5

                                                                    6b87c4912a12a66b87dac39cd23f66e3

                                                                    SHA1

                                                                    1fcdf211b0204bf72f3796641e8f3250710c6c8f

                                                                    SHA256

                                                                    eada0a6359c14a98d558445bcad4efded7c0576d9c48ed12a327ea284b1a267f

                                                                    SHA512

                                                                    acf555903871f1cbff113c58c7e5d6ee9170f15bc85a7fc3370a9d0cb9907f0a5690251b8757b1c5b3b2d9f07b97d5debd7e715ccaede720549ea63fdac470ac

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1927a26afb9a8b4a_0

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    e40be977ce95bd5342dc18ffb7104360

                                                                    SHA1

                                                                    e3d6df20f8650d473e3d1c0a1dcb68db49a397bf

                                                                    SHA256

                                                                    03c4e90fee09980fa0b3b98c81d45f5c51e9fa8dccc086db09ba2698351be531

                                                                    SHA512

                                                                    d8ccb4e1d4347506c5550159304657dab6ae2fee674bd9a779cc4f4efd1aaaf303e369828bac9f07851774e1e75eea058553f1f78c2c80750e79de6944ba8660

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2ce29dfb4fbfd6fd_0

                                                                    Filesize

                                                                    5KB

                                                                    MD5

                                                                    241ea0076a79b1e1bd6cc06d76909f3c

                                                                    SHA1

                                                                    abf388749c103419e81028dee7ac756734797466

                                                                    SHA256

                                                                    875cbc38977aca2d0903afcafb12120932935e7a3c331bba76eb162121a3cdb9

                                                                    SHA512

                                                                    7d739cdf20b9b823710e829b889929b3600ea3866bd8f6d7a70fbcc231d3c70ecbda2b376e164e9e8f3a7a597fe436ef98038faca4db79ac8e959dd2d997c06f

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    ceca184a6413d3c9f7b7ba488fb1b4e8

                                                                    SHA1

                                                                    ec75f2cfab26378923f0f900d0235734941ecee6

                                                                    SHA256

                                                                    306bcfb84e04569616a09bc93df9a97ab91dfd133114b0ee8ee713d3877551c9

                                                                    SHA512

                                                                    872536141a42cf59149efa62a2979771ee86378bcd7d42fcd73b6be102c2429be48c8da19a366b91fcc54b1017ffed633a6d5d9ffe7b5ad561421b0dba4492ff

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    7e2868496f72cba5fd0f97643fa56787

                                                                    SHA1

                                                                    5ce0de9db422676da6b1ce90b4747cab63d5dde6

                                                                    SHA256

                                                                    908d73aff4eb5606bdd9fc1263331fb697ecc001fee6d3892af7c9df62bb8b34

                                                                    SHA512

                                                                    e08b31e14c33c58fe8812fea2a1351e43c40b01c371e22edfc7ed1d05ab64526a1641c7756bbc053a31ce15059f65ad0d26fbee2cde4da4286a7b4de9b940b7f

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c35434d25be2b3ba_0

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    8c7154aa2ce440c83d6c28929933471a

                                                                    SHA1

                                                                    a82bdcb6b6b9f21573dd0a946c36221fb3424d1d

                                                                    SHA256

                                                                    a6ce94d9378c597281f209340765b535852736e4f8de383b3f53e250170dcd31

                                                                    SHA512

                                                                    4a2146cf7e6cac54f84990cc2a908001900d391b97afe5d8ad79ff3771cd327a0835451dc8cfff5d41fccda1bfa42297be939c053d7e380efefeb5bdbafdee96

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ed26cd2dcd561670_0

                                                                    Filesize

                                                                    3KB

                                                                    MD5

                                                                    1ecaa88babcd20f95ac03fe38429157e

                                                                    SHA1

                                                                    acd7ee3fdbee0c33a0dc840b1041a81f0555b284

                                                                    SHA256

                                                                    f735124b3809303ac4fbb3efb9b5303397a2fa3941d35e784a3e8cd96be03a3a

                                                                    SHA512

                                                                    b05bbc4c24910aa5adc209ca4befcabd5b766701277a4978b1e0d934d3fd79e566bb7606c15e74c5d8959eedcadd96638ccbe7071dbcde8ee3ef03bb9a936aa4

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    320449aca85c0657bab6bc1c21d6539d

                                                                    SHA1

                                                                    e04eff575937ccc08ab2749676469b39a060e902

                                                                    SHA256

                                                                    8dc482c73646e37e2a7d20dd9e122cbb56bc4341c7d19353086efbf16a4b65ad

                                                                    SHA512

                                                                    c065d356d00268c7f3d061c4a16b54535d2c590661a7c0439cfa5d5fa0f027aadea541451cfa9a17663856903da16b33e54e35abb82077c9107632833e770d72

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    e5df7cc8691ea22377a53dae097973e5

                                                                    SHA1

                                                                    1d9d10c108726314da96ae07dcd6412287f0b36a

                                                                    SHA256

                                                                    ceac3d14b13ae1d00d37517e3f0dfcb17ea0ac64849729eea510f8c90ac6b249

                                                                    SHA512

                                                                    b41cd90405dfb95a8ea1305eef535b35870543af6ac70713a066e2dc1e504bbfb473036d9f8e465d7bcbcc041a6ac5c164f8f235f6d28dae78d60f8cbbf3721a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    9cb57f016b2efc4fd5665d46fc3c6076

                                                                    SHA1

                                                                    ebd3be54c3b33fc3c21994b8134527bdbb400b18

                                                                    SHA256

                                                                    e2154e218788aee6b1dd40f56ee467071e973ce6b68929ea54fea4206b84ba80

                                                                    SHA512

                                                                    8e5c63b59c0aca9afb08a7c2891e958b2986b63f4cc20578f5cea2747dbb75ae5b8e100d9f8b36fd3c6eff0c5ddf3b6949b63a36bb97de19c519d0f9cf4a8e1c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    c6dba5e211c5c635904ae36c65e3cefc

                                                                    SHA1

                                                                    0efcf08b430caafa307e6faf1396f5dadbe8a6bd

                                                                    SHA256

                                                                    e1c37d70270fd8243ac6512cc5fff26c987a18e1e01a186d7f4a087b3e0b4634

                                                                    SHA512

                                                                    532ba5fb24aba2a5dca4a9931932c0f65b269d41fde344f453629fbb1b48502c1ad078b3bc3f51151ed5b48a5c83eb004d2390c63d8e0a65ba723b0ae55a7972

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    111B

                                                                    MD5

                                                                    285252a2f6327d41eab203dc2f402c67

                                                                    SHA1

                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                    SHA256

                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                    SHA512

                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    e275e1ea26f9d7993b77c4b132b25015

                                                                    SHA1

                                                                    63e1761aca23c740161793580bafde947b247d49

                                                                    SHA256

                                                                    dea497584036998356a4248696b1df45b67dbf71e16b4e75a52c1d789da0749a

                                                                    SHA512

                                                                    d92b50402470e767fdf76f879b513e0e1a2214e1d461dc942160e2887e8437fde879206f345187d6321eae1970e0566e354d7b05046c8aa7cb16daf28426f278

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    7b8d4be134ffbe1baf89ac2e47f663ec

                                                                    SHA1

                                                                    1a273a668d41663dd71f8089037f65d4f92f71a5

                                                                    SHA256

                                                                    d982e611f308554a93b59b720058f08549547872f614405c34080a58b1733729

                                                                    SHA512

                                                                    d4f46008d8a518b7a81fdc68da8fdd03db6b122e72e79222c3b0524abbe93ae21f4c6e58519ed6fb78f757acec9c5ace8d2e54bd7f426953b3b6288a0c501317

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    5KB

                                                                    MD5

                                                                    481ef69dc5034d8bc73cb6edfa510029

                                                                    SHA1

                                                                    d6348e0fcd7cdc24d8a7158a33c494fd26e66337

                                                                    SHA256

                                                                    e32ba5ff34b55e4001a04cbad21fff556ebebac248527ca9049f857d0624a2a4

                                                                    SHA512

                                                                    4a2f3d4c34b2bd27c702f85306908398b36aacaf15437e03660bd7a24b962032b1657c6ec60429e69238f4ab5c90c286cc651bed453077bebd93aae01595ccb8

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    0d26595516001ccb529a4c2d47b39367

                                                                    SHA1

                                                                    0b2c1f9a618d5a190f06c2c59e1ede611caf00e2

                                                                    SHA256

                                                                    3f45075c8e32ca09daa807a9e4b1dbf55dcfd72cbc9368b15d3b35b0d5923b75

                                                                    SHA512

                                                                    7f83ab50cdb0331fc5e4b0610e7e623d68eb76b3baaa700240a9699496ee05746c2fe2637c8cd076b913d1553171c7e564e77d51648b943ab55a1ae5fc5912e1

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    02b2399904afeb48de10a979eb58961b

                                                                    SHA1

                                                                    ebf7afc4c993792d682c47c15563c16c0f11d102

                                                                    SHA256

                                                                    08d6739e9efa33db0ef4522da7cb732530f6a469a2413382124a662a3793d61c

                                                                    SHA512

                                                                    5f2aa44a7974f89657437ddd33120aaf023621b19215d8647d5136c6aa041ac9277edfbbb5a02365817c16ac7829f93f4ea78cd8fc7d8e993f36471bbfc2675b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    9199e6306d25dbf9fccdb8a7788b5e1a

                                                                    SHA1

                                                                    8174b61421ef2ed0f2f1dac5c41fbbda65b75409

                                                                    SHA256

                                                                    ab00631a5d5a203b81eff90ef56d9c5e7d400b4ebf73ccd5cfb74a5d1b9618ae

                                                                    SHA512

                                                                    a91ad17f4e0aefb422558503117961f8d1304067749468a262f78817bd0cc8ebfb098cea1e61707d2f7f17f13b92794460fbed683ed9ddaf590fe3bd4ae4a570

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    1ad93505d002d002224e1cb2f6a16086

                                                                    SHA1

                                                                    9c93c818c3c6d233901e82231da5648625271bb9

                                                                    SHA256

                                                                    edb70d35a0c44ac6564ea3929ba5be11d6635fc0fca38a7e14e2a7daf338a5a4

                                                                    SHA512

                                                                    b2a4f8897fe352b24f9b8034608726cdb81c7895b75ec0241a0e0c8bb23a09a5a5a1f502bae6db10517644a824b1ccd8865ab3c2373d912ed0b29f71fbb96853

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    7c90cce4ebba8caa7d75aa0e872591de

                                                                    SHA1

                                                                    911ab6ca78e3f511ae37d9cfb1dedb17c7ac27de

                                                                    SHA256

                                                                    f53ebc1a27654e9f2af221b8e6ce15c6efe646f5e75fd7d86c947b5285d21e46

                                                                    SHA512

                                                                    ce0ebf8972adcdfc20138685ea88018ad8d24d6655df44b2b94a93feb9ae38c31609859fddf5c0efe864117d1e6ad6149c475f787475f7647f64b63421563c51

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    cb2f2bc080ac7ff4f5d41fa029262064

                                                                    SHA1

                                                                    8da5d6f95649c68abf9b6bb6ced26523fb8f0bde

                                                                    SHA256

                                                                    e9fc52493e8b64db4e0f7fb893c6128f7dc49a1195ff9e9e6d50e21339f7a054

                                                                    SHA512

                                                                    197316e2a692b024c6405c89ec6767e44bccc97b36a3019c22d9a97d27dd359e8924f2383fab827c90059bfbff7588db4aa11255116835eb477623826f3247e8

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    52c6dd24359d2104b3cd027c6534ba08

                                                                    SHA1

                                                                    a69c4e171d4e75a6eb3f174ce86d6cf66592fced

                                                                    SHA256

                                                                    58a67e4d366d8fb8cc942357526a7e5ec2592533546a2a68c7d852499b9a0af6

                                                                    SHA512

                                                                    e9975ad788e990b91f57015570c6a2a1a6ac5e5fc21e9df9fd3d8e9304198c756a2727f9c350dd7d70889307d354a8b4dbd4d13dbbbc342125f903c1988731c5

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    536B

                                                                    MD5

                                                                    7ac006cd880d25af72a709a1ecd93a00

                                                                    SHA1

                                                                    eece3e48fe398ecbdb7566e53d3f9bb2073d7e6d

                                                                    SHA256

                                                                    c096e0f3bf3a1d3a342b23245fda3ff64bcb572181fdac2e454d5a30f843a944

                                                                    SHA512

                                                                    f850efe11560e41ce8fe39848b6d8a36fa5667df3e5a3d80d17954a19cef13492d3bcc55d782e72da9531889831220b7de3b4653bdf377cc8d8884637ac3b6ab

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    703B

                                                                    MD5

                                                                    414976972b909df969c0a6f7008f78d2

                                                                    SHA1

                                                                    b267c707905d360c492a636647e59b5e79e849f2

                                                                    SHA256

                                                                    86db705001e1b1cd3f135d07e0d3bb873458eea81451af1b44e4dc2894e8e394

                                                                    SHA512

                                                                    c1b4ea8a1cae0020c905fc4bb1e866d1530da3d007990a11d6d3145a478c9cefa27e067899282a7b5a4611d079965b27998915f6bc3f01377c3bffa42ea3ba22

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    703B

                                                                    MD5

                                                                    ba848a9331c0b07b850bb2290470b88f

                                                                    SHA1

                                                                    1da49a9eee0cec5e8a6c5db7a45e4e79c0136650

                                                                    SHA256

                                                                    87351839bd038aeff9950e716c4634845ecada30773f3a7d508d49f5fa12e870

                                                                    SHA512

                                                                    86d06f373413c44f2fcab489f4ec4443d8e177e2455462307f46e9f33f72b6685f9ae6ca908d28a5a506400fdbaff5fdb7bfe6a73c8205be79327560c6d6f69e

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    703B

                                                                    MD5

                                                                    5732d6761eb1e218fa3ff4e3623b39d4

                                                                    SHA1

                                                                    81aeda6b02d79eb4b2b3c8cb347358706106b8fc

                                                                    SHA256

                                                                    b842c9d7cb4628f39e570ed24928e79222d41e41c318aa4b798195875d015af6

                                                                    SHA512

                                                                    d73af1cd7dad8c4e7f80c56cfcae727c39ce621da8e8c34c5829af3c0e0a64322a1dcee145c6650c325dcbd4136954b1bfb84f873980aaf934b4816fc217976e

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cfaf.TMP

                                                                    Filesize

                                                                    536B

                                                                    MD5

                                                                    dd316a132ce4bdd6d5fd34fe8427aa7d

                                                                    SHA1

                                                                    10547edbea49848108138efddcdaab36cf34006f

                                                                    SHA256

                                                                    68618bac81542d50316e36b6889a8b38e74160b9cee222c6f622d887228f3323

                                                                    SHA512

                                                                    a0eed6bfc560190119806675dce83a48a3305c53cd99dabe06f5d403df655c3b00a0729b4bf23dee03cd885901cecf7e8dfb8bb89a157295049ff86654433dc6

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    46295cac801e5d4857d09837238a6394

                                                                    SHA1

                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                    SHA256

                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                    SHA512

                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    206702161f94c5cd39fadd03f4014d98

                                                                    SHA1

                                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                    SHA256

                                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                    SHA512

                                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    11KB

                                                                    MD5

                                                                    38f3dd614b30741049239e6a3be1c43a

                                                                    SHA1

                                                                    50c46b8f51d1a8e1c02f5b378482474aad27ac26

                                                                    SHA256

                                                                    2a8e4d92dc33c269c3fbc74ee39544cf98ab5c86564861ddcb2484977ea5de72

                                                                    SHA512

                                                                    af685db20327867022dcbdfbfdc4c90e8f29b1be06e2668f0a472a0441a388cbd8774dd2028a75f984e56bf68e7aa58bbc3834cfbe3734f9aae60272d281f209

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    11KB

                                                                    MD5

                                                                    ccc93c75f9c671146d480194b9a6946a

                                                                    SHA1

                                                                    ce709dc128f3dcfd4a4cd1879b3483a9e5a0a55e

                                                                    SHA256

                                                                    223a5a53719bd0da992ca37a85ca1c1f007d7fcd1a312e64d0367c918e670003

                                                                    SHA512

                                                                    3f4c9124bd3c93976d5ae1928712077110766ce0b01913c35bfdf3c984e589210361115d0de93376c3c5b60386f9e328aa7d70b06211e891d38804be1c35765a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    12KB

                                                                    MD5

                                                                    382c6d10d7f061483a10803001020937

                                                                    SHA1

                                                                    05a9336df0759277c749e822c119e0e90bacefcc

                                                                    SHA256

                                                                    ef981ec955832b7412adf4ab3f3d04342190147ad2e8abbae476fef89d12b643

                                                                    SHA512

                                                                    c7242997531a928c9428021a251e14b0534b54179161f112a96d9f4482c98dbc40300e948ffd5d18b0aedc0fbfc91a4e83af2b097534a357f215cde04d382bf1

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    12KB

                                                                    MD5

                                                                    6a78dee48b8c96e846969ed46508b3c8

                                                                    SHA1

                                                                    8ef4319c20308a8ae3818185e82dcf24c2b802cd

                                                                    SHA256

                                                                    f64bb7cc38a9a4bd5d1e203fa28a68623b28506d804f390baa669aa0901038cd

                                                                    SHA512

                                                                    708ae61cf46592ddf26f1eb0295c09e1f2087fed6636c5996ec0e25ffa90ce56adbc19aba54c7dece5caf84b134c79bd0656eba35e63d89b5c005f7fcc21b95f

                                                                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                                                                    Filesize

                                                                    10KB

                                                                    MD5

                                                                    6e2dd918b2c22ec9d38424b34577d88b

                                                                    SHA1

                                                                    ce9b5ec7934ace13a02d64f494ec8cf6de8ce5c9

                                                                    SHA256

                                                                    037e7f2cd9d518cafd37f55edee61feac13b4dfdd35f67b41d7af525d93b7f0f

                                                                    SHA512

                                                                    fe292b07ea0f7db690e00640f29b5cf7de32ddcdc887c24075801e1b7ad756e94dab31e297efff6c9def49ec3ac20e22c71ba40afb7e4fb75bf0678b64328eca

                                                                  • C:\Users\Admin\Downloads\7z2404-x64.exe:Zone.Identifier

                                                                    Filesize

                                                                    26B

                                                                    MD5

                                                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                    SHA1

                                                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                    SHA256

                                                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                    SHA512

                                                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                  • C:\Users\Admin\Downloads\Unconfirmed 438127.crdownload

                                                                    Filesize

                                                                    1.5MB

                                                                    MD5

                                                                    61ba723e67d41dd15e134b973f2d7262

                                                                    SHA1

                                                                    3282a5b7c20c7123ae6168f0c565d19930ffb6f6

                                                                    SHA256

                                                                    4931869d95ffa6f55788e3b5d92088f3fe590e13532b9d8e811a52e2b377bfb6

                                                                    SHA512

                                                                    b293d21403e8ac935a0ae8daf27a069b31b3b6c4d078d3966f2411e5df34094f9e0ea50c7fdb118ae7f2e7ca25a3b526f0bc172e769244bd92125858357ce0ff