hxxps://ify[.]ac/1Ic5

Resubmissions

14/07/2024, 14:46

240714-r5ksyaxbqh 8

14/07/2024, 14:43

240714-r3y8jsvckq 8

14/07/2024, 14:37

240714-rznmmswhra 7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ify.ac/1Ic5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3268	setup_mEH7ebFdwZ.tmp
2300	cd2mp3converter32.exe

Loads dropped DLL 1 IoCs

pid	Process
3268	setup_mEH7ebFdwZ.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 25 IoCs

pid	pid_target	Process	procid_target
2820	2300	WerFault.exe	121
1688	2300	WerFault.exe	121
2360	2300	WerFault.exe	121
3256	2300	WerFault.exe	121
2980	2300	WerFault.exe	121
2124	2300	WerFault.exe	121
3304	2300	WerFault.exe	121
5048	2300	WerFault.exe	121
1516	2300	WerFault.exe	121
1384	2300	WerFault.exe	121
4108	2300	WerFault.exe	121
4952	2300	WerFault.exe	121
4008	2300	WerFault.exe	121
3136	2300	WerFault.exe	121
3996	2300	WerFault.exe	121
3472	2300	WerFault.exe	121
1476	2300	WerFault.exe	121
3688	2300	WerFault.exe	121
1520	2300	WerFault.exe	121
4016	2300	WerFault.exe	121
1792	2300	WerFault.exe	121
4020	2300	WerFault.exe	121
5116	2300	WerFault.exe	121
1528	2300	WerFault.exe	121
4180	2300	WerFault.exe	121

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
4060	msedge.exe
4060	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
2880	msedge.exe
2880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
3268	setup_mEH7ebFdwZ.tmp
3268	setup_mEH7ebFdwZ.tmp
2300	cd2mp3converter32.exe
2300	cd2mp3converter32.exe
2300	cd2mp3converter32.exe
2300	cd2mp3converter32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
3268	setup_mEH7ebFdwZ.tmp
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4168	4060	msedge.exe	83
PID 4060 wrote to memory of 4168	4060	msedge.exe	83
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 2788	4060	msedge.exe	84
PID 4060 wrote to memory of 436	4060	msedge.exe	85
PID 4060 wrote to memory of 436	4060	msedge.exe	85
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86
PID 4060 wrote to memory of 2736	4060	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ify.ac/1Ic5
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaed8a46f8,0x7ffaed8a4708,0x7ffaed8a4718
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11726321321333308803,2717622453269578193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2660

C:\Users\Admin\Desktop\setup_mEH7ebFdwZ.exe
"C:\Users\Admin\Desktop\setup_mEH7ebFdwZ.exe"
1⤵
PID:3672
- C:\Users\Admin\AppData\Local\Temp\is-QI40U.tmp\setup_mEH7ebFdwZ.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QI40U.tmp\setup_mEH7ebFdwZ.tmp" /SL5="$E0276,5849669,56832,C:\Users\Admin\Desktop\setup_mEH7ebFdwZ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:3268
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "cd_2_mp3-converter_7142"
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\CD To MP3 Converter\cd2mp3converter32.exe
    "C:\Users\Admin\AppData\Local\CD To MP3 Converter\cd2mp3converter32.exe" 1759819519bc7de99fe09eb3d8ba567e
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 884
      4⤵
      Program crash
      PID:2820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 892
      4⤵
      Program crash
      PID:1688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 956
      4⤵
      Program crash
      PID:2360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1080
      4⤵
      Program crash
      PID:3256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1120
      4⤵
      Program crash
      PID:2980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1120
      4⤵
      Program crash
      PID:2124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1104
      4⤵
      Program crash
      PID:3304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1168
      4⤵
      Program crash
      PID:5048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1116
      4⤵
      Program crash
      PID:1516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 996
      4⤵
      Program crash
      PID:1384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1328
      4⤵
      Program crash
      PID:4108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1504
      4⤵
      Program crash
      PID:4952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1724
      4⤵
      Program crash
      PID:4008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 908
      4⤵
      Program crash
      PID:3136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1732
      4⤵
      Program crash
      PID:3996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1944
      4⤵
      Program crash
      PID:3472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 2100
      4⤵
      Program crash
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/bboobies
      4⤵
      PID:2568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffaed8a46f8,0x7ffaed8a4708,0x7ffaed8a4718
        5⤵
        
        PID:3220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1836
      4⤵
      Program crash
      PID:3688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 2148
      4⤵
      Program crash
      PID:1520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1828
      4⤵
      Program crash
      PID:4016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1868
      4⤵
      Program crash
      PID:1792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1888
      4⤵
      Program crash
      PID:4020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1784
      4⤵
      Program crash
      PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1916
      4⤵
      Program crash
      PID:1528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 2032
      4⤵
      Program crash
      PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2300 -ip 2300
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2300 -ip 2300
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2300 -ip 2300
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2300 -ip 2300
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2300 -ip 2300
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2300 -ip 2300
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2300 -ip 2300
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2300 -ip 2300
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2300 -ip 2300
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2300 -ip 2300
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2300 -ip 2300
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2300 -ip 2300
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2300 -ip 2300
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2300 -ip 2300
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2300 -ip 2300
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2300 -ip 2300
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2300 -ip 2300
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2300 -ip 2300
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2300 -ip 2300
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2300 -ip 2300
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2300 -ip 2300
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2300 -ip 2300
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2300 -ip 2300
1⤵
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2300 -ip 2300
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2300 -ip 2300
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CD To MP3 Converter\cd2mp3converter32.exe

Filesize
4.9MB

MD5
0fe58677998932ece058f23fdf28dae7

SHA1
6d0f9640026143a5d128eb021361ca163ce5c3f3

SHA256
6071e75c7cce7ec1900d93ff08a1e3103bc5f42a72e7dc04fe8cb055d2b71cb1

SHA512
5bed3f6678a54ab1933f24c45eac6c00187f4dc65553d5e04614a448c1c35631057037029d712db2aac2c2b280e96cc491a5e4afd9512311aceb9df0e110b831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
389c52f0bf367691a57c433d6d500bd0

SHA1
3d5acd869cd6fdf156fac5d94f74194d5045c039

SHA256
e21e95ecda15bbe75e087eb79ace925b2edcf1c2b46335f2371acf638398f6d8

SHA512
11afea56688eb5dd86f3843edea4a6384323c762469a51f6fdf5860dfab4a7fd87bd95e07caf27eab8c5c4a11057cf66d7399fbca9f864576944446d89e80020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a673c51faceedcad610a3209e2d29953

SHA1
c5dcfabf0559fdfa3b3f8784d4e3444391d565a6

SHA256
c213d1532549466679dc89323b7af97be30246f813e87c4b270cf88b1a8fa9ad

SHA512
e91ca4d3e08115bda17c2167ff1796f9bf1cc02040df7abb7e79db9d737b41bce435216352c084564f1a066658ed358ac45271c7788c0f3685e4776b61d6b245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
e4b24b348efd126500ed92509362771a

SHA1
2d14abd974dd981b22ab63410b61b35fc0eb14ce

SHA256
e08a5c737679ec833bf347a5baaf32e4ea4abb60ffea64635a83c51bbf411871

SHA512
55d44b2ded9f265c9a285b882e6a1635a97ee3cf18aff9dc02e16142d45c4222cae3fe10bedd204e2617d3c38b32f76d581ef38b45d7a5f32a015132bfaea7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9599ff3d7a6e515333dd12ad1e588489

SHA1
46272416e33ac9239070f8cf95721d257a5f77f9

SHA256
f94a601ae0e4da1dfb5a1b317d8fa187ed3a36c9064254000d33afd764e4c4c1

SHA512
606d4686625810b2871b91bfdb8e05f73b1ca3d1b50f3c5e7ec4544c6ff045478225333077279d08c557f3e0277a930539d1c18e69245f0bae6d28ad5920be91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
239d1c9e5e64e63059841c69489a19d4

SHA1
f3190217a015d9715e1a6c4afab0a8fd5d6a0760

SHA256
2051a66920e81d03e07bc7b2188d882c76312932e1923d140004ff1647eba0a6

SHA512
2ecc7edfb8bb8d3ef1f44863374ae0cadeffdf0be0c0ada6bf891a1823b010955a70ea095e185682e1839fa9f237330539bbb181fdcddd9d926c91f4c92f3aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8572c2e558f9ea6d6823d2eaa75265c0

SHA1
760b8666470ea81cdbb3aafa31bd001a7514520f

SHA256
a9029dfb3b18cb64307f85b3a65f4ead9031834d925cf5b9321647140ed01903

SHA512
413b4b5cb0b26a5192f964b6de81deee44336d4841b56abc43c3b52930e4e59690ac4a7b3cdccebde1ce38baca14c37ad7b213c208cba5a6cb03f2385a2606bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c4348e3e4bb08fa16672893c6ec3f5c7

SHA1
5dcfa70d76d6c7d20cf7c3bbf6862113293ca39e

SHA256
3cb797ad2cb5d6e397b99b5617fa352398cad2c4eebe94bcac793ae049c0bc8d

SHA512
9f33f1bcc979e2d6e7cc6d0a665f62beb911e31e4c9a9712edb60966ce2d4c2b2b4aab392298ecfbbf3ec5b5a9fb064a33349371acee20c16431b5c429f1d8c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3a7a15ddd679eb989cdccb1db546573a

SHA1
93a030ded21724ba79ed3e789486da425e7ecf74

SHA256
a54692489915799e96305df6ed10a0110e8c40dc0b39d06c877e39f77d94c8ea

SHA512
83183dc142079158179b703e0a165174b0f0926e63cbc1858c91b5a5a04ac55fe5e8b8b069b5df5da0c1c72f8cbe7438321373ddc9d56e2040acaa8a7cc37855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
373603f470068173fc4793af88449dca

SHA1
f77fe506add20a4545efee1bc725bfcee7212ab9

SHA256
08e6db43215fc09ac90973b1dd912d5bc4a8023874317a2b48a5545d0db0f3a3

SHA512
3b4946896d528dcb06a1b51452fded756dae1b681018afe6a963dbb397f34e10fb0a3207363f5be569621d61c69d5f21f0b14628dcd61c0ae9aad5f23c04ee11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65b8356f80eb4794d8482f2fa24b6e3f

SHA1
35de7dc337a5984138a4f3554510b0d8ef6644b2

SHA256
368b613b2ba7414906156dbef387e1eb64a24792637b8f28f250e9b6066eb43a

SHA512
93e6c3f056e34748e8d90b83a7b51ba42a151236722a00fcc5bee0343d3e410c5d03ac058c79b80be80d1f1e2381567e567f7e09eb90fdfb49a15df123769b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e399e668beb3dcfe0d16b9d99cfff01b

SHA1
91dcac5c497a809e6bec63c194d79ff8513ef3bf

SHA256
8dfc8630872473236be12d3ab41e3f7c635df0d58375b9bb6a5769a570e8c80c

SHA512
ca170946dc1e6da8041db78f4dd689119c2d78c0754f614bca6ed7d664a53147a1135c98a951709f78d8c4752b9eeec3278ca4bbc3163acc025b9f8e5cc24e7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d7e9bc912191782635cf8082c228ff00

SHA1
a05c055f283479734c9742ea8b1ee7388a4b7b11

SHA256
fdbfd7a631f159e2b6a35a01a40ad230b594d0d6d86f4cc9380464732a29a6c6

SHA512
e47acf9a5dc0232c5acb15b534b7edd1ac48834cf0e877971e0fc87794aa4ee8871e1cf60434601eeda8bb37a0c9a239616f8881021f19604bf7685049430b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e31c.TMP

Filesize
48B

MD5
d0f2bb3a393bf223119ede412c2d9fa0

SHA1
b8c328349db8bdc80271c2ffac1d72e347b47a99

SHA256
5e62e3363ef3cad7bfeb18bdb3bd6177b1bb55dcf84c3e65ea6b78009a606643

SHA512
9d9e63b69a12121753977d1b3352998ca2f2f0119ecfa5e5165df71cf1a2a3d5b1b8b05f67e3b11e24522b85d22cc362a1c78df3c0cd8d8ccf60364002df07b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b63a361f23d19e674de91d893ce0408d

SHA1
f0bb543eb4e5dc046ae63915259e690cae4df211

SHA256
e30bdf1281793f90623fe1270c822ce8c81571f040066a57ab60d6edd343a6bf

SHA512
bc5034417bb88dea0fec0690e25e806c0cb9adbc6abd97cf3efb3e96ffe2f0ae519bb46a281b454c79ee1116efe88794fd35489f97d40e026e550f03f7f482b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fe0c926011702e764c00b3856cc6ea4d

SHA1
1c414b7d914f1281178b1ca953e8941764185954

SHA256
764ffb3565e559ac2d275086c5097e3251f62dff729b90d2dfcb5675ae9a856f

SHA512
de897cfa716cae25fc2130d94a63f62bee6f57719befa79e2658a17e15702a1e127a7fc23423a0efd57d8a02cd02a2652ed9cc712ea1c44c8852928b3e2956b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff8e.TMP

Filesize
540B

MD5
c2b13bcfd38930421bba3187385dc68d

SHA1
707f8278b4fca253fdfdefa3141743a23e4bb07e

SHA256
623ee18b5d7455b3259697357a5290abae03fa8087555ee520fa5f9a1cfadf2b

SHA512
676093c66d185837c6af582aa3441dd1ef2c4cc95cbf6c99964db8e6ce9f8052b4afeb53d5b63975b831fc8bd8ad719940d75febb0fd23d76eaad1b1bee2670d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
59b97f31ccbe4ce96f88d1d279689e9a

SHA1
e648ff5e8aa3c820040a253e51eee8281b99b2cf

SHA256
c968958171b4ea4142b384439b7f4179cabd2daa3ae01b00af6556f1417401b6

SHA512
f3c6fcb5e50b6d0646eb73e74548f75470ee1324798643714433308b99f4ac461cde822c31d7731df61d678c82c254619091ba71b9dfc1b8876f31afeb3015f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
af71538da011a0ad4860342ea5032808

SHA1
1425d1f81b5f58b24404a3710cb1a32236f054c1

SHA256
4422e12415e130259b999fbb8ac3bacc665b1ccf27aad1adb908c280a57dbde3

SHA512
1e63c9324ce489434fda23a7b629052f222dd21084c48846cfd7d5f3d9fab0b602f669c8a1e266897095a260af655026023d7fad7e6e69bd7d577253648c3a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N6S84.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QI40U.tmp\setup_mEH7ebFdwZ.tmp

Filesize
694KB

MD5
e1c26c323dd52cd731320cafc0d2bd89

SHA1
6d4b246cf638917954050b0b54af8912fc8458a2

SHA256
2b59a5d1e0719242d3049602b0be47f55460f256991b35c130bc2ad7563d435b

SHA512
b61122c6c73c03af13bf016d3ef98ef51f2e26f99285cb6cb6d23bb24288b5978275bbf8d5d0620e1e79dda0dc1a852599de79dfb1f0a79b960083118a311943

Download Submit
C:\Users\Admin\Downloads\setup_mEH7ebFdwZ.zip

Filesize
5.8MB

MD5
7df8c70f29690a24559f0e1129c172f4

SHA1
3e5f90a4f543c2ed3f6f6dc2dbbf63bce57876fd

SHA256
3c80016889913bb4727280d8deb7287b50837a2aff6815dfc7aef4c4e0831fce

SHA512
3b19a37e3627b97172239092a48c055f6ca1a0cc6b401546083dc1a0a2b9e4aae4f49ec46a141fa70871d3c24b7ef229730cc08fd1847c190f3436006f63ae2f

Download Submit
memory/2300-436-0x0000000000400000-0x0000000000CDC000-memory.dmp

Filesize
8.9MB

Download
memory/2300-437-0x0000000000400000-0x0000000000CDC000-memory.dmp

Filesize
8.9MB

Download
memory/3672-367-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download