Analysis

  • max time kernel
    340s
  • max time network
    338s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-06-2024 17:18

General

  • Target

    https://www.kaspersky.ru/downloads/free-virus-removal-tool

Malware Config

Signatures

  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kaspersky.ru/downloads/free-virus-removal-tool
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9e363cb8,0x7ffe9e363cc8,0x7ffe9e363cd8
      2⤵
        PID:4288
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        2⤵
          PID:1068
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2028
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
          2⤵
            PID:4944
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
            2⤵
              PID:1368
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
              2⤵
                PID:4812
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
                2⤵
                  PID:2960
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
                  2⤵
                    PID:1108
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
                    2⤵
                      PID:3348
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4000 /prefetch:8
                      2⤵
                        PID:2788
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5668 /prefetch:8
                        2⤵
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2620
                      • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4004
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2304
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                        2⤵
                          PID:4776
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
                          2⤵
                            PID:3620
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                            2⤵
                              PID:2824
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6668 /prefetch:8
                              2⤵
                                PID:244
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
                                2⤵
                                  PID:4068
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                  2⤵
                                    PID:4888
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
                                    2⤵
                                      PID:4200
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
                                      2⤵
                                        PID:4992
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                                        2⤵
                                          PID:2652
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7252 /prefetch:8
                                          2⤵
                                          • NTFS ADS
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1464
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,3597482355945467014,14304233838829123549,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6272 /prefetch:2
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4076
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:1960
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:4004
                                          • C:\Windows\System32\rundll32.exe
                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                            1⤵
                                              PID:1260
                                            • C:\Users\Admin\Downloads\KVRT.exe
                                              "C:\Users\Admin\Downloads\KVRT.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Checks for VirtualBox DLLs, possible anti-VM trick
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4040
                                              • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\49e70d0f.exe
                                                C:/Users/Admin/AppData/Local/Temp/{1493dd12-d486-4ba5-82c8-80a1195a365c}/\49e70d0f.exe
                                                2⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • Checks for any installed AV software in registry
                                                • Enumerates connected drives
                                                • Writes to the Master Boot Record (MBR)
                                                • Checks for VirtualBox DLLs, possible anti-VM trick
                                                • Suspicious behavior: AddClipboardFormatListener
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious behavior: LoadsDriver
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4936

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\KVRT2020_Data\Legal notices\legal_notices.txt

                                              Filesize

                                              160KB

                                              MD5

                                              2689909dad3f105937cc03917ce6a8b2

                                              SHA1

                                              0e3c2f27db9fc53f205bae4268091db2dd30623f

                                              SHA256

                                              15fff20108b100ce81e6b3de6a11535b9f0a18d80067a62555cf62e6954c1b6f

                                              SHA512

                                              0be32a0ac0ff64f0e7a9a0f362d3af7c701cc3f32ab78ccad12babf1da542723162a95a241688558c553f66ee56c57c6bfc1a96e27fdd8324c26fc23d94405f6

                                            • C:\KVRT2020_Data\Reports\report_2024.06.11_17.20.24.klr.enc1

                                              Filesize

                                              450B

                                              MD5

                                              5ddd872b313ff923f4244968c08602ef

                                              SHA1

                                              3abf3ddd173226e7775265a0a23d0bd2c2d85042

                                              SHA256

                                              e03e336876e6e1e41a6e20c135d1a8eccb49967bd8d6f67776491bd1b11f4af5

                                              SHA512

                                              919f04c6041e0b344fed1ca13acaea7c4e01ce31166c1a752f9749de801e487adb118685d408788dbcb7b8f77d6aff36ba5a4a8b94aecaa0d7605465b9f85324

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              1e4ed4a50489e7fc6c3ce17686a7cd94

                                              SHA1

                                              eac4e98e46efc880605a23a632e68e2c778613e7

                                              SHA256

                                              fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a

                                              SHA512

                                              5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              8ff8bdd04a2da5ef5d4b6a687da23156

                                              SHA1

                                              247873c114f3cc780c3adb0f844fc0bb2b440b6d

                                              SHA256

                                              09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae

                                              SHA512

                                              5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              9a0fa4b2c49e2d5a06c327754b21fcec

                                              SHA1

                                              7279eca262dd4154bc5c7314137b3bc0c07efbb1

                                              SHA256

                                              e79167d26c2465224ec8bc83f1dcfbb74be6c7a823acf469520a50641ea34e78

                                              SHA512

                                              1be7cab4dad10312244afccb8cef39d692f512fa2b9188b9a7d87f074ec0045a4852050470dbe651e173261baea76356dc0620e15cdc8b3244543ce0968ea42e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              fd0528726a4a3da0723155c5228b4997

                                              SHA1

                                              d9ea0907f693265666f6a81b28633b0d9fe678be

                                              SHA256

                                              485c5a648b9dce46190f3bb5affb73cd55a15a6fd2a10c3a7024c6aab4bc62bc

                                              SHA512

                                              76133d3e4e8025c1eeb88b5cca942c659cb61cfc4ad980176cd42aa5f7de83b1694ced2c4199a5a36764611b0ddf660c79af2702bf5edb35be0114ae06f3c179

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              3KB

                                              MD5

                                              2fed5d0d99d4c05825e3cb04d1048ef8

                                              SHA1

                                              6e598665146f155aa5abce800aa6ce253cc13483

                                              SHA256

                                              57e5ce686cb9cb97d95335aec260f020ab9e0bffaea376cea37278f910195d10

                                              SHA512

                                              c3d5d0f1ab8da1b59bcbcfbab91688f857b9a5342dcc51ed8d23ffd3b98c0f37746aba84faf550eac66040e7b1c512e82485a2287d14736770ba799c01f5c73b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              19cabdcdbe67dd0d82a609caf07c5f0d

                                              SHA1

                                              995d43ebe8c315e6c07f83ca931ebab705494e40

                                              SHA256

                                              318f402cd5eda9110fa8f4c7250bb0dbddb576b486612d44dc576e642e6f2cf3

                                              SHA512

                                              3c2d63b4b88e2276e74db4ed2fa97b17e6a22c8aa69df40c30b9087d0aac08d5361798f28d7d9f15f1cf7f1b78c5748d39e32a4e459596529507d8cf21ec5d93

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              8KB

                                              MD5

                                              b6bc0b0eec3145223ef9a2bbcc1241fa

                                              SHA1

                                              82bdd5225d79d2c5f7a60cc62b3847f1aff7840a

                                              SHA256

                                              9d4cdf04e64b1fc15306d168ee1a14378ecd491548d7d563c78b504c2a422c7a

                                              SHA512

                                              ebeb97f6de092bb1720a6fd3f3285a1a623c27eb3916dffae740ab2e5df04e13a54cb891c46af501b497f14bc6b37cd92c5afece3b7c9277e959d7f887677a73

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              f4562d8dffb2afa76eb5f375fc7ad1ad

                                              SHA1

                                              f912823234ce2413f9150a8c17cdd133fa89fa29

                                              SHA256

                                              ae7898a1faf5ad653b8e2998ddc86f400d9acbd95c14197dc1f12b3e6f1075e3

                                              SHA512

                                              73cf69eda53b814124587006b5676653f70f12ce983f6c8e2d6f9804935940d344527fd5f33d0c045c809ecb3a1df55836ef25eb90cc1e2f718077abea5213c8

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              33515eaf2559b3d01aacd2a5e64c363c

                                              SHA1

                                              ded68e66206678dd8e59cfea40aae0cb31cda13d

                                              SHA256

                                              81cefae007abda220a93cb765c2dd3dc1b8b2f6acb1a151e87bbe25cdb69fef4

                                              SHA512

                                              8eb5230ff562bee50413fbdfbb7abb509144e9da66b4d967a776a975d70531e4310682a7a7ce2c1b58dd40a461e46c89a09efd61fbe4c964d79f6cea4eaa8735

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              5e3b7c1a10842272553d6e8bcd5c8694

                                              SHA1

                                              11ed51b38e0c09f1043d2850919424d51274644f

                                              SHA256

                                              824c32a3888be980ada303a69b96cd618fc85425e1157379835cc3aed07fb1a6

                                              SHA512

                                              7c5da58f52ade18a8dd1da82b7fcba696e9b0c82007b241d6d1db9f27767f3b8b8d4edeaa7456e5bc0c5f3c32682d8af30638a2aa3c99866dce985b40588c518

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a9dc.TMP

                                              Filesize

                                              2KB

                                              MD5

                                              949309f75632c5296db1862ff7c283d5

                                              SHA1

                                              3553e749ea105718dfae2e10f2d5cbb05d12f65d

                                              SHA256

                                              49184908db44737d1a6f3544a830ea23e9f468abd3e4cf086586b10e734c3f0a

                                              SHA512

                                              d744b6e162512d2695c1df9184ee4caae65522084c8d92c27cfe74e012fb1ec402f2e13763c10a5c5d79519c0f85c09cd40486f30adcbd88f20008978d6a01be

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              206702161f94c5cd39fadd03f4014d98

                                              SHA1

                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                              SHA256

                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                              SHA512

                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

                                              Filesize

                                              41B

                                              MD5

                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                              SHA1

                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                              SHA256

                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                              SHA512

                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              1004e46a491a46f4035bf306cd77dfc4

                                              SHA1

                                              1112008d3aa85c1659df13615cb52807adc0c861

                                              SHA256

                                              8f7fafdb61be324b0f3e33113474621674541c48adf29bb8c3e7a7afbb750a14

                                              SHA512

                                              0d2adbae9acecdca95641ba7b5ba177e414272c770b9a45f6cc4019f0a6de5863af1e9acf38fbe9db5fdf59c1182844ecc2015aa680796a919d67e404953d7ee

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              ea9f2dd406be34cafd1b539c69e4a1f4

                                              SHA1

                                              7b96b4ab2783a8fd8924ccbfedd445fb1e2afd0b

                                              SHA256

                                              0563c9165bf944b289f62a20e37a0d6b026a94734cb318befbca2bbb7eb6d2b6

                                              SHA512

                                              663c63d06990995c6d003df022c6699fee56f8538ba634e8ce3f04497c334fd7487af4a29dce0351bb5d150993154d5e50e3ecae9ba80fd23bb5a1412e8b7f8d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              c81b777275bd6d1028e24cda057fb523

                                              SHA1

                                              01abc609cf69d6b42467363c194e0d5aae33afb2

                                              SHA256

                                              db48723d5c565c8383958138a2ffaf13a04c5da34e2a31eadd2c90706b08bf16

                                              SHA512

                                              7e12524602133f22e53786fe0dd5f29eaa10c5c2629f6e2810b6e1b74f6e15827116647bb821e256ed328f1e6e86910f76c1dd0ba0174a6b0202b1042514ddd7

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              eb788f66cbf01e2f0acf3e6a03db017f

                                              SHA1

                                              267eff9e061dd44084354757d31c8558a7390c56

                                              SHA256

                                              f3f12289b67ab03c44ab054eec6169275f893406c9a0d300ce4e584e97fe784a

                                              SHA512

                                              e773346c278386200ebc491b40f7f6a167df2f37c6cbc00b7a684ef0e4a59c7922e6206655ceb9f82667ff99a3f8767c78d6b2f9ae515252a788814eff27c31d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              9410c3f7d64c5613b53de5f5e21c38bb

                                              SHA1

                                              4f350c69c188d3ed572ed95d2e8b1a1ab2531889

                                              SHA256

                                              61ce516bc57f165bf01825024bc4833fb96e280542e1b2ef422b4a437cdfd3de

                                              SHA512

                                              f3a982c164d52fd5c056793fb9f783342b0b86587376fac18e1f0434b8881bc854e212eba232913f38682aaafb6e2afde459f81c9c3393165cffc279b9972768

                                            • C:\Users\Admin\AppData\Local\Temp\etmp2DBF8EC1-2A58-524B-BC61-2D01C91AD167

                                              Filesize

                                              92B

                                              MD5

                                              7662a879f5ea52c1089465e46752a514

                                              SHA1

                                              31697e48276d1b5fac0a13b478487d123efd3f1e

                                              SHA256

                                              1f7dfc2753cb87b3c02685b6e85e8ddc608e2bc8a0ba9f2dc7a9d9becb470e76

                                              SHA512

                                              95207d66c4d28a3bdeeddd35b367f5f36e3e6324070f010a9b634897a1635ed63d1f1b5f6a2971533c1b7de3578b17864ad430d4d3f5986741b3fc071ce99d0a

                                            • C:\Users\Admin\AppData\Local\Temp\etmp36C21B44-2AC1-F144-A8A4-5D2140210791

                                              Filesize

                                              7B

                                              MD5

                                              85cbb2a3300c5969e28a59d571e18709

                                              SHA1

                                              1c241ba19926bec8702a19dca831c5311d3d7e26

                                              SHA256

                                              cb6cedb24f57007074f89b72d27f0badbfa3517d3cf0eab94de9c757a8ef4d86

                                              SHA512

                                              7303ef7afe2cb4eda8a3e3d175fc12462e67cf505c87c8cf40dccd03f9447df1b9169d03de7baf5180f91572c2477f5bb2617a750b7e79be823039e89241fd14

                                            • C:\Users\Admin\AppData\Local\Temp\etmp9A635814-18A1-2F48-AE17-2165C58B605B

                                              Filesize

                                              118B

                                              MD5

                                              58711fdd032d847473d881cd0c1950f2

                                              SHA1

                                              57694e3a9efccc2771c839f53d9dbd12aac82fa7

                                              SHA256

                                              e381975c4ef147187c577a20cc0df577d9f6a35c9f8fdbd53598a2ace04090d3

                                              SHA512

                                              a0345b86fca6e96f94387f5d5faed454f1ee5f9a8f88ae6fda8a35c5ad9e6cbbe3bbcda21df8aa78fddd8295b81a396dabea336a344fbfb7dbb2456cbe5337ae

                                            • C:\Users\Admin\AppData\Local\Temp\etmpDE74578F-12E4-B141-9564-98C026593C50

                                              Filesize

                                              69B

                                              MD5

                                              66cb576f0b97f33bb82f910f2c609820

                                              SHA1

                                              934b7c659f257deda4a4b239d507fa33e49ec515

                                              SHA256

                                              41d6305f3ddbde3e0cc9225f86c5f24d004a0c39f7553de5404779da6f45c891

                                              SHA512

                                              15160d48cdf47cf509c3e7332076119b74fbbf5d9b28671f1d29c5c80a2685bda89078edfe603fde9101f515ab9f7178a96d2b3c71362114adf20b154f8d667d

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\Cache\arkmon.kdl.ffa97045d8465e2172bb1d40a8621d1e_0

                                              Filesize

                                              448KB

                                              MD5

                                              ffa97045d8465e2172bb1d40a8621d1e

                                              SHA1

                                              2805422d402810eb5c44d3c522e763eac8e944b2

                                              SHA256

                                              a23155cddf6a696f403d6299edcbbc77a029a35c7fa65fb0ccdcd4d5bd2c93a0

                                              SHA512

                                              dbe1d9afe191c2cbea9d5e0b434f908bb802cefd7937a2054565bb28b6defb43bfb6ad76310535832eae5e3187bd19f6d92c38f21a97bb35e1f29d9d8f35f162

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\Cache\avengine.dll.52c5f0ba7444d13378e2102a58232671_0

                                              Filesize

                                              946KB

                                              MD5

                                              52c5f0ba7444d13378e2102a58232671

                                              SHA1

                                              f484829da9c5e3a44cc5e0ffcc7d7550f6549dba

                                              SHA256

                                              de3b4f0d7a3d26785943a777166ef7f9ffa866ecc6f4170b6970af4e296671e7

                                              SHA512

                                              daf7c7dcafb6e1cbfd3d79fd9401f90934a8d5ff8a09b619fcc14c6619cec2cc10e40d808605430386c7b6565140165c4ea0660e5f253a8feec4729c6a2b1bf6

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\Cache\kavbase.kdl.7baf07601ea55caf34b35bec5751de63_0

                                              Filesize

                                              799KB

                                              MD5

                                              7baf07601ea55caf34b35bec5751de63

                                              SHA1

                                              aec49556ba3d8bb11e04687fa6722360d4753bb2

                                              SHA256

                                              b26e39c787e00a46c3813f017ed90ad641c13b5232e9e27e43f99c9bdcb75645

                                              SHA512

                                              cc1083d92887f56599bc3b3efba358fba4d35852f62079327347b6698af7e3ffa367b6693c8d8a2adf45517f2037658d265da64413953fa10830b20891aa9c94

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\Cache\kavsys.kdl.761f656789cb55eedc099ba3cd372121_0

                                              Filesize

                                              935KB

                                              MD5

                                              761f656789cb55eedc099ba3cd372121

                                              SHA1

                                              1498e8b3e8ae171002a0d92f66877adaeb6f19df

                                              SHA256

                                              0ad762cc4c8548fb7c8ca6e97a8d1c5078acb2ab3d4622d00fe28bc8cf893095

                                              SHA512

                                              9b3004efa350d45eeae4c7e42209e1da6d7800f1a823ed734fc82a6f592adb75659cd712a72db69cda3e2d9c352b9e9e8eaf87d1d309a61bab1cc2b1a6f13d3e

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\Cache\mark.kdl.68d9adb364007366de31df216e06bef3_0

                                              Filesize

                                              420KB

                                              MD5

                                              68d9adb364007366de31df216e06bef3

                                              SHA1

                                              5a1b5face27868c07021b9b4af48be81f12b31c9

                                              SHA256

                                              6692e9e3e029ec4f48b752cfb197d4e9b7f0d8faeb0f6ce51a962885cdd99fd0

                                              SHA512

                                              0629960df306e2d2ffb6c1d8760456b306e15da9a0a3682e912ff4b816a517428d0871e812682072b1cf388695440acae40ba3f5804b92d825304a1fa18b613a

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\Cache\qscan.kdl.ccf5fd3fdf62d187e66af0757868e5d2_0

                                              Filesize

                                              1.4MB

                                              MD5

                                              ccf5fd3fdf62d187e66af0757868e5d2

                                              SHA1

                                              ee9dcb9e130505bfb654627c6064fd7792ddb95f

                                              SHA256

                                              1076d20f9d7823b1888fa0564bc1224a9ee66ce6ee4c632d1bfcc4feb458d998

                                              SHA512

                                              2aba637da52e249628ea63d6083221ba36d0e211bf7e8bce2d1eca0155cb73bb0c058cfe5a6e0c658bae463debcacf07de08afc3ee91a01f7335c9e55c3cb73d

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\Cache\sys_critical_obj.dll.802c20a8239d0082e57135d00bb9b003_0

                                              Filesize

                                              725KB

                                              MD5

                                              802c20a8239d0082e57135d00bb9b003

                                              SHA1

                                              9721cf68faf500fac464283cfa86e7b3306b509e

                                              SHA256

                                              d66ffdecef0c81c7cbdb2408b65084d0ed78e04e69ae862fab7990fc2f834c75

                                              SHA512

                                              b1fcde7e942aceaad1bf84655c3633e47d22cc515db2a61ba4d80f8aff2240257095c08af766440cebaa2cadfde3762de313e8e33421b31d9c3eb9e94029db46

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Bases\arkmon64.drv

                                              Filesize

                                              377KB

                                              MD5

                                              fd710c439f89ca6b7d8caf3ee6f307d0

                                              SHA1

                                              5273c87564d9fcbf99b846195ea8bd3102d65a76

                                              SHA256

                                              ca317c531bdd3a23d401a242a904e8eb81401c79073eee470b6e1078f3645faa

                                              SHA512

                                              3df58ac276362fb7d7999bc8e902f22e9ee1501ee2e4f653e58595d411752e18bf7ee0cbc95766ecb8da34a5ebd3a11fd5bbf5450b1c01fd3ed8ee0e22183b09

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\KVRT.exe

                                              Filesize

                                              2.6MB

                                              MD5

                                              37226eb4f1c7a0b79275c1401f83cc6d

                                              SHA1

                                              71ed962d1e0d212869d92c23d6e20a4e1e7ad430

                                              SHA256

                                              be00dba953a6f26990e020bdc4e3f13e5799a3ff60384768ee6c1af37c656a4d

                                              SHA512

                                              afea618c795406a49d159e1359e76168dc6b6dee07234666d21ee21bb5011fe9af57a3425e76126f2595e3d180cf2121db5d02258d7aca77b3c4d8621a8aa15d

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\KvrtGui.dll

                                              Filesize

                                              2.2MB

                                              MD5

                                              38717f028f7df6e29996dabe26375956

                                              SHA1

                                              328c0ed49e079999ad0cc7c1315375b77531c8c9

                                              SHA256

                                              9db65ebeaf888b6cc99c06d0f063e48932feb27f25b5350d9d870e9ce40d1e10

                                              SHA512

                                              4c6de66d71527c1c0e8d666e85dde671ca6b2705e5e4584487be265f25c6369f5512c0601d251192c56ad44bec538161bded7fcfcd3a578cddf76d7617af237d

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Qt5Core.dll

                                              Filesize

                                              4.6MB

                                              MD5

                                              02b21d6184ec835fba23088e7c7368e4

                                              SHA1

                                              2386e5cd242ad6abfadecc2d8ba416125f0bde56

                                              SHA256

                                              5967b2240167500cfbb602408833776fb9be95ee404ad2bbdbdde18c752aaefe

                                              SHA512

                                              e8b15e68c61f1a0f78fa4f4821a636e07ab3a87699fc45ace096d080d7bda62534af7acf93b9a32d730b0403b52dc1eac8df9175ae02d5f6f829c7849e340eb9

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Qt5Gui.dll

                                              Filesize

                                              4.8MB

                                              MD5

                                              8fd0c7b86b4988b234614944edb565a7

                                              SHA1

                                              120015375d66f6e3f1c889cbada3efc4f8ff7f5b

                                              SHA256

                                              449a105683a27ebce39f2a7a0fb413cbe2eb2df8c2c8f51870a40e9eb9708a7a

                                              SHA512

                                              3e92401ee9ed0dd51fe95f963378caa73fe07bae0186406b9689519d6b75926b5027339ea52c8643c92c21b621ddc05056a1338f0114a6902c2897406cf371f7

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\Qt5Widgets.dll

                                              Filesize

                                              4.4MB

                                              MD5

                                              8751f0205fc7a87b46afae8ceda42d90

                                              SHA1

                                              d7e41a64c09f580d9e63ff5ffc8ac37d1f7da4c1

                                              SHA256

                                              7273600d11889adba9287e6d5a3b684a9d902d1b4db8cedec21562fa00c436cd

                                              SHA512

                                              18466c4c4b6dd07445862d8e6a84825b8b0edeaa95dc8fe58741527d5dd20cbfc7672825108acec69bae506b41fb01fc6413401759db3d8265503fea88ed9bba

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\crls\c7e6bd7fe0e4965892ad706f0d2f42e88789b8041daf5b3eea9ca41785297798

                                              Filesize

                                              368B

                                              MD5

                                              4b03934418970c06f092afe3d2155bf1

                                              SHA1

                                              56a0e9666c3ee0071d70b9d2b364666fbb93068c

                                              SHA256

                                              c3a63c68ae58f008e5eb52c8e515fe6f5f978e3a8e33ff3c4c4ec43b186486c6

                                              SHA512

                                              7846f929ec6d68397c60155202365bbbae28c5faf053c67469b378bd059ac7fd8575ee4973d905e51471cabeadcf3251d229057fdba70eb5df478ab4eafb39f8

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\dbghelp.dll

                                              Filesize

                                              1.2MB

                                              MD5

                                              4003e34416ebd25e4c115d49dc15e1a7

                                              SHA1

                                              faf95ec65cde5bd833ce610bb8523363310ec4ad

                                              SHA256

                                              c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

                                              SHA512

                                              88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\dumpwriter.dll

                                              Filesize

                                              409KB

                                              MD5

                                              f56387639f201429fb31796b03251a92

                                              SHA1

                                              23df943598a5e92615c42fc82e66387a73b960ff

                                              SHA256

                                              e7eefcf569d98a5fb14a459d949756dc00faf32ed6bda1233d9d2c79ca11531c

                                              SHA512

                                              7bfce579b601408262c0edd342cb2cb1ef1353b6b73dce5aad540eb77f56d1184f71c56ea859bc4373aac4875b8861e2cc5d9c49518e6c40d0b2350a7ab26c0e

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\klmd.sys

                                              Filesize

                                              368KB

                                              MD5

                                              990442d764ff1262c0b7be1e3088b6d3

                                              SHA1

                                              0b161374074ef2acc101ed23204da00a0acaa86e

                                              SHA256

                                              6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

                                              SHA512

                                              af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\msvcp140.dll

                                              Filesize

                                              439KB

                                              MD5

                                              5ff1fca37c466d6723ec67be93b51442

                                              SHA1

                                              34cc4e158092083b13d67d6d2bc9e57b798a303b

                                              SHA256

                                              5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

                                              SHA512

                                              4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qgif.dll

                                              Filesize

                                              45KB

                                              MD5

                                              213734f42848f6cfb91b5d0f80a352dc

                                              SHA1

                                              72060bb18421eba12591e923929bc70b200b26fa

                                              SHA256

                                              ed3a7867931a8c05d267a62522223ca78bd435d45af6dfde116e7eb72c2fde7c

                                              SHA512

                                              913afbd6e950f61d038f81ff7f0f08986469ee11cd7202cc0598d9caa7a4200e9e8e5e23f0c5062e01a6ef908e92a52f35dcf60f1af77a075200e8db466df807

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qicns.dll

                                              Filesize

                                              54KB

                                              MD5

                                              4d1fcfe0e08da0bfd61ad27863f05a8f

                                              SHA1

                                              51a9c2d12181b66f3f9fd9137a699a715df8d2fd

                                              SHA256

                                              b95d07323612b27e04a716a3894e46a723a457e8c0be37ee838573eaee1624ab

                                              SHA512

                                              2251f8c7bdfa0ad6cda6d619f6df1cef76e8f317119ec4b495d0d98351e77e5f7c678f49f9c8c6eefadfee175304d00757689ff35f8c77693b2ea3435dac2aa9

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qico.dll

                                              Filesize

                                              46KB

                                              MD5

                                              f463183ff33be64d8a61fc5d61b16064

                                              SHA1

                                              5a2d6a62d293e8335d787c1e4681cca7e953b20a

                                              SHA256

                                              e4773864ec821c90ff7b2b6a081c4abd7b9fb10829b7e067521b0b18d4e75422

                                              SHA512

                                              6576842034440b4329a6cc99e419913316e2bb869e20053238add0adf23eb9e35e32ec758c93dddc8162c64049690db177791c11ed7fbdd2ef4780c6be0dbf2c

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qjpeg.dll

                                              Filesize

                                              258KB

                                              MD5

                                              03e1249b16b47fd240283f44636f6087

                                              SHA1

                                              e0a02adeee91ff330891ed93428956f1fb90ef44

                                              SHA256

                                              f1b0528f0b43b798b78580363f19bb75e68347755ef84bbf313cbb1c9fa649b2

                                              SHA512

                                              287a13ebcddb151cd37ec60b47c6f674730d1886ee53d4a864e62d23aca084d9b3a4e0b8eefc07b8e1aee2e40a6b7327602aa547f1afc63dc4b254abe14749f1

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qtga.dll

                                              Filesize

                                              40KB

                                              MD5

                                              82a65b1ce5a7041da64290b66a6a1c8c

                                              SHA1

                                              577e7174b02182ada17328cbac3ac1d3605fc023

                                              SHA256

                                              6da0850ed1f6d93e1d99cecc31153e8993b7b20d68308c248c71e9af4c061336

                                              SHA512

                                              bbc0fd32e8bdcac4d7f5fac77d9a4386be671b9d6c18d14ac6807e521a0f5192af91e106e0a3258653afbba625c09f79542f1fd7a1eaf97d9b5b98cbd2bb1084

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qtiff.dll

                                              Filesize

                                              342KB

                                              MD5

                                              058a1449a4656fe891bc589ea61434b1

                                              SHA1

                                              8803afd1bb77e4804925610e6a94361a1e26c4d5

                                              SHA256

                                              fc271f33b879c7966564d04f698b7fd77d806e61107574d1240502e7c7666f26

                                              SHA512

                                              91f43f8062095044ba41fea9fd4df490711f131437ee90a0354a629a7677c9c7fce84b1c1165e07a2b8c4e58beb1d66d953c1034923c986a2288553221761ca9

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qwbmp.dll

                                              Filesize

                                              39KB

                                              MD5

                                              43bc7f0b0b91676368db78d61e83edd3

                                              SHA1

                                              628228c8c477f2e6e8d6f2f9dd8cc72b894d5fe6

                                              SHA256

                                              fe95bdae47201a7788c2cb18042c7eafa0041fb6ce6b2ea7e7d5ffd656086583

                                              SHA512

                                              11e847fe59e28bdbf7448846b88578f5b0a1d6b1d7c11a80271d833ad540991d83cc1b89c2b5bfaf9b5dfa68dae538233575fac3b6f1cd5f09398b400b421872

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\imageformats\qwebp.dll

                                              Filesize

                                              412KB

                                              MD5

                                              a23c6a3494e296a521a08dd2d676eb3c

                                              SHA1

                                              260ccb3b2f454bda853d003e3b71fb0789858873

                                              SHA256

                                              e58be278a435f44bf10e13d81fba5349d0f5ea224701c91f992276bcea173856

                                              SHA512

                                              a99eea4b72d20e34c37e0c7971f6e467b2421ff99f059c46f76d961093eea27d031edbd907ed2a99bc9ddaea9ec5b0980871b4a018284c3c324e59c00491b11f

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\plugins\platforms\qwindows.dll

                                              Filesize

                                              1.1MB

                                              MD5

                                              869b64be13907d16f8108d4e46eb1ae4

                                              SHA1

                                              abf528676719f69a4d2f85147dc683d1c9bb606a

                                              SHA256

                                              93debc8c092905993932b16f165e0b959639920d0af6156a64b9c947784fbe73

                                              SHA512

                                              cbd294354d5f84103b7c2f31cca6ee7f390c7852266478fb790cdd2448b1a563ddc6fcf7e351b4b28c3f5e23a52a442064ed75409f076752d0d94f133c9d7e96

                                            • C:\Users\Admin\AppData\Local\Temp\{1493dd12-d486-4ba5-82c8-80a1195a365c}\vcruntime140.dll

                                              Filesize

                                              78KB

                                              MD5

                                              a37ee36b536409056a86f50e67777dd7

                                              SHA1

                                              1cafa159292aa736fc595fc04e16325b27cd6750

                                              SHA256

                                              8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

                                              SHA512

                                              3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

                                            • C:\Users\Admin\AppData\Local\Temp\{7ad03a33-0598-4978-a936-424b3ba91949}\994d5369-33b7-4a78-9fc7-d8cd79eac999.cmd

                                              Filesize

                                              695B

                                              MD5

                                              6b3538766a7c15bccc6673262f957740

                                              SHA1

                                              21b9ecd4e5595c8dd717c126d09aad5f6ce41705

                                              SHA256

                                              f6dc6dfaa707c30d471769e770cda52b8fc067363b1cf8393553eda6b0f88db6

                                              SHA512

                                              07ebfba71e48aa1411120230168e2a5bfbb1bba0f5f69707644cb0d32f276d092ac6f70577c07105e35f542127c3f93b6235fdefd141123d397282c6b26e0567

                                            • C:\Users\Admin\Downloads\KVRT.exe:Zone.Identifier

                                              Filesize

                                              26B

                                              MD5

                                              fbccf14d504b7b2dbcb5a5bda75bd93b

                                              SHA1

                                              d59fc84cdd5217c6cf74785703655f78da6b582b

                                              SHA256

                                              eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                              SHA512

                                              aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                            • C:\Windows\System32\drivers\klupd_8789c6eda_klark.sys

                                              Filesize

                                              350KB

                                              MD5

                                              5ea5aa37289ae16948dc771223f94160

                                              SHA1

                                              640392a0d01521cb0e4485d5641f74e64e1f38aa

                                              SHA256

                                              4b1fd5753737f72f2b8cb0fb299c6c0e3857df69dc19931351d9784f52f307b3

                                              SHA512

                                              2721db2afd55f6abbe54b5865cb41f72216a52cddb6d07721cf0bd1b76fe58b47540467ce9b503ab56e4c614765c18f559b17d73479a4f5a0fae8f6093772455

                                            • C:\Windows\System32\drivers\klupd_8789c6eda_klbg.sys

                                              Filesize

                                              179KB

                                              MD5

                                              ed6cd641a02baf78ecbe069e0b18b3b0

                                              SHA1

                                              cc4d47d1d0fcd3deb841f58923ac309f3be42081

                                              SHA256

                                              66e7b89188e292d0abce941fcb2469e515e2a1bdbe07ad9868a34feb5f47005d

                                              SHA512

                                              cb945fa49683b92841a7a915c73eb11b00fbceee8715a166d256cab0971dc4b4d8b2c7ad3c96e4efb73a7ea9c43ef6bfc9ff3acaffdc08df40b00048ea903abb

                                            • C:\Windows\System32\drivers\klupd_8789c6eda_mark.sys

                                              Filesize

                                              259KB

                                              MD5

                                              124a94969ce6660453ccd66e40ecdbb0

                                              SHA1

                                              46f7ad59b93bc1b78f76fc973ce728c7951352aa

                                              SHA256

                                              5938747dbf6aea335fdf9131fc912452cee781dff8be61750a9b2ef384b5f835

                                              SHA512

                                              3b25bc9eead7f09350c81bca4eb1a11c5332b128918802385d15fb35d017bf2a5eef64966c3e6bb74d4450d794327a1a81c0521dda8b742fda17c0bcc50079e0

                                            • \??\pipe\LOCAL\crashpad_4128_YHCJOGSMQPUSOGKT

                                              MD5

                                              d41d8cd98f00b204e9800998ecf8427e

                                              SHA1

                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                              SHA256

                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                              SHA512

                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                            • memory/4936-568-0x000000000F5B0000-0x000000000F5C1000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-598-0x0000000014EB0000-0x0000000014EDD000-memory.dmp

                                              Filesize

                                              180KB

                                            • memory/4936-567-0x0000000013BA0000-0x0000000013FED000-memory.dmp

                                              Filesize

                                              4.3MB

                                            • memory/4936-573-0x0000000014330000-0x0000000014528000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/4936-576-0x00000000141B0000-0x00000000141C3000-memory.dmp

                                              Filesize

                                              76KB

                                            • memory/4936-575-0x0000000011E20000-0x0000000011E31000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-574-0x0000000013FF0000-0x0000000014198000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/4936-579-0x00000000142E0000-0x0000000014326000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/4936-578-0x00000000142B0000-0x00000000142C3000-memory.dmp

                                              Filesize

                                              76KB

                                            • memory/4936-581-0x0000000014950000-0x0000000014965000-memory.dmp

                                              Filesize

                                              84KB

                                            • memory/4936-582-0x0000000014980000-0x00000000149C0000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/4936-580-0x00000000145A0000-0x000000001493D000-memory.dmp

                                              Filesize

                                              3.6MB

                                            • memory/4936-577-0x00000000141F0000-0x0000000014293000-memory.dmp

                                              Filesize

                                              652KB

                                            • memory/4936-584-0x00000000149F0000-0x0000000014A2B000-memory.dmp

                                              Filesize

                                              236KB

                                            • memory/4936-583-0x0000000014B90000-0x0000000014C5E000-memory.dmp

                                              Filesize

                                              824KB

                                            • memory/4936-587-0x0000000014C60000-0x0000000014CC2000-memory.dmp

                                              Filesize

                                              392KB

                                            • memory/4936-592-0x0000000014D60000-0x0000000014DCF000-memory.dmp

                                              Filesize

                                              444KB

                                            • memory/4936-591-0x0000000014B60000-0x0000000014B79000-memory.dmp

                                              Filesize

                                              100KB

                                            • memory/4936-590-0x0000000014B10000-0x0000000014B41000-memory.dmp

                                              Filesize

                                              196KB

                                            • memory/4936-589-0x0000000014AE0000-0x0000000014AFD000-memory.dmp

                                              Filesize

                                              116KB

                                            • memory/4936-588-0x0000000014AB0000-0x0000000014AC1000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-586-0x0000000014F90000-0x00000000150EB000-memory.dmp

                                              Filesize

                                              1.4MB

                                            • memory/4936-585-0x0000000014A40000-0x0000000014A60000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/4936-599-0x0000000014EE0000-0x0000000014F02000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/4936-606-0x00000000151A0000-0x00000000151AF000-memory.dmp

                                              Filesize

                                              60KB

                                            • memory/4936-605-0x0000000015170000-0x0000000015185000-memory.dmp

                                              Filesize

                                              84KB

                                            • memory/4936-604-0x0000000015150000-0x0000000015151000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4936-603-0x0000000015130000-0x0000000015133000-memory.dmp

                                              Filesize

                                              12KB

                                            • memory/4936-602-0x00000000150F0000-0x000000001511A000-memory.dmp

                                              Filesize

                                              168KB

                                            • memory/4936-601-0x0000000014F50000-0x0000000014F71000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4936-600-0x0000000014F20000-0x0000000014F33000-memory.dmp

                                              Filesize

                                              76KB

                                            • memory/4936-569-0x0000000011CA0000-0x0000000011CC1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4936-597-0x0000000014E20000-0x0000000014E34000-memory.dmp

                                              Filesize

                                              80KB

                                            • memory/4936-596-0x0000000014D40000-0x0000000014D51000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-595-0x0000000015420000-0x0000000015579000-memory.dmp

                                              Filesize

                                              1.3MB

                                            • memory/4936-594-0x0000000014E60000-0x0000000014EB0000-memory.dmp

                                              Filesize

                                              320KB

                                            • memory/4936-593-0x0000000014CE0000-0x0000000014D03000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/4936-610-0x0000000015250000-0x0000000015251000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4936-609-0x0000000015230000-0x0000000015231000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4936-608-0x0000000015210000-0x0000000015218000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/4936-607-0x0000000015300000-0x00000000153DF000-memory.dmp

                                              Filesize

                                              892KB

                                            • memory/4936-616-0x0000000015400000-0x0000000015402000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/4936-615-0x00000000153E0000-0x00000000153E3000-memory.dmp

                                              Filesize

                                              12KB

                                            • memory/4936-614-0x00000000152E0000-0x00000000152E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4936-613-0x00000000152C0000-0x00000000152C1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4936-612-0x00000000152A0000-0x00000000152A1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4936-611-0x0000000015780000-0x0000000015865000-memory.dmp

                                              Filesize

                                              916KB

                                            • memory/4936-570-0x0000000011CD0000-0x0000000011CE1000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-571-0x0000000011CF0000-0x0000000011D07000-memory.dmp

                                              Filesize

                                              92KB

                                            • memory/4936-572-0x0000000011D20000-0x0000000011D44000-memory.dmp

                                              Filesize

                                              144KB

                                            • memory/4936-565-0x000000000F260000-0x000000000F31C000-memory.dmp

                                              Filesize

                                              752KB

                                            • memory/4936-566-0x000000000F330000-0x000000000F349000-memory.dmp

                                              Filesize

                                              100KB

                                            • memory/4936-561-0x000000000F000000-0x000000000F15B000-memory.dmp

                                              Filesize

                                              1.4MB

                                            • memory/4936-562-0x000000000F210000-0x000000000F258000-memory.dmp

                                              Filesize

                                              288KB

                                            • memory/4936-563-0x000000000F190000-0x000000000F1A4000-memory.dmp

                                              Filesize

                                              80KB

                                            • memory/4936-564-0x000000000F1C0000-0x000000000F1E6000-memory.dmp

                                              Filesize

                                              152KB

                                            • memory/4936-555-0x000000000E4B0000-0x000000000E4C6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4936-556-0x000000000EAA0000-0x000000000EAB6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4936-557-0x000000000EAD0000-0x000000000EAE1000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-558-0x000000000EB00000-0x000000000EB11000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-559-0x000000000EB30000-0x000000000EB41000-memory.dmp

                                              Filesize

                                              68KB

                                            • memory/4936-560-0x000000000EB60000-0x000000000EB72000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4936-554-0x000000000E480000-0x000000000E492000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4936-553-0x000000000E450000-0x000000000E461000-memory.dmp

                                              Filesize

                                              68KB