Overview

overview

10

Static

static

1

SoundCloud.exe

windows7-x64

3

SoundCloud.exe

windows10-2004-x64

10

Resubmissions

20-05-2024 17:32

240520-v4snyabc9z 10

Analysis

  • max time kernel
    252s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SoundCloud.exe

  • Size

    182KB

  • MD5

    75c4a5f827b71f386c836a00155b349c

  • SHA1

    20a2552cd785f96049d4b524dd35c9897c3d9b1d

  • SHA256

    964883bdeb50388f7fe56cdadb3b81009ea8c0ad78bb2f832b267b163981acf9

  • SHA512

    add872232df95c4191be4c89b7ea25b64e395521c4d627759905bc34378353f0dffff2440156d58989e53bc0c331e97edb1415ddaba37c1cda92c82b61dd7584

  • SSDEEP

    3072:lbNz9GySF0OhwX5qnJTvT8mgA/8Pc2r+k7hqHrT4AIatAuJ1hLgsp5:JlEyC0KY5gqk8b+ghUEAIabKsp5

Score
10/10
phemedronepersistencespywarestealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6719312271:AAE1QFaFTcG0HSHiQXVv7gdDUMwSNOPMadg/sendMessage?chat_id=-4194654645

Signatures

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\SoundCloud.exe
    "C:\Users\Admin\AppData\Local\Temp\SoundCloud.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3524
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:3308
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4948
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2284
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe80f646f8,0x7ffe80f64708,0x7ffe80f64718
          2⤵
            PID:4884
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
            2⤵
              PID:628
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
              2⤵
                PID:3760
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2360 /prefetch:8
                2⤵
                  PID:4468
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                  2⤵
                    PID:3524
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                    2⤵
                      PID:4976
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
                      2⤵
                        PID:2272
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                        2⤵
                          PID:1124
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
                          2⤵
                            PID:4336
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
                            2⤵
                              PID:1684
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
                              2⤵
                                PID:3708
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
                                2⤵
                                  PID:5012
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                  2⤵
                                    PID:2272
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
                                    2⤵
                                      PID:6076
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
                                      2⤵
                                        PID:5268
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1324 /prefetch:8
                                        2⤵
                                          PID:2532
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5328 /prefetch:8
                                          2⤵
                                          • Modifies registry class
                                          PID:180
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                                          2⤵
                                            PID:744
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
                                            2⤵
                                              PID:2600
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
                                              2⤵
                                                PID:3616
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                                2⤵
                                                  PID:5260
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5160 /prefetch:8
                                                  2⤵
                                                    PID:5264
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:8
                                                    2⤵
                                                      PID:5664
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17213555128623671093,12438194896003697474,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
                                                      2⤵
                                                        PID:5532
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2204
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:1908
                                                        • C:\Windows\system32\osk.exe
                                                          "C:\Windows\system32\osk.exe"
                                                          1⤵
                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:5716
                                                        • C:\Windows\system32\AUDIODG.EXE
                                                          C:\Windows\system32\AUDIODG.EXE 0x508 0x49c
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5848
                                                        • C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe
                                                          "C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe"
                                                          1⤵
                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2440
                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                          1⤵
                                                            PID:400
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Modifies Installed Components in the registry
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:736
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            PID:592
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Modifies Installed Components in the registry
                                                            • Enumerates connected drives
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5712
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            PID:3636
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            PID:4536
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Modifies Installed Components in the registry
                                                            • Enumerates connected drives
                                                            • Modifies registry class
                                                            PID:5540
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:376
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:5288
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:5832
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3928
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:5256
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:5304
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:5512
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3616
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4000
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2796
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:5024
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3360
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:2148
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:736
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4532
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:412
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4556
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:5572
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4280
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3308
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:5136
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4560
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:1016
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:5584
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4640
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1396
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:1488
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:6044

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                    Filesize

                                                                                                                    471B

                                                                                                                    MD5

                                                                                                                    7c8f5eeed84ecc871f84acbcdd5bd0bf

                                                                                                                    SHA1

                                                                                                                    11099f76796efeeedb768334b21c2357aeb729eb

                                                                                                                    SHA256

                                                                                                                    c92449d48523c6a16f9a59e5b825aab6a5973c55c23733045f3738cbf0b0b387

                                                                                                                    SHA512

                                                                                                                    5e0dddcef18267d61031db39bd07b54d26116b15f53078130bb3ad541479eefb349c7cc7ceaca0884999401867fafb716e3180d9fd727920318007488c599218

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                    Filesize

                                                                                                                    412B

                                                                                                                    MD5

                                                                                                                    cddd924c0092fb2da6236c25ace51ad3

                                                                                                                    SHA1

                                                                                                                    cc1d084001157b192242475eb1461eadf4c2f24c

                                                                                                                    SHA256

                                                                                                                    371d96f1b7ee1d79a69c3fa28472b081082e46bb1080fec88e8779d69bdc37b8

                                                                                                                    SHA512

                                                                                                                    61040ba6c94ff1604d1577c0e25c4f382435637d7f8bb5f936f9985a90ea242b45257299e0e268421259243b506b700685f2f7c8d4e0a46b2edf5f0d858ce883

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                    Filesize

                                                                                                                    152B

                                                                                                                    MD5

                                                                                                                    4158365912175436289496136e7912c2

                                                                                                                    SHA1

                                                                                                                    813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

                                                                                                                    SHA256

                                                                                                                    354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

                                                                                                                    SHA512

                                                                                                                    74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                    Filesize

                                                                                                                    152B

                                                                                                                    MD5

                                                                                                                    ce4c898f8fc7601e2fbc252fdadb5115

                                                                                                                    SHA1

                                                                                                                    01bf06badc5da353e539c7c07527d30dccc55a91

                                                                                                                    SHA256

                                                                                                                    bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

                                                                                                                    SHA512

                                                                                                                    80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    4e826158fb1b7579e58209a90b4e8ca4

                                                                                                                    SHA1

                                                                                                                    ee39ae4b7593b9f3a5297a432510e6a2706452d4

                                                                                                                    SHA256

                                                                                                                    719674e477872d7623a7ca584b3293d98eb49a724e1348f1acf6d672cb033734

                                                                                                                    SHA512

                                                                                                                    0628fb9f0a1a201472917158fb5c339c59fc461194ced916944408dc73ec1662829064f0cbc25e4458da3ad8e8fe13fa7b25604b488eb56e3537de4b4b50c38a

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
                                                                                                                    Filesize

                                                                                                                    16B

                                                                                                                    MD5

                                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                                    SHA1

                                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                    SHA256

                                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                    SHA512

                                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    bb1e220f488133037f569f49f63d9a59

                                                                                                                    SHA1

                                                                                                                    ccc1f183a10ee11b862696b04379843307861822

                                                                                                                    SHA256

                                                                                                                    d9d5fc7efb1fe699a9a8edf4c58ce5be9bd8a008e3af0bf18834d1b6c713d8b4

                                                                                                                    SHA512

                                                                                                                    e43930508e2f4793e126016769cd54bcb2f03617a15465058108b24e361db8fce8cb4ab38c28c6c6caaff33abcf93c5d78fe17086ed76fec60d5f7669c0b72c7

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                    Filesize

                                                                                                                    891B

                                                                                                                    MD5

                                                                                                                    47cbcf3e6da2a77a3111efa1426ec38a

                                                                                                                    SHA1

                                                                                                                    37c9e69ae00958dfb1d3ee8675bc683c3b178456

                                                                                                                    SHA256

                                                                                                                    b8de5bc0909dcd3e2f20e25f51ef76ad542b0bae4fa75d959a4867bc3ed7d58d

                                                                                                                    SHA512

                                                                                                                    2e393d15e3a725c383660b3d0c9acfa587967a6374b9c065c9e7a14f44f2355f147ae3fa2a6b266008680b9839b2d86c1e861c31a838d29d7eadd50da84d5ff7

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                    Filesize

                                                                                                                    7KB

                                                                                                                    MD5

                                                                                                                    306c962b5a536b5aee905c2159665f79

                                                                                                                    SHA1

                                                                                                                    1db2092fc47423c944e193ba2a1635422b7c5d00

                                                                                                                    SHA256

                                                                                                                    780ccb6e916700adacff977aeb007368964cb08125ce94497cc24a2bdb633a28

                                                                                                                    SHA512

                                                                                                                    97b5175deda5e948ea438e33847abc5c5a76a57578dc8ec4e07c61b8eacf3744369bf7f261a7c95beb8de609c618cc6283aaa7c04d4fa10666e4d62f42c1b980

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                    Filesize

                                                                                                                    5KB

                                                                                                                    MD5

                                                                                                                    3e9adfbb6012632a9ddada0f79b99d25

                                                                                                                    SHA1

                                                                                                                    7cd8faf67ff5b6bb53bb46876693c2d3363d04b9

                                                                                                                    SHA256

                                                                                                                    a113edcb87682d7aff1cebd486702daf0ff4101915bfe62127101405eda9b237

                                                                                                                    SHA512

                                                                                                                    23fe57c7a90044261808ce6ea6b722820549b412764e60af4dd44577bdc1d7d1441f53f8f0494db4224ba246dd3880d8a83a8c289f583bb0145d6fd69b440be3

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                    Filesize

                                                                                                                    7KB

                                                                                                                    MD5

                                                                                                                    1ecb9417d940c55765266888e21a865c

                                                                                                                    SHA1

                                                                                                                    34c723ec0bbaefceced5fe42caf2ea4748920bf0

                                                                                                                    SHA256

                                                                                                                    b68a82338b440b0e8357db8da07b77ef5b56058f0496f3d8d72399584bb76b49

                                                                                                                    SHA512

                                                                                                                    0ab6764f357c7705096edd6ec9b29049eab137d2ffaee6b5032208c9feab99e5c6ced86c7b07e62a569f456ea1bd7e3fc2e8c9a9d1fb8d8bf0c50003d541e66d

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                    Filesize

                                                                                                                    6KB

                                                                                                                    MD5

                                                                                                                    de1bd09fa1dcbd228857e3d3efdf9ba4

                                                                                                                    SHA1

                                                                                                                    5bc139995cdfc725e8aca98c66437518a3595964

                                                                                                                    SHA256

                                                                                                                    6a2e87beb2f65b6e471d771a49c319503c6cbd3345671f3232b8dc7d579eb7ba

                                                                                                                    SHA512

                                                                                                                    5eaf2eb320d7d2964142fef795fc0945085fac0d5176eca626df1d26e8cde77712eb393aa0c6fd07a4343363463d90258dd037bf1e4c0580fd1524a89cac88cb

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                    Filesize

                                                                                                                    6KB

                                                                                                                    MD5

                                                                                                                    79a362368710f059c0e9b77338e55959

                                                                                                                    SHA1

                                                                                                                    03b77340271659289becb0df097e0f01ca407678

                                                                                                                    SHA256

                                                                                                                    35a0d6e0fc4069ebb189b86166c2a823eae7ec12d057b7e5bcf6f05b355df6b7

                                                                                                                    SHA512

                                                                                                                    0895b1cce3257ca8b3a8255b433acb49f69c9b66f5849e9d32e78ccd15cdcfa86a130fa19696ddda96d777afd5dc30306ef9053e427517b8a26ab7c8ac895922

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    29b6dcf29057fad452e07bf2199b2671

                                                                                                                    SHA1

                                                                                                                    435a4953b9daab0ae83038ec56f25d6c2678360b

                                                                                                                    SHA256

                                                                                                                    e9a11003cf6d2d52ffe9541fb95ae3c92f21ab58bcf20eba24fd69243019cd95

                                                                                                                    SHA512

                                                                                                                    e46d65dc1ba35d75c11cda996fd998195881ac10b24775231c7a64db4b0d9d45358641f4e6efbde9079c9fc772d8dade7c939d168ae5a90b547086c641138f6f

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    d5e1125161e83e407219fa6d294edebd

                                                                                                                    SHA1

                                                                                                                    d0848d3ce6cce59401aa7d9534aa13617f5b138f

                                                                                                                    SHA256

                                                                                                                    7dbea865a9c29ee2cc28da092a931831ae2c06d176761fc80476f12ada4dc8ce

                                                                                                                    SHA512

                                                                                                                    42c8622edcfe819672ce692e4295537000575375cfcd1e4d121b81cc8fcba747f067dba91e2a50015788aa0145403428d29b11ee49cc2b5f18f7c1da5aa9ba29

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a5209.TMP
                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    7a83662bb9af1fcda250c47ccaf35ff1

                                                                                                                    SHA1

                                                                                                                    6e506e7df3a439ad4cf92008e4a9831cd3ac3c4f

                                                                                                                    SHA256

                                                                                                                    a68f8daf41dd91f4d5365e704c809e9bc0cfb87aa695726f0de231cecf653a5b

                                                                                                                    SHA512

                                                                                                                    739e8d9fa0a1d8310a39ed36a79f724affef18f2127f9e457e7893c88f8d2347aafc879cf06d2b8165a82bb9b97a97e25128b2d28533fe4aef3a23c8a49a321b

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                    Filesize

                                                                                                                    16B

                                                                                                                    MD5

                                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                                    SHA1

                                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                    SHA256

                                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                    SHA512

                                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    Filesize

                                                                                                                    12KB

                                                                                                                    MD5

                                                                                                                    753b8208d191446ad77a329709590358

                                                                                                                    SHA1

                                                                                                                    50ab1adb749cc69f9aa17c648d86de25975a0009

                                                                                                                    SHA256

                                                                                                                    1d3f4822960d32ac5650daffa59c0f95c8f9c829ff0c36bcf78f461c756f8ab0

                                                                                                                    SHA512

                                                                                                                    7a3d94e14f6b364548917782ad2eda826fce50e49571a741464ea06a081d34a0c79669a7f151a029a131f973f8369060434eec53135161bd6b84a0017e21d449

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    def2e229f39e8c39f4baeebe92629a48

                                                                                                                    SHA1

                                                                                                                    ed53b9cb3c50d05c7cdc0ceb42a160789fc2557e

                                                                                                                    SHA256

                                                                                                                    1a768d491a4ffbc7d8cf3810b60084b1885a9dd1850cdb282313ad86a45f9370

                                                                                                                    SHA512

                                                                                                                    0bf6ef61b327d6de19c5d7570976623b799de01b5e7e828650d26ba8a997de1cdc87fa691379ba9a53ff9e2b9d8fd8ced40eef5c1ba902991692c197da939cf6

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    Filesize

                                                                                                                    11KB

                                                                                                                    MD5

                                                                                                                    bb1170be74cc1fe00c0a616e93f562f2

                                                                                                                    SHA1

                                                                                                                    611286438e2fbc04e82930a46fbb71b4dc0e486e

                                                                                                                    SHA256

                                                                                                                    be58d3ef73268e233565424a0adbcf49425aec9bbb5d4c116542a46af6e8f3b9

                                                                                                                    SHA512

                                                                                                                    51c9842f6793d39550b69cc4736f46fc67c425dbae36c28f907c661fbf36237ade0fc1e3f78cab1b61791acee6aa7f1c27337c61d20370e215dc5e7bea967c18

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\92G8RFY9\microsoft.windows[1].xml
                                                                                                                    Filesize

                                                                                                                    97B

                                                                                                                    MD5

                                                                                                                    154014c190bcc3ee57ed7e94a2f5d4b9

                                                                                                                    SHA1

                                                                                                                    20848fea26d00af1a18c235031228444530ec9d4

                                                                                                                    SHA256

                                                                                                                    bcd046aa48862e2cc160ed1dc72283cfeeffce82c66d4aae555664ae3043ac53

                                                                                                                    SHA512

                                                                                                                    91c232d6bb42bebe9f998bae5e1a08d9ea0a8ed86ead98ab733fcf8170ecb100f3294ba378ac4b07ed7b8023760a20324145fcd3884d8848334de81a718d8be5

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\Downloads\Unconfirmed 946817.crdownload
                                                                                                                    Filesize

                                                                                                                    11.6MB

                                                                                                                    MD5

                                                                                                                    fda8602bca41e95bec1eb1ce49663f09

                                                                                                                    SHA1

                                                                                                                    1ef9f09b6f6a466882677aed95f49de927432fa5

                                                                                                                    SHA256

                                                                                                                    dbb9e16f0f70ec6e3c758b170b40076fd969767455f6a9b55c0c9178496d8d20

                                                                                                                    SHA512

                                                                                                                    4071f2659dabff72f8c9840360b3db10712da3cb0003184a3e49b4cd9c4a6fae4f5c5967cf78d4b1e31d2be80dbb0c8480e6bfad64d58ff5a0d15cd2c0874684

                                                                                                                    Download Submit

                                                                                                                  • \??\pipe\LOCAL\crashpad_2360_BUUOYZAYNIETWAGM
                                                                                                                    MD5

                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                    SHA1

                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                    SHA256

                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                    SHA512

                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                    Download Submit

                                                                                                                  • memory/412-1154-0x000001B429570000-0x000001B429670000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/412-1159-0x000001B42A4D0000-0x000001B42A4F0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/412-1167-0x000001B42A490000-0x000001B42A4B0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/412-1176-0x000001B42AAA0000-0x000001B42AAC0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/412-1155-0x000001B429570000-0x000001B429670000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/736-1152-0x00000000031C0000-0x00000000031C1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2148-1038-0x000002032E7D0000-0x000002032E7F0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2148-1008-0x000002032EA20000-0x000002032EA40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2148-1039-0x000002032EDE0000-0x000002032EE00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2148-1003-0x000002032D900000-0x000002032DA00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/2440-352-0x00000203E3E60000-0x00000203E3EA6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    280KB

                                                                                                                    Download

                                                                                                                  • memory/2440-351-0x00000203E1FC0000-0x00000203E20F4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.2MB

                                                                                                                    Download

                                                                                                                  • memory/2796-842-0x0000017528100000-0x0000017528200000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/2796-849-0x0000017529220000-0x0000017529240000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2796-866-0x0000017529620000-0x0000017529640000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2796-847-0x0000017529260000-0x0000017529280000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/3308-1429-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/3524-2-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    112KB

                                                                                                                    Download

                                                                                                                  • memory/3524-4-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/3524-5-0x0000000005600000-0x0000000005692000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    584KB

                                                                                                                    Download

                                                                                                                  • memory/3524-6-0x0000000074EB0000-0x0000000075660000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                    Download

                                                                                                                  • memory/3524-7-0x0000000005B50000-0x0000000005BB6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    408KB

                                                                                                                    Download

                                                                                                                  • memory/3524-9-0x0000000074EB0000-0x0000000075660000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    7.7MB

                                                                                                                    Download

                                                                                                                  • memory/3616-841-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4044-1-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4044-0-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4044-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4280-1313-0x000001C555BD0000-0x000001C555BF0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4280-1302-0x000001C555800000-0x000001C555820000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4280-1304-0x000001C5557C0000-0x000001C5557E0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4280-1297-0x000001C554700000-0x000001C554800000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4280-1298-0x000001C554700000-0x000001C554800000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4536-403-0x0000016B5CE00000-0x0000016B5CE20000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4536-421-0x0000016B5CBC0000-0x0000016B5CBE0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4536-400-0x0000016B5BB00000-0x0000016B5BC00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4536-434-0x0000016B5D1D0000-0x0000016B5D1F0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4536-398-0x0000016B5BB00000-0x0000016B5BC00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4536-399-0x0000016B5BB00000-0x0000016B5BC00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4556-1295-0x00000000034D0000-0x00000000034D1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4560-1431-0x00000258BE740000-0x00000258BE840000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4948-16-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-22-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-19-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-10-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-11-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-12-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-17-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-18-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-21-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4948-20-0x0000027FAB940000-0x0000027FAB941000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/5024-1001-0x0000000004520000-0x0000000004521000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/5256-710-0x000002A3F14C0000-0x000002A3F14E0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/5256-707-0x000002A3F1500000-0x000002A3F1520000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/5256-723-0x000002A3F1AE0000-0x000002A3F1B00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/5256-702-0x000002A3F0600000-0x000002A3F0700000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/5288-576-0x000001EC903E0000-0x000001EC90400000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/5288-585-0x000001EC90F00000-0x000001EC90F20000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/5288-555-0x000001EC90720000-0x000001EC90740000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/5288-549-0x000001EC8FA00000-0x000001EC8FB00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/5540-547-0x00000000043E0000-0x00000000043E1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/5712-396-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/5832-701-0x00000000044C0000-0x00000000044C1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download