49453b589ffcc62183134e9f90bce44115773a0eec093b0d0b2c5494ee4ed8b9

Resubmissions

02/08/2024, 14:36

240802-ryvdssxgqm 8

Analysis

max time kernel
1002s
max time network
1009s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spoofers/Unbranded.rar
Size

13.8MB
MD5

bfaca3571cef482d77b0a4fb6ab61ed7
SHA1

a56617335195dbf3bf1ec5ec6dd486160577fa7c
SHA256

cc3a76b189133d4c45ab1d302c1086612bc418b059b07baa8f36dbc207c031da
SHA512

5a082ba2dbcbb942ada3c1dbd6a0f865e1bbefeb5416a9fede122bba9239189cfe8fc1d17d135e32dc0ec522580ac4216894626e78adf968d5477632ac0acd87
SSDEEP

196608:x0d+soh3b5YAPXHMyi4QRD4Ksy0EIRk8T5GcOYCJL8k40RTksGDDLCeC6xS7MuYA:eboh3b5/f44Q+yC4zhvvTlGe6xStYBq

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
4172	winrar-x64-701.exe
4500	winrar-x64-701.exe
928	winrar-x64-701.exe
1844	winrar-x64-701.exe
1920	winrar-x64-701.exe
2848	winrar-x64-701.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 0c0001008421de39050000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e00718000000000000000000000e4c006bb93d2754f8a90cb05b6477eee0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{5FB867E5-53C7-4D42-8332-36E19D7ADEF4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "4"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 634073.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1932	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1944	explorer.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
4208	msedge.exe
4208	msedge.exe
2468	msedge.exe
2468	msedge.exe
2728	identity_helper.exe
2728	identity_helper.exe
1744	msedge.exe
1744	msedge.exe
452	msedge.exe
452	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1932	NOTEPAD.EXE
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe
1640	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1932	1640	OpenWith.exe	88
PID 1640 wrote to memory of 1932	1640	OpenWith.exe	88
PID 3196 wrote to memory of 3548	3196	chrome.exe	94
PID 3196 wrote to memory of 3548	3196	chrome.exe	94
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 1484	3196	chrome.exe	95
PID 3196 wrote to memory of 4664	3196	chrome.exe	96
PID 3196 wrote to memory of 4664	3196	chrome.exe	96
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97
PID 3196 wrote to memory of 4044	3196	chrome.exe	97

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Spoofers\Unbranded.rar
1⤵
- Modifies registry class
PID:2372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Spoofers\Unbranded.rar
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:1932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9fd3cc40,0x7ffa9fd3cc4c,0x7ffa9fd3cc58
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2188,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3336,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4764,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4904,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4844,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4560,i,2269854625819635505,12780520192301558166,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:3088
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff701b04698,0x7ff701b046a4,0x7ff701b046b0
    3⤵
    - Drops file in Program Files directory
    PID:812

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab6c746f8,0x7ffab6c74708,0x7ffab6c74718
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4012
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4580
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5412604938855145966,12427460243459337652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e3ce5f31794f4f9699060391b821641e /t 696 /p 4500
1⤵
PID:4300

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:1944

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\db534b52fd4c4bb4b59dde874bccabaf /t 4432 /p 4172
1⤵
PID:652

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\2d545d1bc01740f780ce1571e44c2692 /t 4172 /p 1920
1⤵
PID:4500

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
36b0e029e4d68c47d11a66334354a627

SHA1
1b0186db8ad1611b389b75a6a76fda1f580bb8e9

SHA256
ff6187eab5279387b0ecb7c0bd1b164b74a748de69a9f6d011515158dbc4487f

SHA512
0a134caa6e4604e90ca7001c115a91fa4670a4033938f896dce076775dc0f756d0e160a3eefff775cf41b5df1737a16e51d1b51210e853d096510d599c7e765e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
63aa64ab1c326d1e1fa2954fe4a23e10

SHA1
62b5703428e3e467ade2fd58c561b10489937a90

SHA256
2ec21bc00d7a4d5c516da06d569609d6c6980e3207fcf9cda417a6ad91f0911c

SHA512
ef4cc48e6b02490dcad70ac9b85d17e7af8c130be94736b0c30e48f203286b48588edb5e3024d14417540f6b2fec6a807eadc7b5ec7fd909ebfabb64d21300d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9a48652c48a36566e9d873dcb4647fd3

SHA1
d4ec6287ddbeba4e927c46090b5f141bc4b22c8c

SHA256
a7daacff0f6ec5a4db86dd39d06804c7fb9ba05744a52570a549049d8a10c466

SHA512
54007e3e15d9dd1c053256b99807d2e07295f430ff797a82cc45b5f7e92723f2732ea67608a14253fec26b7a1ac3fac5399237101149f63c0fd9337cf6b9229c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f0b9f4fcb747c5da10c9b79716b9838b

SHA1
406de3cc7995d3c0b50b42165a2d2db11c665b4e

SHA256
6afdb087370147fb8bfe208f86f91ae3c892b4972895379b1ccca463f3d43b38

SHA512
dfbb6f506d915a0728419fcbc4ed1fce1479ac6b71adb96c17f8a4526ec970740c3e0813c2446bddc09de9bce50e841afc58baef1d8e64d8b97ccd6e5930caef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b0199063d170fcb1c70401f3e499a88e

SHA1
df66a022ac3a875a1d54dee771443f6e80f8ec03

SHA256
a8efc0f718f683eb9050e82a7249d94f81efdc6b2ca4115680e3e6a11c08400f

SHA512
574f726a4e4377fc01f90a463d607eccc6057f8f33e3e8668d8092cb47ef04011103df309b6510a1393fe1cfe805166f1aaf448c36875eb1063259af25a97dae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
caab036dff27397f0043445d21d69b9e

SHA1
7087a24b9d89706dda6d5f415d802df811c18559

SHA256
e07394f1b10c63eb042c135a561e170d303db9bb37d8cad94a6651690179859f

SHA512
e43d3a4de9a468d7a339b7e0490605377d41669df02782901035819290d1e79989383f549f6cbd96d1ea193f24fa66ab034cc51edf7d61ae3174d51c6217d964

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3b2677dd61dd388c56ef5d358ee84e01

SHA1
8878325eb60b7bc0af3fbbe74d95791e874cdc41

SHA256
8fda42955118c3bcbb6ca05ed39df1027b11057b1dcb092550c7aab44c24370e

SHA512
c76a0b37a70bf099240faedd030e5759b3fc6f03615b30ecff989ac8e57ff5ac1f1c59074c9cb7227eb2c89b3423510e933d80164fa446eab5320d6ca30b61c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
b1ef4a115a8b3c7249679d8ac91d6a8c

SHA1
930ebfb1e7825d1b399eb53ed2a70f4f403384e9

SHA256
a74a8264acbf2e68e1efd8b7b1aa466f8746a55a706864fbc009a89046c9e9af

SHA512
5d45f93a56b8a33e177f62a1f61aa52f8fb8fa76e3c4b3b7050b99c27bf6248de510d03a751035ba3a8eb0691c078e0bd0529bf5f3a9e1f91d6e3d790c3120a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2919eda9f11f6ce024f6aa3eb0af551a

SHA1
95181776a0f8f5004652a3d0062d49660fa36ab7

SHA256
895da15fa113041ecb7158e0fbec30926030f7b0dcb791cd415cb02d78bb6c5a

SHA512
bda49a3566aa9b0c538d802d606f85aac3c370ce7d0d0786a1fe8210892202fef28a1359ba87a1b4f4f9eecf8d45be6a5dc342e0dcebdefaccacc487f89d109c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
f5c4b641026af0f9c84f54e55d34dbc1

SHA1
d4a4f912fdf242d0d7acb184176fced8cf90448e

SHA256
51eb1be82c1fd034112b5a0bb4fe6f400a6797489af20e93b87778711cb24bf9

SHA512
f266eec58f174e921e3a848bccb178e1484faf47f85fdb9db4de0b3300cc5f74a35ad17cb1b36896e9c5d31c8823dd74a836f0da0e74479f57b3e7b5a17d4f7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
965734db000e61430b5f10ecf9fecf66

SHA1
3a7217b31c1ffb78064b150529367e926d891a28

SHA256
df9a2f9b76c5c3b30fd6219fce12abcd626d4e7fe9266aa2df1725461dd4e5c5

SHA512
da1ed0cfe507f9ffed6c28d1b8552d3a20a08a7a45d1cab8df04bd5050f6832dafcc86a879b9e3b14d1d1243d305c54d7dde058ede0c24f8123fe7c6fc80b990

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
e24ab139edd47042a961a6440d3df603

SHA1
a867ff858482955cec1d841abc04ecc7c1c926b0

SHA256
9579ae23dd9760e428a2666e61d4d6b61cdcd773a9c8dcb9443252ffbac6ee53

SHA512
8b195fe7aa713d547be0b32f09e6f3242bb7622f579a4bedec923000b0f19cb158c98fb1d1541f82d4e724149a74101df58528d6e993d3727c2451d2650082bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a28cc3cd4d1608b15e997415ddefad17

SHA1
b6f993de5a0fe6001b3fc12a19a67d0fd09131d9

SHA256
c00961afbc25a3291f775a7bb1f576e0db4be7900f55582cd0c638f33bcef5db

SHA512
5e9e67998faad80e2b4fe1a371af6621ddb43dd8407606e66d6908ae8ae5e60b7cb38fd649596392d0d7bb72e29bf60520e1c168aebcb207a6f5aa6daa03d2de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c5129e8202b00bc6974042c679b991ae

SHA1
2c16a9a538f0d666e295d3858abf8a4611be2bc8

SHA256
e9d546807c2ea3ac72a22bcbe5a1dd731fccc6e698e5a98331a5873326ebed70

SHA512
49574448459a59c15a0ac349423baa6d2f1f249f13b0329721b0ab4487e47cfc48a490d7efdaf4cae001edf1d1a3a3f8872a3a892d2f2d570acd1fb2979be3a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a4d1eb0e1b6e2176626f7ed0113f165a

SHA1
b3d1c718b14921c84df49ef8c341de594afe5f6a

SHA256
97aeafb479c5d6f23c2dd1a16b4d6fda5b73a09a4630b6eff2166bd29f70aeae

SHA512
621467505ab811c0a348d6db5b1dc2cf31462610a7ce9d391b9beec19ae1457869a88236c55366b957117e6b7b33e7fb44144c2cd6bb8bc0bca4687660560357

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
821a620ae7d756e40ef99122b8fef182

SHA1
b3883de81650f09eba65cf0835d62c3c428d00d0

SHA256
8ad5abc7b68ad781653c89fa079ffb38b4106b20f4e677133b4a295316244833

SHA512
8de5fc77e87de6658280d9d5a430a1d89495977085c98ab096b8e32fb85a251e91e70f44ed4be523a32906e0b60b8d844680314ffabab594b1652b89bdaf8266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
07293b88b6f0630f473f8969176c73c5

SHA1
8e8b4ae7f2a57dbbf1cf2331cbd7ba8d0db1f0a7

SHA256
97a8879962bbbeca464b5811550271ccf37dc7e5d14e58829e1560b54245ac01

SHA512
88ff1a23b98780547710b4832d598a3b0994bb9249400da3011be876ea106633f0b7c3b7a06eac4e1f16ca76ffbf278c9a4daab4ac793b0af8d9fdbbabd45b92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
7f98d6eaeadd67ace65ab83338d366fb

SHA1
84d8ea437810b01d3a3adc7fb4a345b50e05ea58

SHA256
750be3fe78ef0435d626bf56b0c76892266c00c1ce675dd9064711bd05e05de9

SHA512
5009aefb44eb550c46d47d7bb75b277e0a933f1e397f2e39d96c6154d67e259df4bdd8176c597bb6d75423c15e96cbc0b5bfe8f8d6074406f440f7150bdedd28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
e8c4308a0bcd207ed3ac9e6df0eb4215

SHA1
f9b4fbce6e3ebc2f6de1fd800c993bccb58fd5da

SHA256
008cff8808d73868c69bf9302d542d6a9dcd007c0c0d1a0afe8b38c05e91a05d

SHA512
8b6b7f45b1bd01cfe04d37d5b67be8c30b19383663284f6e3426ffc0f305fdb32fa44c1957d4f315024e77a2e43f075a689d7f13fc2cd8ea0fe529aa57d2167e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
da83544ba801817f5a5aa41c2d7e7512

SHA1
ffb85f83b9cacd3a0aabdccbb34b51a16101a8c3

SHA256
9bf3d261edc6bb206cd2e932a8b8c18eb2b1bb3bfccb93b5a7fc5fbc24dee886

SHA512
687e1c4d0da0cdf4641fe86df2b9c5162731d88b46102a9d6adb269e8943d9d314b836fdb1191fdb7d872cb26da29f71607af5e5798d287d37e95a2b329e41b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5525ce2e-3a9a-46da-87bd-b2704a8edf39.tmp

Filesize
12KB

MD5
e27d126ad601067162b2ede8d9ec240b

SHA1
cb2fd6782f396c4e248bd35c30ca441e9339b4b6

SHA256
9b6843a0d92eb2c4a3098ecc959838fe1cfa20820e8bc3966ac47026e435ca9a

SHA512
e4e5de822e924eb932e97016c7d2b14e72513fcd1f01a4f625c58dc6a2440381e8255729b78b0b6cb0371c755c8408e9458d1b7942738e7f4e2377ea6dc555da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5bbc3838-cdb0-4bbd-bd7b-e0f0e94429eb.tmp

Filesize
12KB

MD5
b66363cecd57ae4850297e15b1d326b6

SHA1
7ffc25043f716f35395520ea165409355549644e

SHA256
89a26d03477357af69719979655da7b38b571c432f52d94f64070f929e9499c8

SHA512
ee43f21948f6708b182280ce142193ee8a8480df98c5c36c0eb703d0db626b500e2cbe0f07befe000dc72e798069f1c47985e6f73f2917e8ef586ba46d116c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
408965d5f758e573f9d715123b5838df

SHA1
1c8ce993054679d78f59d0997ce4b762a7e22748

SHA256
6ff3f92758ba43a0f9769c226e8477ae2fce0ffdf7d516465bd87c4149e7610d

SHA512
bd2f6780bb30943dfbce6d3bfd02cd5092d0d187c19de61f3641a1915c60eb22c5880bc7a807f138a39ce55d91dad6a54edbef9a67d08c33ce8ac9d18ebeb3bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
809efe77bafad89093b6f1b33f605a29

SHA1
bed8103d046ef4f6986345ca4791c42606cdf27f

SHA256
d440dd5ddf63daedc6bffe81d8ef092d4295138e67037b3d7df4394edb17f433

SHA512
78ae389e68d60dd24030bdba50233dbf85126e97e75cd52d0180e972b362d79bcfd66a7bcf16845a43b26b3d1e5be442190fc3726bdce777c502367d36da3511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3efb51350a36bd9cb660adaef54ee90a

SHA1
1a697e76e48166fac4d8b9480e98d884bc4c5431

SHA256
29bb21478a67b3fb13b26c1a5e021d27d9c04fcbad3a591d1aaaf0c4b859b68d

SHA512
5422a3bbb0ce5b5a6112b16fc8ac202d50191c0f3bde87ed30f929f1bc5096576c6427aedd98fdcfc89ac71be9416a4b170c9dd5903cc53dc47a58a62ee3268f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95c2a2d393c1852a571dfacd2ebb8194

SHA1
7685137ccc240e00f4df5f372e12bfd121266398

SHA256
1bf5656b190ddbd0cae7c9273bcc33863598f7a02a442ddea7167ee42b943dc3

SHA512
ef8eebdd407446462909da36a9688e0db9aef876a7f65aef0b89f90ed4b63c47de7cf77d0f9f2eb25d549c1508015fa4bc7bfcdc280afbf0c82bf11f1dafdb02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
84575dda5332547da118a4dab97194ee

SHA1
3a4979bdcacad7d37fadb2233b3f191c99abd2ab

SHA256
e7e417c0c6e69319db1581c76407138e0b1dd604179a2ee7423af723a1f2b3be

SHA512
ea5a2519a016eed0e7a7564956749083cb4d2abf18810124233c26fa04573505505596d415a1e9b8b769421bd8355e2a805489a4d03aa72c0d40112e19e32a66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
812f301e3ead298aaff609d62ad34cb9

SHA1
5d3034700fb228bb6af5ef5da2690530c30cdc59

SHA256
e992c2b5c5a2b94df6abbc0a143f496ca46dba5ccfbafb6bc00d6eb196391110

SHA512
7052cd45fabe511001d075a37608b95856ef8cadc8d890e558d056a9e07077b0145460a1257b61437294122b4c493a44b20b53017cced9214efc4479096d42b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aab76eaa4e1939cf9d388bd105a2b438

SHA1
832e3e106da160499a6d188df66553d7f97367e5

SHA256
ca85befdd17e02f0f122bcca413bc2603a4afff314027750d1891089fd8b7e4a

SHA512
fc23f8dc67986606846c5615aad083ed4337649e31339ce129f874ba6419d10676e25d320fb4aaea4dcd4a27302fa68ba87c81ecaffaf802ff4a6910fa30ad06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
559880d4d86dbcb8c5c734d29c1d8a9b

SHA1
81706044aa605f5cbbf7ce51e809dfd5bb8a4713

SHA256
b442ec41cda87fc5d80c31a5b886831002fb2954d44cb38eeeddcd71f61dc588

SHA512
8dbe62aa27a5470df28ebeb85c21c2e6ee3de95d6c6d523a458309baf4fb69a69a598742b07b49256518710a54d8ffe05f2213ed8d7a3bae4cc7c2e619306865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5aa980.TMP

Filesize
873B

MD5
a70028ede496b1cd4e3e84537fbb1385

SHA1
f0f9484b09c6d4e41f633e2e5e2e72cf5e1763be

SHA256
46886c12220cee2db74f5765a1a971a6c2d15a4514828a6f02d9e2535e7ab7e1

SHA512
99cb9ea578b3391581b51e80f2560d8f0dcf0151c220bd81212200cc94fadac6fd4d555731de285e7f6921a5d94fc4cc7c43165b4ac994169e78a5e4b252488a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84745f2cfa45d3fbbde72333c2e505bb

SHA1
18b6e5e8993c3a19bbc3130a56d32d16aec265e4

SHA256
496e64226aac3eedda81a86a407c0de6d57eb882d9f1d9fb6afaa0c6689ca49c

SHA512
77cbae4e091e2f264315fdbb45e81ab9e60079aa49c5eb954ab1363a4f7cd1b5986734e3ea45c65bef54d1993cbec63921aede038aa4c11c1d63d1b72b45f7db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2a0a73d82cbdf2684a30bd53dd48396e

SHA1
92f1dbc8323496383cef67ab5e6d20405694a160

SHA256
80d655d9e8a82972a434b6c1fa310959aaf4834743d21e8bbd3c6b16a1ba13e6

SHA512
218840725ed6e32569af75d372e9e1849658a2e27350bee59c841e168f32426cd6b67494b79d7b2bc306326cf6836e139461d0847f31227b55169a1bba306fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78ab988c50e7a5df5d7d6a860666de0d

SHA1
9faea2070b0ea526b51ff857e56b08814ed5cac2

SHA256
8502846886775687a562c95aa29ec61e9a7b07bc9def79a46d94647009e30567

SHA512
cd38eaa7bca64b6b564e755e0c9e45a17b7519c8ee0d103cbd255374596e179536402aabd053d784656731b98f44d68c3ea13619f244f472e131dcbcb0b8fb87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eeb820ae4bce6f423f788c04718bd508

SHA1
72325a8780c6427e90a6610d16af92eb0475c12c

SHA256
b6504ec13f3313d8a62d7115abd4d3b61430ff8d5d62717628efcb3a3cb7c925

SHA512
5915826bb8da81d55dd011960a3bbffb023bd87a41db247862189bbd1baaa420e692fa4ba5446f97c9fbe7261278bd3147c2c997002cb0cef19ea134bbc2cae0

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit