Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/05/2024, 21:54

General

  • Target

    https://browimeto.click/?up=e2a82bc944060d36243d5&d=1&x=102&down=b70dc785141a5c00a9eb9465&p=Mafia%202

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://browimeto.click/?up=e2a82bc944060d36243d5&d=1&x=102&down=b70dc785141a5c00a9eb9465&p=Mafia%202
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcfa3b3cb8,0x7ffcfa3b3cc8,0x7ffcfa3b3cd8
      2⤵
        PID:232
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
        2⤵
          PID:1500
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1072
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
          2⤵
            PID:380
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
            2⤵
              PID:4868
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
              2⤵
                PID:1840
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
                2⤵
                  PID:2912
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                  2⤵
                    PID:4668
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
                    2⤵
                      PID:1576
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
                      2⤵
                        PID:3340
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
                        2⤵
                          PID:4620
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                          2⤵
                            PID:1664
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
                            2⤵
                              PID:3564
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                              2⤵
                                PID:2564
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                                2⤵
                                  PID:2252
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
                                  2⤵
                                    PID:644
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                    2⤵
                                      PID:4596
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
                                      2⤵
                                        PID:3852
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
                                        2⤵
                                          PID:1148
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
                                          2⤵
                                            PID:3596
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3156
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
                                            2⤵
                                              PID:1904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:1
                                              2⤵
                                                PID:5224
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7588 /prefetch:1
                                                2⤵
                                                  PID:5324
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
                                                  2⤵
                                                    PID:5392
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
                                                    2⤵
                                                      PID:5460
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
                                                      2⤵
                                                        PID:5532
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8640 /prefetch:1
                                                        2⤵
                                                          PID:5600
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8772 /prefetch:1
                                                          2⤵
                                                            PID:5608
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7712 /prefetch:8
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:6084
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
                                                            2⤵
                                                              PID:5788
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8776 /prefetch:1
                                                              2⤵
                                                                PID:5764
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
                                                                2⤵
                                                                  PID:3032
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:1
                                                                  2⤵
                                                                    PID:4488
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
                                                                    2⤵
                                                                      PID:832
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
                                                                      2⤵
                                                                        PID:5308
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8848 /prefetch:1
                                                                        2⤵
                                                                          PID:6068
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
                                                                          2⤵
                                                                            PID:5740
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
                                                                            2⤵
                                                                              PID:2780
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7012 /prefetch:8
                                                                              2⤵
                                                                                PID:5508
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=8788 /prefetch:8
                                                                                2⤵
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:5516
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:1
                                                                                2⤵
                                                                                  PID:5420
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                                                                                  2⤵
                                                                                    PID:2812
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4592 /prefetch:2
                                                                                    2⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:5008
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2976
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,74135022155788896,4798227893210520881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4728
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4684
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:3572
                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                          1⤵
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5800
                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                          1⤵
                                                                                            PID:3456

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            55540a230bdab55187a841cfe1aa1545

                                                                                            SHA1

                                                                                            363e4734f757bdeb89868efe94907774a327695e

                                                                                            SHA256

                                                                                            d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                                                                                            SHA512

                                                                                            c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

                                                                                            Filesize

                                                                                            230B

                                                                                            MD5

                                                                                            a33c13aab26c2ebf89f6971c7ec92395

                                                                                            SHA1

                                                                                            a68c78431776208c9055046e54f3057588104e54

                                                                                            SHA256

                                                                                            7a8e57f1042207a90e7f9df8177b796cfb2245a96636ac999f202f5214fb0596

                                                                                            SHA512

                                                                                            24b47dc44cdc605b9d65f7eff42be2dac10cb5300b80af47e08dfa3150183dc9e24a1d1b527262318e886eb526f07f1651eae5e00a2176e194307d960978be95

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                            Filesize

                                                                                            330B

                                                                                            MD5

                                                                                            6c420bb800fcae096fc9cfc8184f02a9

                                                                                            SHA1

                                                                                            3f2b35f0efa30b7adef09d6c324c7ca2c26c6591

                                                                                            SHA256

                                                                                            2284f8112a7e5942aa11aad6e3002d5cbaa73482ea2dbf0bf571002eaee534d5

                                                                                            SHA512

                                                                                            647204118c854ba33ac53fc5f5b0529e438d183c4c7da33747140d556de2b60c80ed38e1c23a9a154f492b81a80a114c387e590a99153d8e64b4ef7c3ecf9c58

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                            Filesize

                                                                                            330B

                                                                                            MD5

                                                                                            600ef7ba70eeb116dc1ec2af12fece5f

                                                                                            SHA1

                                                                                            ce6b0f82800e9fd020e6e62a433833ba99765923

                                                                                            SHA256

                                                                                            ff326a8b75f4d017c191838c38ce368ae4c6b33992bd7f1d8f33857fc283295e

                                                                                            SHA512

                                                                                            d5552ef7229591bcb74b93f17366dd1b71cc5f8cdaffc7e0de06168a685be02035a11a1d47db37ffca0cb9e746f34f445fc7e7949ab8e1aed67edace0baa2e80

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                            Filesize

                                                                                            330B

                                                                                            MD5

                                                                                            c3cca86c384d094252264ec74f1341bd

                                                                                            SHA1

                                                                                            303cc29b4d6f2fe3da9d7a38740e7d8e57ffc314

                                                                                            SHA256

                                                                                            dbca8435db95780166fefe1a1ee4cbe5e69a7e049332784025818ba180bbb598

                                                                                            SHA512

                                                                                            25fdb2cefd44b1d7dfde5358008894d8e97ed3b1d31aef90ec427703b692309e827122a286a165ac1fa356630404bd5c21d24158206fafa758c500cb9f058d8b

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            de47c3995ae35661b0c60c1f1d30f0ab

                                                                                            SHA1

                                                                                            6634569b803dc681dc068de3a3794053fa68c0ca

                                                                                            SHA256

                                                                                            4d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7

                                                                                            SHA512

                                                                                            852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            704d4cabea796e63d81497ab24b05379

                                                                                            SHA1

                                                                                            b4d01216a6985559bd4b6d193ed1ec0f93b15ff8

                                                                                            SHA256

                                                                                            3db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26

                                                                                            SHA512

                                                                                            0f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b118a85-5c7b-4345-9f88-395b1ec383dd.tmp

                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            e24489a8c857efe98fa496298b49d39a

                                                                                            SHA1

                                                                                            ed8033cf7ebc4261e3cf2f7e7cc4f3727f0ca875

                                                                                            SHA256

                                                                                            db04e0eb482bc578f250971aea74ef66cdf1ceef0ef6e806991b7d7813304102

                                                                                            SHA512

                                                                                            bccc7c396ab35deb80ad389e8fafddb7ecc9334efbd61e541856ebc338550941a2f9b469aac1afb26c9215dae41330f1e9a8b0f8d744b93ef094dd05e941b680

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                            Filesize

                                                                                            456B

                                                                                            MD5

                                                                                            502e71785e8cf45ebd734a2eaba2ea7a

                                                                                            SHA1

                                                                                            3147ad5d1dcf606eb6531e4165177e7c09d16c38

                                                                                            SHA256

                                                                                            f37b941092341f0e9b362bdcdd91143d31cbe1410f301e8afe7c6996fb5a6d3b

                                                                                            SHA512

                                                                                            2b875fad475917538f83bce55d9c60903d77bf79c87cce88fecfb170dd5df1104d81b1f56c62db20ba14e5c8ea7b1d3ce9b39695874b9952740d7c20a9b9a9fe

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            8e4ef799c37441ca11f173db3ce08980

                                                                                            SHA1

                                                                                            1e26971d9571666bd12fd944469a2b3697a3a87e

                                                                                            SHA256

                                                                                            d68940d48c96155d148f4d90dfde4777ef8e7e932a4d556e186afe238c3f7ee6

                                                                                            SHA512

                                                                                            0c6aee133df4e1ad19fd677540258fbfd96be8de10d4fa8d39f7d22c124a26125cab4209f88887a00dbdf29395f79e73f21daccae98260db00f07a257425968d

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            23703a1212a5f02aa7ff0e7c6780bfc7

                                                                                            SHA1

                                                                                            ee8087429a335303ed0194f5b85888acb9fc4c43

                                                                                            SHA256

                                                                                            3cb2acf73cf3020328423cadcedd88fe2b4f91d33264f396064fc59007099b16

                                                                                            SHA512

                                                                                            e1a45ce1771f44b827cd37bdad50d391dedec24754f3a6db955ae39c58ece41d5fa3da7f746bb9c852a25157597bdf72a01aa423d139a2d23383d45f220dd7f4

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            afcd4f88d123efbb71be9d70b4c15234

                                                                                            SHA1

                                                                                            57bcbe06b18d7e593e7820e36e21e5899a199823

                                                                                            SHA256

                                                                                            428d4b286cabd094198c4b2a05d8093d8667f0dfff5beea43bf80e696eba1638

                                                                                            SHA512

                                                                                            1eabae699e0d79b7b53b0511475b9a46063be955a8a9414a0b302f24f583611155f145e2fc65f2849fdd90e9226c7687006b263e35d95887801affc7e0b3f8ff

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            13KB

                                                                                            MD5

                                                                                            4f828cf8ab670e4ccace2e4e8835ba41

                                                                                            SHA1

                                                                                            85473ac877cf06aa9db0cb6b24bcdc1e4e75371d

                                                                                            SHA256

                                                                                            f01542704e25095deb2e4f1bab2e774f2ed5942456aa394d353f11868ee4d65b

                                                                                            SHA512

                                                                                            9fbb27a05d025c74fd2e4a9ef52f19d85a9591e2cc37529b11acfa5cd115c4db0d0fb7d365116bd8b2704ed1e68262cc787114994fd969f5a2502ba76e93ec99

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            13KB

                                                                                            MD5

                                                                                            0411d6c11eed2d53ed91960688bd1a8b

                                                                                            SHA1

                                                                                            01cee59b1777037c15a609b62fa690753d22ca8b

                                                                                            SHA256

                                                                                            dff4d4947c605a8dfd32eb0c622b7676d5c24f2746b721f2ac9f2118f4f0b851

                                                                                            SHA512

                                                                                            54a4c83509ae453558e12adb5b4565e453bb0a8c3c046b7efc84d22184d7f4986838a154cd9fc6b8f4953fd7c1d7f1522db5cd55a7ceeefc6359e24ef32f9572

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            13KB

                                                                                            MD5

                                                                                            9600e14d3d4db359a7d400f30daa5bf2

                                                                                            SHA1

                                                                                            b24f1c1f6a0d50089784800ea2068c1aac230f53

                                                                                            SHA256

                                                                                            9e32c4bac5a4c7386427ad87926b3ed8e7ea52cbe0468e5ca3f257ead091cf0c

                                                                                            SHA512

                                                                                            47b2d6f09c00e9538fbab4d454a69422bee6345a386d19efce6678a023c04e84f2d1bad645fd3b3090706421d57852281028c8ecf7b6ce9f7d991ed2da130ff5

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            12KB

                                                                                            MD5

                                                                                            3571dda765ab7ab5a2882b59ce644244

                                                                                            SHA1

                                                                                            17816a3e6de68b0c0e3305fc100af105ff280a12

                                                                                            SHA256

                                                                                            8368831a423479e602ddb897b8fd076d9010a5d7b9c15e38ac37d2413a0542ff

                                                                                            SHA512

                                                                                            291ad676cfcff1c77c0f522b7cae33a3c3f1929307ac5429c2da572480c5a09c8999dc9fbb939a3d25a974b2e28e994474e5365e260a563fcf6eb77c9b6e27ba

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            13KB

                                                                                            MD5

                                                                                            dea82a14d3ebd920c1375c6fe1eca95c

                                                                                            SHA1

                                                                                            85be3dc761e42ed17a45871a71c92e86bb7f4900

                                                                                            SHA256

                                                                                            ce9de5d11cc1e9e400184788e9edae07bf30fb832f3f2a2a220c4666fd5c6660

                                                                                            SHA512

                                                                                            6f263195b5eee3ae7b4c6ccaafd517fbdacb26157a23b071e5e0cd4e6e76b501d23243384fff082d675486461c2295465b3139c26211716db4ec497ef71257f0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            3KB

                                                                                            MD5

                                                                                            aa197b4db61527fcfcd6b28bd9ec5645

                                                                                            SHA1

                                                                                            69c1a93dbfcb31a5d7d9ced039591ee47167bad2

                                                                                            SHA256

                                                                                            608510835720fab911f402a8a1289e6fae5f3c6aace28ea27c3371b58c7c1a1c

                                                                                            SHA512

                                                                                            a62bff13ccd483fef5193a9cf212785d497421067671ec5f7d7ec0420c1696ad8a2c2dd8458f493cf1d35ae71065224bf705078f8c5984d16daec5b7e58e7f82

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            3KB

                                                                                            MD5

                                                                                            2c23aafb9247b18ebc466a6247879e7a

                                                                                            SHA1

                                                                                            92543b371d4bafed67c0e3ccf9dc20f7c07457a2

                                                                                            SHA256

                                                                                            f226ac51168d817f683472592fcdbbc8efef3ce86e8081e20a5a033ff55617ad

                                                                                            SHA512

                                                                                            46286ab09cde7f07e88395e06fb87917cb37290e926a52e537eaa32b6bc5197a811051971279ba5625fde31988631f2d73afa01e995e6c4d1a1624cc22648bbb

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a96a.TMP

                                                                                            Filesize

                                                                                            3KB

                                                                                            MD5

                                                                                            c6ade6863a62cc3af8d13f8ee0267247

                                                                                            SHA1

                                                                                            955fb4a9c7fa3e7215b467fe040fdaac4270fe02

                                                                                            SHA256

                                                                                            b6bd9789d40afd80922a39bf0f01f72491f91f1ca14648bc03988ece4a3cb4dc

                                                                                            SHA512

                                                                                            d619f8414dad82f57dd748aa04eb7210082cab345ef950f0292ef86cc91f1508162d91d64f51518978967580811defb78d633ccb4669ed198433fb5be85936c6

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            46295cac801e5d4857d09837238a6394

                                                                                            SHA1

                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                            SHA256

                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                            SHA512

                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            206702161f94c5cd39fadd03f4014d98

                                                                                            SHA1

                                                                                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                            SHA256

                                                                                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                            SHA512

                                                                                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            2f68f67ca1678c09bb64b568fe8f3621

                                                                                            SHA1

                                                                                            fa03df3b4294b501ce462ec15a3e4152497e0732

                                                                                            SHA256

                                                                                            62b260da711e34b959766867e5d480aa181404a814261d2aece2714946fc69b9

                                                                                            SHA512

                                                                                            6ad117efc63326d8fa61fe13217881e2551a9f2a6ec1e625a7d776a90c8d518b65a7f6880952abe9429eeff198ff68fee1248f8e0c940adcaf7466cc2768b8cc

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            12KB

                                                                                            MD5

                                                                                            395d2cf9b3ddeed0bbe6b30a8b3369fc

                                                                                            SHA1

                                                                                            f3e87c6af02aa5b3e7161f5c6504574a7a9d6637

                                                                                            SHA256

                                                                                            cc2d99074017cfaaa55e0abb1da1a3a997218c26296d09e758051b59b28dba3a

                                                                                            SHA512

                                                                                            fd5e288bfa3568d627934f29198b078f59e5235d2e9d49d10655e88ce44ec084f1a52e567feff69de1100fbe8410d43f3035628864a1953d0eb57545f8674ed0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            ed1b77b7f20499287054e0c7ea46c3f6

                                                                                            SHA1

                                                                                            91ff7a18d24069e7aaa2770346c0a158b002b8c4

                                                                                            SHA256

                                                                                            e87fbd605a07bdc04866dcbe5d0d384c6dec486c5105ce370e4cd921cb3086a3

                                                                                            SHA512

                                                                                            86ddc3b06a080843d978be255864fd5868eda8fa85fddebb1f65b32d1bee6ca5f2aa858ed67c46ae6ee45470bb2242770741876a4a61e9475ae76dc13223e714

                                                                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                                                                                            Filesize

                                                                                            10KB

                                                                                            MD5

                                                                                            2cb9e3f89741961748d38d15dfecc8fb

                                                                                            SHA1

                                                                                            11f89dfac73dfacb194fa01bf6e7fddb38c1f6d7

                                                                                            SHA256

                                                                                            e76dcf1390543fde2ae6fd8263e90df10923df9dfe78a5fb588a50654577fd13

                                                                                            SHA512

                                                                                            20557311d13320d2f7c8bfb99e49c8af30dbcbace0faaa5101f9ea893a017a55100bf2b3c466c9d9cfe4fa8a8affcef9223a870abbcf571492fa90abd0e748f2

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                            Filesize

                                                                                            10KB

                                                                                            MD5

                                                                                            0e1bf269017cc7ac2817fb849debbb3e

                                                                                            SHA1

                                                                                            4b0912ae955b3cdd00a9babc4d55d2e64d8092c8

                                                                                            SHA256

                                                                                            f2df08a8d1cec91f16b3780772b18031139c619394bae059fd325a7a15f2827a

                                                                                            SHA512

                                                                                            c7eb9de3a208c4a9944c6671fc94c5654a1cd7bd59c58dd297a579b35ac2fffc093f0eb3c274691f13d9d7c5dea72e091779f43b13f0982053ba654767712cf4

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            07ad20e408f8ebd6b8385b87e3b6a454

                                                                                            SHA1

                                                                                            ab53a26f47ada0ed53ed2ff80ed4c3afeae26ef0

                                                                                            SHA256

                                                                                            6c7aca652e204bf6c9c1a2a6147ab2e7ab3a8c8d301e4681154019507c670adc

                                                                                            SHA512

                                                                                            76ca2a18a7d3af61f8dd66be76152e4513b9337b5eb7ea3a27ec2b2011eee29f42ef17d14e6f2fb7fad4f2111659053bc9aa834e1830c16c6204d813b2318dba