25580ba156d2adfca6c4b48e9912b785b7fd9ff6f1aeb855bea845f9b2f19bc5

Analysis

max time kernel
1800s
max time network
1692s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BasebySofter.dll
Size

236KB
MD5

2ecb51ab00c5f340380ecf849291dbcf
SHA1

1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256

f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512

e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP

6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
880	winrar-x64-701.exe
1336	winrar-x64-701.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
7	camo.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-6179872-1886041298-1573312864-1000\{E25C6519-EC08-4D69-A517-693A4AE8ED21}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 198195.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Valorant-External-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3776	Winword.exe
3776	Winword.exe
1192	vlc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
2540	msedge.exe
2540	msedge.exe
2676	identity_helper.exe
2676	identity_helper.exe
2860	msedge.exe
2860	msedge.exe
4816	msedge.exe
4816	msedge.exe
2640	msedge.exe
2640	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4124	OpenWith.exe
1192	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2848	AUDIODG.EXE
Token: 33	1192	vlc.exe
Token: SeIncBasePriorityPrivilege	1192	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
1192	vlc.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
1980	MiniSearchHost.exe
880	winrar-x64-701.exe
880	winrar-x64-701.exe
880	winrar-x64-701.exe
1336	winrar-x64-701.exe
1336	winrar-x64-701.exe
1336	winrar-x64-701.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
3776	Winword.exe
3776	Winword.exe
3776	Winword.exe
3776	Winword.exe
3776	Winword.exe
3776	Winword.exe
3776	Winword.exe
3776	Winword.exe
3776	Winword.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe
1192	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3920	2540	msedge.exe	81
PID 2540 wrote to memory of 3920	2540	msedge.exe	81
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 3524	2540	msedge.exe	82
PID 2540 wrote to memory of 4024	2540	msedge.exe	83
PID 2540 wrote to memory of 4024	2540	msedge.exe	83
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84
PID 2540 wrote to memory of 4888	2540	msedge.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BasebySofter.dll,#1
1⤵
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffc5c73cb8,0x7fffc5c73cc8,0x7fffc5c73cd8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:4168
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,4058230371673974218,10497436877792872618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5d2e4a66f3b84315bc06f651741b97bc /t 4000 /p 880
1⤵
PID:1896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4124
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_Valorant-External-main.zip\Valorant-External-main\README.md"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3776

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Temp1_Valorant-External-main.zip\Valorant-External-main\Valorant-Aimbot\AIMBOT\eternal.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1192

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05921667-4ff2-4fc7-a609-64e16e2da902.tmp

Filesize
11KB

MD5
ef447d649a0e3b4ec039d863b387a5af

SHA1
a08246ab87229e49f36e2bcfde699d0c4072c20c

SHA256
097065e0b538f1e28b967b39060988233c60d2fbc78d702231d58bd9f5aff439

SHA512
cab9bb830a6c5690b0ea6a222823c244b4b1af59a5de4a55dafe85af9fbf9f1cbac218b0931b0c0dcaa718eec13c75f482f348053abf0b8f3624035776ce888a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
00d4cc262b70dd3d386111ff78fb0812

SHA1
628d4dcee1e82d04ab3969c29e256cef10101407

SHA256
956916ddd6bb5ebde0f5df3605a524d1624ea335cdc6bd5bf26681d3a5ac5239

SHA512
12f3cf77c4ee58eb00b08ced394d35e35237da4bc9ca62b1408c6dca4350068aa94d3a0e98132aa0e6cbcbdb7dee9c2b9c5399ba7c4780442200ad37a4c2b1a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
027a77a637cb439865b2008d68867e99

SHA1
ba448ff5be0d69dbe0889237693371f4f0a2425e

SHA256
6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd

SHA512
66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
45KB

MD5
ff6490f2b1414e34b58e0762b0475540

SHA1
89b5f5d3d6b4332111907000cdc2ad3c2c43e033

SHA256
56e798e78e22b5857af2e3a787039c48bd7e39e7409542b566bc5c34bc5da623

SHA512
97e4972e20b3b4e1d8e035e25745502050f93859dc60eea6f3121e082ecd7ff1c7a2086f4f6964603ddb04ffea18db249f1bab3343d41989777f2dfeac1112dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4d87c46b39318875155c6b71f91c54e6

SHA1
64a03919d4d4e6c76343904bf8820248de9e8a45

SHA256
abd7822e3d02d22f1324e47561931565708521f70212cbe77c6645325cf8045a

SHA512
e30281f72a7f88b1781073b2c797d637f256159a0d45fe9e1683a3143c9ad33cda9cc88cec16949a794b73dce6d7ced80b7ce3ebdefdd3f14d07dc2b9fabb864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d4cf5a7e33a41de886a6c432701e6640

SHA1
c8a1d0e408b821209d97cbf715f9ce93bdd39aa8

SHA256
0e09c09e9b35a6c27a0d8991d76b59959c9b2c0fc3fce4fec8fc5bec1f38a86e

SHA512
c1bf32ab90b7cc08bfb44b39c94389f5b5dcb884790caf34338a461059670b7b6c3cee6268e0f0e81552a0b312c6935951d53d5fb71a9264bc874f0374131128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
868B

MD5
37e318c601754154408f810b96b2c9ef

SHA1
48e5083bc2221734ca89fe99dbcf2d906de67ed6

SHA256
3d626003eb4377c2f6d7fc7519e23221ef473832fdd3fcbe461c2de67bc445e6

SHA512
f8e8e5ad20db7f54675c0d40a5949cbca48304d97ca188056db722952be8159957cc19bbc7b227fc014ffd930e85ccd0067a9b32513a5780c17cff76ca293a06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
945B

MD5
ad2acf0ad0e59f2d7fbcedeb4e7afc21

SHA1
9b44d72b148f8dcdde85b5036ec93008322f7d74

SHA256
1760afaa69053809bb602d25f3d52a6d31693b85dc0b2ec4e1226bb0f815b0d8

SHA512
f7d9d539a07c185ff958ffd19c29d56d2ed732620725ddcad2478cf3b6dc36622b07bbd530e4a2f164867cca0add83a796a1b167adee6784148b146296855e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c318e22da046dcab4974c4c40484c75

SHA1
cdb980d240efc3f8d0b2b06d827fc99b8bd89264

SHA256
59b21ba15d38a8c4afb628fdaca8103980cb491bb03980c4fd0aaf9dc95c528f

SHA512
619c789985677f2caadff622b71584df588569d7fc9100056888541407d272ba6143f9de689c2db0f43feb6febfe17bf42199573a2a5db93465e34c49b253e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7cb18330b92ee0062be1caf4fb9d0382

SHA1
5f05784f4bb50609e70388ed80109cd15ab6a77c

SHA256
fa1e0e211096388c3306eb5d05886abfea5c56d7f6efdf7a64e85cfe406611c6

SHA512
7204ecd8d956e3f889ba397901e5e659182e8f0b717cf1db0b292aa64421d233567508aefab8235ef75f7ef3b564f44350949aeda70bf03a650b625486818b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02b1bf9ef6415c1238f0211156f42c7f

SHA1
becbf48e7573154a9abc9f7339c1351a8d1af943

SHA256
f2d03e405f5e50d8bb3ee9d763a1ec7edcdffa07c80b2a736c16095944d52e9d

SHA512
49899acf63a96ee984a70c4ea4e0b374fe5807a25ff3240ae05c501aea819c5544261607dab8c5f96718f6c44236e8c47bf682d39a34ba672f6caf8b0cb7cd9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56f39fb04f7bceb69c9cd831cabe6fec

SHA1
7934557eed3e71406a37121e8449caf4f1b30103

SHA256
aabd2fd2ab6c32e51a8c701ee36727522a89adf61d428226c82cdc0976759aea

SHA512
64a8b8d7e8ff899f61a9007a94e5f377e9b49d228294484a0e382b8f56dd4869aa10b1b2ac40e915360359ab3f2fda7828d9040fbd3961fd18cde81c2e454751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa6609e887cac161768dc421190e0530

SHA1
1adcad2adf9ea2c389d8ac663e756075702999d8

SHA256
b3618574ce9510e5b54408561c9ca13a78413bae003a76e69fb001cbc0ab3825

SHA512
7b1b5cd70dae06d7aa430518f649d7e3c8616c110620364c51f6abbc28909de390aa55fd43a76fe7a50ab5c936a2663599592bb436d93792c95a72d1fcd5ca85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
edc5e3dd4074ba21ae1700aaa6b4a99a

SHA1
4a82ec3016946e6e74e0bb174b8a55cf627d338a

SHA256
03ae902058b4be4d35b1ea2a49d6c1f65963c8e936f7fcd8cd11c4bddd9780cf

SHA512
1d59a9034dcca84d7842722bc4d540a070a5afdf71763b113e4793cae16e8086f293a7e9cd028b418376f07efacfaea27e1ece690cb425ad0dddf778f06819a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0fc31f2748bf3efda3a2ac085c4425de

SHA1
74e26e4d54f935dea3bee0d2c89c0cedee9d420e

SHA256
e8c250bfa8629a93b6ffa93e8ef03d6a0c3bdcf911cc4ca5ea144b69c851ff41

SHA512
09848def73309e9d0920e69033d52e7329e2f9229e7e44d37df390d2e87e6f2626d8c0123ffc8a5e4a0c3904ed0156cf1b4c3bde453c7317c6136e6681e4d47d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
6935f6b3653a7f37ee073111e00bcc38

SHA1
7ea53de57b28968c897c0052a8ffbc905c129d14

SHA256
3dc8877c32f1707eb9234856bdebb6e45c4f17c2241a1f36aa2e10e6d699ab3d

SHA512
71cf303b8995942e6893209349ba7612b29d8d0d4cc9df43127045f44c59ff994dbf2ba0d1a0b95667538777e2bad3c821af8aec01c53848cc5e720e409d1a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e207d85ea7d4d86581fb9370c4b0e70d

SHA1
8f51f4cd8461edde3fe61dd09989b47a100d34ce

SHA256
ae82f19837149f7f282a208bf2247baeec5c6951537166036ab9808540a981e6

SHA512
fc521f46b5f1930982cbf092591da1a42b813d9ac5e4fc1a40f94542247564860890895d53ca26310a9083568f771455e7242857c4d47bd994a6e574d263106e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cf11dfdaa31132f99ecbd45c6ecd5b1b

SHA1
848c812cd1c50385968ccf9d7b76c3fbadf920fd

SHA256
0697012e860c5a4f405feef1e4c7a8dca7a9b0098471ea57e9b0a06e1ce11b0e

SHA512
1dfc4639631c2cda0622ae5420645703c40d63f28a4c4c5d3932abb644ca2bd8c7bdfc65383f15a4c545b6aaef870835b2eb89326c7061f2c76706be75b44261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5258e0b7e9904046efe004ded3a2bd59

SHA1
fa27853a0b03ad67e7129be2401a1912e56152d1

SHA256
9d863d65e5364c83c6d1a16adbe96b2dbdc0f965880aa3bbb0b6ba312158815c

SHA512
af1b5ebed1a669d247efcbeeb986e235ed9a421cad6da6754149b8d9fe57c1eac3dd8d581c71cb14df98024cd035efc240ca5d49d84d23bb587c30e2d5563485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
16ce3c951da54937c7752a6f11a362c8

SHA1
52097707f5c6929c22683c8d3febf5545de1616d

SHA256
be789b0201067664a1028a68388a8695b77691e9045fea243ee6f5aea149bf62

SHA512
8b85a0f45776047bf8091051adbb4b3b17f748a0d74ba406a4294c7c938472904b51352336fa08de194dae2d4fc5b5496baf1788cc363f51d0ad627f9dbb9e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
008c177ac5549498fbb12f678177517c

SHA1
ff10588983dae616021aadefc80fcba250c04ad7

SHA256
5e7bd382bd2ddba28f8b5d5abe47e529366884c358dc2927b5b3ba0001943fc1

SHA512
8fb55506e7416d137df85474f994c3e66a1cd71966913134f6d4ad9a939420a12b54a3645400b3d92bd9a77dfbb7627bc9b2779f2e9ef63812b95d6722ce2b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593743.TMP

Filesize
705B

MD5
49e3739b19eb7fe12f009e204e327b44

SHA1
f07a407bad289185c9adb9fbe5d57ffa508190fd

SHA256
8377337b01b22ccdd0e5f6c631f37d4baeef2fdbabe49c8c043825fa079c1523

SHA512
d5d3e7d55210dd22422655ae4a4001dd22ccd6fdfdd7a8be860504370713b480989c252775a110916aaf0c28b0a324e3bce2412b6a6a935a45d64d1839dd8b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
26c9dc8ad218d090fab6f8c8fe22d459

SHA1
5b78eae8cf822aea8ca89adc76ba0fb988224db4

SHA256
8cadd87707c112b06a3e82fb3618cb23f57652933a37fc2e58bc5b2b29c8ba23

SHA512
780d9388d80730e13896801a6834ee0ca367eddc8e0b42c26e1df484fde37836d17d8ac2d1fbb108f2949992d7a7d30dff63ca6bbd93cffa5a2a6c673f2c4589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9936b42a84a4c240f2ecd20bd5194a27

SHA1
39856c0eced9d4435011a1e1a7c0e9adfb246d19

SHA256
5524e7955633de2a999e50ccad5ad1d706eaabbbfe74302ff7baa1fabee79cc4

SHA512
c26dbc1cce47a57c2cb2381a24c2a5f5458fac8bba8d537f8680a83a44d22cc6ac7f5fd0df063523d19ebb230304c70f1ba343020fb8a8e461b0afbbc0daaf3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e44453f12740d90048b6d4087f7fb9b

SHA1
392f84975d8dd626e922a76ce05b5f0dae2ba24a

SHA256
1bbb20caba71bc794e419a5631a38e50c8cba0d42b8cd954de4ea858137d76f7

SHA512
6f769478166b8c30e87303c8ca037f3629252bd4dbffa15123693fc5a4900bc03cfde3c4797a5db340b8eb4919422c2d5fa37eb4b658c56b66e5519243a09142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
3f177bff751be3474eb2929c18e790bd

SHA1
961ef03f1cd24dc31896053c337fdeab866857b5

SHA256
f9592d0be08e171a1fd0692c87ad3c3a94cdc3d8cda3280d8a02b3910a79c02d

SHA512
93432af129372f4557336968665e1bbbe919da6fd2ae3f99884ac35cff09ed7bcb9d6b795c367a596ca473014357747fa72b94cdd2b17e98f32d7fd2278b5bd2

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eed1599235b9dd933e13cbd5751d7eec

SHA1
d461f7edc8bdb31b672f97b18d34e38bb7c96c4b

SHA256
13ee96f0fd8b45de1603cea7aa86ddaa749ea580989d6cb806d944f3547fbf43

SHA512
9679690676ef1ede8030e26359381a092eaec7cb671d51e91d8cd446006301bcb98518b977fd5d475e777baa11dd28e69135c517e3b3d74475134bfed4e8da9e

Download Submit
C:\Users\Admin\Downloads\Valorant-External-main.zip

Filesize
33.1MB

MD5
59850df21c84224012b1022742336d90

SHA1
4d029768e4a7380cca5a669ac9991e730e069f0b

SHA256
ae4921b0f517951e1225954c30ad031fd53bfca993af4f8868a02964a0a94f4a

SHA512
6a1f40d31f0e935245e7814b790241e2fea4c206f4444a23628baaa546f9701f50840aa5cdde7b230c60c72066b00a1d5ff36766eb46aa55987bce9ce630723a

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1192-1295-0x00007FFFB3FA0000-0x00007FFFB3FD0000-memory.dmp

Filesize
192KB

Download
memory/1192-1293-0x00007FFFB3FF0000-0x00007FFFB4001000-memory.dmp

Filesize
68KB

Download
memory/1192-1313-0x00007FFFAF6F0000-0x00007FFFB07A0000-memory.dmp

Filesize
16.7MB

Download
memory/1192-1310-0x00007FF75E980000-0x00007FF75EA78000-memory.dmp

Filesize
992KB

Download
memory/1192-1311-0x00007FFFC5350000-0x00007FFFC5384000-memory.dmp

Filesize
208KB

Download
memory/1192-1312-0x00007FFFB09B0000-0x00007FFFB0C66000-memory.dmp

Filesize
2.7MB

Download
memory/1192-1290-0x00007FFFB9740000-0x00007FFFB9751000-memory.dmp

Filesize
68KB

Download
memory/1192-1294-0x00007FFFB3FD0000-0x00007FFFB3FE8000-memory.dmp

Filesize
96KB

Download
memory/1192-1287-0x00007FFFBAA70000-0x00007FFFBAA91000-memory.dmp

Filesize
132KB

Download
memory/1192-1288-0x00007FFFBA8E0000-0x00007FFFBA8F8000-memory.dmp

Filesize
96KB

Download
memory/1192-1274-0x00007FF75E980000-0x00007FF75EA78000-memory.dmp

Filesize
992KB

Download
memory/1192-1275-0x00007FFFC5350000-0x00007FFFC5384000-memory.dmp

Filesize
208KB

Download
memory/1192-1280-0x00007FFFC1AB0000-0x00007FFFC1AC7000-memory.dmp

Filesize
92KB

Download
memory/1192-1276-0x00007FFFB09B0000-0x00007FFFB0C66000-memory.dmp

Filesize
2.7MB

Download
memory/1192-1284-0x00007FFFB07A0000-0x00007FFFB09AB000-memory.dmp

Filesize
2.0MB

Download
memory/1192-1283-0x00007FFFBBBB0000-0x00007FFFBBBC1000-memory.dmp

Filesize
68KB

Download
memory/1192-1282-0x00007FFFBBBD0000-0x00007FFFBBBED000-memory.dmp

Filesize
116KB

Download
memory/1192-1281-0x00007FFFBBBF0000-0x00007FFFBBC01000-memory.dmp

Filesize
68KB

Download
memory/1192-1279-0x00007FFFC32F0000-0x00007FFFC3301000-memory.dmp

Filesize
68KB

Download
memory/1192-1278-0x00007FFFC6720000-0x00007FFFC6737000-memory.dmp

Filesize
92KB

Download
memory/1192-1277-0x00007FFFCED90000-0x00007FFFCEDA8000-memory.dmp

Filesize
96KB

Download
memory/1192-1289-0x00007FFFB9760000-0x00007FFFB9771000-memory.dmp

Filesize
68KB

Download
memory/1192-1297-0x00007FFFB3EB0000-0x00007FFFB3F2C000-memory.dmp

Filesize
496KB

Download
memory/1192-1299-0x00007FFFAF690000-0x00007FFFAF6E7000-memory.dmp

Filesize
348KB

Download
memory/1192-1298-0x00007FFFB3E90000-0x00007FFFB3EA1000-memory.dmp

Filesize
68KB

Download
memory/1192-1285-0x00007FFFAF6F0000-0x00007FFFB07A0000-memory.dmp

Filesize
16.7MB

Download
memory/1192-1296-0x00007FFFB3F30000-0x00007FFFB3F97000-memory.dmp

Filesize
412KB

Download
memory/1192-1286-0x00007FFFB4010000-0x00007FFFB4051000-memory.dmp

Filesize
260KB

Download
memory/1192-1291-0x00007FFFB4DF0000-0x00007FFFB4E01000-memory.dmp

Filesize
68KB

Download
memory/1192-1292-0x00007FFFB4DD0000-0x00007FFFB4DEB000-memory.dmp

Filesize
108KB

Download
memory/3776-1221-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1220-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1219-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1254-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1257-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1256-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1255-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1224-0x00007FFF928A0000-0x00007FFF928B0000-memory.dmp

Filesize
64KB

Download
memory/3776-1223-0x00007FFF928A0000-0x00007FFF928B0000-memory.dmp

Filesize
64KB

Download
memory/3776-1218-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download
memory/3776-1222-0x00007FFF953D0000-0x00007FFF953E0000-memory.dmp

Filesize
64KB

Download