hxxps://collegestpaul[.]nl

Resubmissions

14-08-2024 18:54

240814-xkl36ayble 10

14-08-2024 18:40

240814-xa8t6sselp 7

Analysis

max time kernel
822s
max time network
820s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14-08-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://collegestpaul.nl

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
656	rhcgmoj0eg30.exe
2532	pphclmoj0eg30.exe
5932	ska2pwej.aeh.tmp
5224	walliant.exe
3204	walliant.exe
5360	walliant.exe
1464	lpmrmahn.exe
2964	lpmrmahn.tmp

Loads dropped DLL 28 IoCs

pid	Process
424	[email protected]
424	[email protected]
424	[email protected]
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe
5224	walliant.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMrhcgmoj0eg30 = "C:\\Program Files (x86)\\rhcgmoj0eg30\\rhcgmoj0eg30.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Windows\CurrentVersion\Run\Walliant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Walliant\\walliant.exe"	ska2pwej.aeh.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
64	camo.githubusercontent.com
65	camo.githubusercontent.com
108	raw.githubusercontent.com
113	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pphclmoj0eg30.exe	rhcgmoj0eg30.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rhcgmoj0eg30\msvcr71.dll	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\rhcgmoj0eg30.exe.local	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\database.dat	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\msvcp71.dll	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\MFC71.dll	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\MFC71ENU.DLL	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\license.txt	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\Uninstall.exe	[email protected]
File created	C:\Program Files (x86)\rhcgmoj0eg30\rhcgmoj0eg30.exe	[email protected]

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	5112	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ska2pwej.aeh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	walliant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ska2pwej.aeh.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	walliant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmrmahn.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhcgmoj0eg30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	walliant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpmrmahn.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000620a07d6abd55341a93eb59d41b672a7000000000200000000001066000000010000200000008527001fe4edcf465a2ed6fc9fa7a416de4aae5ab5ea1b54f2d664a5ec5a1844000000000e80000000020000200000005be5963152c590cac5c6673891e3e2ff8b182dc2db446e3a91b3f07d6718a3635000000013ea876fa2cb421bccb53dfb13681aabc64c285de6018ff9322f3dff094774b4082023f79b4f1550674571a8d18ad13ecc24efa843c3dbdcf9895913d059791b5270b7dc3ebd2d0b203a2260ee4a4d20400000002671d904f33e2968a3b8c0a53da0cce98d452a06f903731f26c039e9024182a74ffacb1aea176cc0dbf533703d6e59e5aeee2e52d7f77d8a9fc799a1ba46feee	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31125136"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000620a07d6abd55341a93eb59d41b672a700000000020000000000106600000001000020000000944965abf774e4bed3dc479cacc48d22c3b5650d4aaaa3c825362380730d3cbc000000000e80000000020000200000000551e79004bec44ab2e0d56177d1244f4fe096471d5dc018dfe13b1f8c891586100100000302533a103068977e3db16811a47da64168a7edfc8cd024f19f91df0341e25dbb1f734cc25995edb64d6a0ec9a79a2864da99a8e0cf74e7c90f1016bca13f20f2d964bde5adf33197050246082e2ef0a67c31a67d70d0a4999eed9b2ae3a00638268546009415c314d49a12d20881f6e0a70fbaf4f87d09a06caf60aebcbdf1e123d369280e6d03276cb33406a18143a63b8d0bb20c48361455d45bc1442a52bbe680f26747f4742bb5ca940dc92472b3458cc4a7cdebc6b90927ae6f05da4105c2e7412d8c42de2437972f9c12a3145a225c5825761550055078be1596a8835dd089ee6898c28446a0d2ed2d5c58df526fca7a91336545c454f6a3a0ee12dc100746bee6302d9be0e8c59410581d6940000000238fd4e52b8f07695a3d3d0a9e5cc54b65398fb43c0c5dcb8850796009054f82ba6ff340f49c58e3ed7910e2fcee3923ea4bd3706701e725ccf6dfd1523a00e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3250094818"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05381DD4-5A6E-11EF-9BD8-722651347A01} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000620a07d6abd55341a93eb59d41b672a700000000020000000000106600000001000020000000d5b59b74c1471d02e8b05eea2cff950863b92a01303ba94b8884882c94557b11000000000e8000000002000020000000407987f353a94f7f8834ad04b8ecc6aa5e07331d698b5542bf11258be0d2bafe10000000381bd9be4f19e11fc1ff79b5fd61065a40000000caa6c230df8acbcc9e1a4a5a0e4975086222c06d6e6430b1bddc9c59958b9a4dcb8a7c1a8e1515080f7b031ecb7c54dfb545df320f3610f5512a6737bbce2a2e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000620a07d6abd55341a93eb59d41b672a7000000000200000000001066000000010000200000006a9f15aad5ed027852ebaded0990fc5768fd2ef1cc949cb45c886506b40f91d2000000000e8000000002000020000000a3900fecb01b4648be2bb600506ae0f964d3dfed822d1c43793e59e0e62c81c8200000000db5d46d507615393fbe2a14c01aebe5466068c09caa9850aa787bb8e6c5cdc540000000ac40d808013d01c195a05ba97619085d03e7b527811f8f8801b65276cefbe76cf1683cac02d1441315fafe76e9c24ac1e0d0d033ef21a21085063be7646120f8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4059fbd97aeeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = ef6297ef29e5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000620a07d6abd55341a93eb59d41b672a7000000000200000000001066000000010000200000001ed469c43582ac0290399c17e865782c0bedfb284d06ea3651d7301414a51a50000000000e8000000002000020000000ff323c9e99d4b4bca028270f8798c1d76d5cb50017899e6686aa2d281956d4ec500000005f53807f0d7e31110ae4b7277215c1e618a0dedf95d90c85632578f0e953a072da0104dd82e9173e2d5851a1d583e03ec84ad3766f354d6e210e4264ff18cd7e4d4b11b0796ee5be722f947b6c1dba5d4000000087499dcd3e4a54c63563dec35acf3e0becbf2a581a600bd035e66b4d36823a45493ba65f1e012da34685e5572359fa7feec8018be9cec79fab29587fe6956395	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000620a07d6abd55341a93eb59d41b672a7000000000200000000001066000000010000200000008fd35dd276941d584ff9064a38b46ceb54f2912c40ced1187642ea8599aefe31000000000e800000000200002000000044f82f59734ff212cb146066ceb519fb475c05a60f2265220d0186adea840d7a100000000778020b2fab9de399aba18fdf8bf4c840000000ac18604dd839f85109a2a35f4f6c003e47360429b733bd7b162e358d1c97eebcba4661c71b4f31a6670da0378038bb2f7a1a5864bfbc33b4cf8ec1c50937e517	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\Start Page_TIMESTAMP = 0e9021c87aeeda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	iexplore.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-131918955-2378418313-883382443-1000\{469A6D99-E8CB-4EE4-8DDA-9AC2392B6FC6}	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe

NTFS ADS 21 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Walliant (3).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (8).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (12).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Bonzi.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (11).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (2).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (9).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (13).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Fake Virus Alert.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\XP Antivirus 2008.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\XP Antivirus 2008 (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (10).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (4).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (7).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CookieClickerHack.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (5).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (6).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant (14).zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1628	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
3740	msedge.exe
3740	msedge.exe
4192	identity_helper.exe
4192	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3572	msedge.exe
3572	msedge.exe
5040	msedge.exe
5040	msedge.exe
652	msedge.exe
652	msedge.exe
5028	msedge.exe
5028	msedge.exe
2428	msedge.exe
2428	msedge.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
1952	msedge.exe
1952	msedge.exe
3784	msedge.exe
3784	msedge.exe
2972	msedge.exe
2972	msedge.exe
2788	msedge.exe
2788	msedge.exe
2964	msedge.exe
2964	msedge.exe
2732	msedge.exe
2732	msedge.exe
860	msedge.exe
860	msedge.exe
4672	msedge.exe
4672	msedge.exe
1172	msedge.exe
1172	msedge.exe
2940	msedge.exe
2940	msedge.exe
4996	msedge.exe
4996	msedge.exe
3572	msedge.exe
3572	msedge.exe
3884	msedge.exe
3884	msedge.exe
1480	msedge.exe
1480	msedge.exe
1820	msedge.exe
1820	msedge.exe
5932	ska2pwej.aeh.tmp
5932	ska2pwej.aeh.tmp
5820	msedge.exe
5820	msedge.exe
2964	lpmrmahn.tmp

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1628	vlc.exe
656	rhcgmoj0eg30.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	1920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1920	AUDIODG.EXE
Token: 33	1628	vlc.exe
Token: SeIncBasePriorityPrivilege	1628	vlc.exe
Token: SeDebugPrivilege	656	rhcgmoj0eg30.exe
Token: SeDebugPrivilege	5224	walliant.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
1628	vlc.exe
1628	vlc.exe
1628	vlc.exe
1628	vlc.exe
1628	vlc.exe
1628	vlc.exe
1628	vlc.exe
1628	vlc.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
5224	walliant.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1628	vlc.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
656	rhcgmoj0eg30.exe
4760	iexplore.exe
4760	iexplore.exe
3980	IEXPLORE.EXE
3980	IEXPLORE.EXE
5224	walliant.exe
5224	walliant.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1320	2748	msedge.exe	81
PID 2748 wrote to memory of 1320	2748	msedge.exe	81
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 3332	2748	msedge.exe	82
PID 2748 wrote to memory of 4908	2748	msedge.exe	83
PID 2748 wrote to memory of 4908	2748	msedge.exe	83
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84
PID 2748 wrote to memory of 4504	2748	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://collegestpaul.nl
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff901603cb8,0x7ff901603cc8,0x7ff901603cd8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7416 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7544 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7272 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7520 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,6163910231373537717,14379507452595668398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3100

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4884

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4124

C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\YouAreAnIdiot.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_YouAreAnIdiot.zip\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 1228
  2⤵
  - Program crash
  PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 5112
1⤵
PID:4112

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Fake Virus Alert\beep.mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Users\Admin\AppData\Local\Temp\Temp1_XP Antivirus 2008.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_XP Antivirus 2008.zip\[email protected]"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:424
- C:\Windows\SysWOW64\wscript.exe
  wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Antivirus XP 2008.lnk"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3916
- C:\Windows\SysWOW64\wscript.exe
  wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Register Antivirus XP 2008.lnk"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ehhb.bat "C:\Users\Admin\AppData\Local\Temp\Temp1_XP Antivirus 2008.zip\[email protected]"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Program Files (x86)\rhcgmoj0eg30\rhcgmoj0eg30.exe
  "C:\Program Files (x86)\rhcgmoj0eg30\rhcgmoj0eg30.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:656
- - C:\Windows\SysWOW64\pphclmoj0eg30.exe
    "C:\Windows\system32\pphclmoj0eg30.exe"
    3⤵
    - Executes dropped EXE
    PID:2532

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:4760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3980

C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant (5).zip\ska2pwej.aeh.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant (5).zip\ska2pwej.aeh.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5904
- C:\Users\Admin\AppData\Local\Temp\is-2VHPN.tmp\ska2pwej.aeh.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2VHPN.tmp\ska2pwej.aeh.tmp" /SL5="$604AE,4511977,830464,C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant (5).zip\ska2pwej.aeh.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5932
- - C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe
    "C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\lpmrmahn.exe
      "C:\Users\Admin\AppData\Local\Temp\lpmrmahn.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\is-2H73B.tmp\lpmrmahn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2H73B.tmp\lpmrmahn.tmp" /SL5="$904DA,5010045,830976,C:\Users\Admin\AppData\Local\Temp\lpmrmahn.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2964

C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe
"C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204

C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe
"C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5360

C:\Users\Admin\AppData\Local\Temp\Temp1_CookieClickerHack.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_CookieClickerHack.zip\[email protected]"
1⤵
PID:5456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\rhcgmoj0eg30\rhcgmoj0eg30.exe

Filesize
9.0MB

MD5
04b88c7067b53a9bdf844cd1cb4b9c30

SHA1
7d081a1053cd9ef3d593f5ef9a27303824b779f5

SHA256
d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9

SHA512
566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\103101b5-4224-4b31-8619-7a9d3ef1d272.tmp

Filesize
11KB

MD5
07e507c68140a89ca41ecf1291c4a5ad

SHA1
046ffae36d2c5908b9dd116264cdd67fa8388e71

SHA256
d020595f2fd281662c80dd9d5782338eddd55b252755197f01563ff37ffaa4da

SHA512
10568b4efb3bf91db1b33d2dd3f9dc852cca846a0a732df088cf2182549000f2f6664c7a24b30fe04c01c0769650300a534b54ca1ad56b4ae36e49222f44a90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
c79d8ef4fd2431bf9ce5fdee0b7a44bf

SHA1
ac642399b6b3bf30fe09c17e55ecbbb5774029ff

SHA256
535e28032abf1bac763bffd0ba968561265026803eb688d3cb0550ad9af1a0e8

SHA512
6b35d8b0d3e7f1821bfaeae337364ed8186085fa50ee2b368d205489a004cb46879efb2c400caf24ba6856625fe7ee1a71c72d2598c18044813ecde431054fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
1.2MB

MD5
771f4dc9c62dd576d8433571a857a40c

SHA1
7b4fecb308d4640cbac12494809d82426607122f

SHA256
5cb56ef854300e6c5be352cf1ffd360f4fdf272edf69ce95b9b3fd4c6473c3be

SHA512
ffc953bccd24128e7a04bcf64a17a50ba21e460efceac4308206eee9aee86a46d1a02a7cb7e3faa4f554c2ee12e8222acf281478651c1b70e06550ee5fb8b090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
43KB

MD5
d9b427d32109a7367b92e57dae471874

SHA1
ce04c8aeb6d89d0961f65b28a6f4a03381fc9c39

SHA256
9b02f8fe6810cacb76fbbcefdb708f590e22b1014dcae2732b43896a7ac060f3

SHA512
dcabc4223745b69039ea6a634b2c5922f0a603e5eeb339f42160adc41c33b74911bb5a3daa169cd01c197aeaca09c5e4a34e759b64f552d15f7a45816105fb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
27KB

MD5
c3bd38af3c74a1efb0a240bf69a7c700

SHA1
7e4b80264179518c362bef5aa3d3a0eab00edccd

SHA256
1151160e75f88cbc8fe3ada9125cc2822abc1386c0eab7a1d5465cfd004522c8

SHA512
41a2852c8a38700cf4b38697f3a6cde3216c50b7ed23d80e16dea7f5700e074f08a52a10ba48d17111bb164c0a613732548fe65648658b52db882cacb87b9e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
37KB

MD5
a2ade5db01e80467e87b512193e46838

SHA1
40b35ee60d5d0388a097f53a1d39261e4e94616d

SHA256
154a7cfc19fb8827601d1f8eda3788b74e2018c96779884b13da73f6b1853a15

SHA512
1c728558e68ed5c0a7d19d8f264ad3e3c83b173b3e3cd5f53f5f3b216ed243a16944dbe6b2159cfe40ee4a3813ca95a834f162073a296b72bbdedc15546be8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
7715176f600ed5d40eaa0ca90f7c5cd7

SHA1
00fdb1d5b1421ea03d2d33542a4eaf7ac543d3d0

SHA256
154632629a0698587e95c608e6ed5f232e2ba1a33d7c07fea862a25293a9926e

SHA512
799cfee1969b6137813c98b83b90052c04527b273156f577841b64828c07c4e6a3913a6ddd49ae5021ed54a367ddbc5ab2193226960b0ffe9a618c663c8d8a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
37KB

MD5
93acf02790e375a1148c9490557b3a1d

SHA1
78a367c8a8b672dd66a19eb823631e8990f78b48

SHA256
4f2513f353c2cdd3177e3890f216ea666e4eb99477a56a97ff490f69a9833423

SHA512
e6354f4e4d35e9b936a7ddaebdd6527c37e6248c3f2d450c428903a32d77439cab78020a45834379cf814a79149c3dddf4e1280b9d06a7f972e5f8e61c463d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
24KB

MD5
8cd3c6d8cf9e5a9655bf5624dd0bcdad

SHA1
09c3fa22560c7f4559a343847fcf2b629e35513b

SHA256
bda6f5004cf18a54fd3e447b0fc82565303616c8b1d7e0094a96af72691a0b3e

SHA512
925e3849c68315ecbfe3d7b0fe6b4320dfadc0defd2e56063216b36fdfa0930b40be2d948233037b0c672c5708dd612fa7a3b8189e276d2f8faaccc4d9586d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
23KB

MD5
bc715e42e60059c3ea36cd32bfb6ebc9

SHA1
b8961b23c29b9769100116ba0da44f13a24a3dd4

SHA256
110ccd760150c6ac29c987ee2b8f7c56772036f6fe74ff2fb56c094849912745

SHA512
5c0edd336a6d892f0163aa183e5482313dd86f9f5b2d624b3c4529692d70720f4823808f10ee7870fd9368b24de752b343570419fd244c33ad2d9cc86007bedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
11.1MB

MD5
c5b65f32dfc73072ba7ac00a0507745f

SHA1
a70a403e1d99af98cfebdd318c9717cf59d5e8d3

SHA256
41fe71ed625efca3b159ac86bb1cd2c8ff63cb41ba5967c9282b7d675724a937

SHA512
52c1a575462f295a174eb2328e8d465fc4f2c90c3af162647c1cdc69f8708b733c38baf8f0ac5e29a7a6acd4bcefc667c2264fd6f0819b9e98fe693b27dc61c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
106KB

MD5
99f7b59bb69d6870454d0e3b02b058fc

SHA1
e8a23b7f7d941b128e378895861c79d501b2e5d1

SHA256
9d0dbc4343e9201276b332eb7a0de1c3efd103f86547080a5e6162ffc5f21e0c

SHA512
16bce0bba157c0b45b28a90375075739ef702a3f2709708a4adf4e6af99ee343cc2b25d752968b6053cbf5317dc30fbd6713bdae825de58d9f06bd2192ef92db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
1.3MB

MD5
a06ce8cd000f726c1aa2485a841f9640

SHA1
c2fad57e9c22ea6714d8bee9941339aca1cc7e8d

SHA256
20c562166df0c0a76fe9ff901b20983321b2e9a4b045e3c3c3a20f8e4f22a5a3

SHA512
32947e6424359499ec393db8e9776b4fcfb4419e5b8e821515d1220078458d3bbbe879b22a6a18b6d3f457369ba9369b0970f8905b431dd5e9732c805b0d7be2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
a8bf733e2f498a0a1fddaf1081fb034b

SHA1
d6d15b0cbf2c42a0dbf29aae4ee3c419d222e6fe

SHA256
a5f01e50da3994994a5555c947854eee71e694bf64c055a3674dfc98052a313f

SHA512
81da450506d4a2172034b6b42089af9f8ce6c25077b0875193680c325807d61d950bfab5033c93eb6afb16c2ba28e60ed785f809802614809dac3b038f925c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c46394cdad2fbd11aea21b84289289af

SHA1
3b5f37b7a62ad6cf3507468d7ec7d11391b53cc4

SHA256
0ff31849e548486f7a06374f22a10543a4b82d4835c902f6d0e92128830258ae

SHA512
6a50f7bc1f7d27898a8cff6a4a8c6651ccddd7878854f508a178946c806f4d82a6f98260ee8a74bbada89613ae0bdc108feaeabdf11f69f2d08ee29341a48938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b9c55a57e38d258f2048309381401a94

SHA1
19ba70d9482c0fee66119000926ae049980600c8

SHA256
77e7c65e6872052476442ffd8a8848606cf31fa47db1d690e7ef7e9ac57ccb84

SHA512
9daf6b14e1917d560b4bb8d13eeb553898e16aba99b787e845c9a86a070855d5982a6d2f066d9f63d5b5a391e0abd80b35f15c5b75b001b2be2bec8642c7c812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cac8cbe417f3286f9b928058b1c0b8e9

SHA1
7bba95193a57000ddb97ea45ebaed2a1eddebbcc

SHA256
6cb8e4632b2e26a2c1756e1248349f981e1d79d33e3da5b2196e9e307b4d09fb

SHA512
9b4c5958861a7371e09cc9884d09a521c33e3b7b9d0a3b416e03632eace325ab79522b7edefd4b5c1b6166843fcac60d49cef908a41baf2cbe3a9e6bcefcb878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d88557fd545bde510507e71dc454a137

SHA1
7df5f9f2ccaf232cb501f8d8612b3b4e5df41a62

SHA256
0e56d0db893aa49cd42dae0e774b9d3995c19c39e5d150f68ea7566bd986cdb3

SHA512
c2b3ffa6cd7b1943b094aa478f618a7e7ac7fcae83360517357a25e56cfad0b961690041e1f4f681aceb185279b6455b541daad109e513d27cc3419e8044c15c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2630221f68637a8f41d2ed1bfcd6050b

SHA1
8f80addf191a4152059cefd093347ecdc74b1893

SHA256
11a11cef834f83f3c1f5cfea99435ca3832b27d2645b4532fce6fdd36dad6f63

SHA512
dbbf3caed6aa0f4f59cfd83bc55e0e6297c6eb10f447a9b1c8906d3ed21e0bb0f06b846ab5647236a38fac6b877d6131689f7e8eb2121c99014e8fddf0603bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a1ec10f4e94321dc33cad546726ab9f1

SHA1
6755eafbbf307b07be068a9bf5dd2a0b32958891

SHA256
631beeb97a4da6b9207cbc4a1d4239d6d4fccb270730379b50c6cdd58ddff8d5

SHA512
7996bf89d042051dda42422609c8b6d45f3e8258e63cacf9b8f3828ed07d504dc725841ef0f243b2b9f0652b0e5e690d64198eb8d3fc788ad1a899c78c5d731a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fecc7ad4b0b9cf4605690f3cc930c1f6

SHA1
03862be4977de3578265c26c09aec45600e23ed9

SHA256
4702f1593216804d7ad6e36b7eb758a1ef9beead7285dbb65c49d96d390df411

SHA512
a9f593d3485b8f5206fb15239b590902c31a3d58753ab75709b11a38c90c5e0145771b67f84ac67a5e7650c45f604252bc95b6dcd3d49f0990e71e399695eb7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e158b4d01901fecaceda3bde22a4af8f

SHA1
8ce3e784d1566174fb2530f1823368a77974d27e

SHA256
ed9cc073ddd4f7c511f5c3ef223730e7ce0eeb42259ed36b8e95254bfca2520d

SHA512
e00ec55a8c5f7de644a3f826435e7efa3b752401824e02611edf196b0ae3f676c8b37d90cace1328653e7fd6ebe99245932b5cbf4b4240d3b508a31dbb98bf47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bfdbf500bf83fbf8009d38acf2681bc2

SHA1
88df71097c1b01855f2e010e459b223e11cde6ee

SHA256
8841e5692e357094dd202c31dc58d37519d1c72c1fad4370a1d38f7dedce6b78

SHA512
32f743f37b0cebd6dd1c75b4736d5b642a7b4b46c4abea17fe8b4c385190bd2f3179ebdd2f42719842167f5f4bad0533c9dbb109304ff33f86b55f248f4d621e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0e986336ab531ac87427440fabef092f

SHA1
15beb330b99968428d333ff7d1c4129b0f7893e6

SHA256
9ee0fa97c6ec207e28fbe7dd07d67210ff9f17986128809cc562f2a532ad3134

SHA512
844345430cb4b566156aae6e801b6c5c9a869a6728d700306ec21a1b4a4b6cdff2aa146e38525d717bf3ab6dac45b83facff0fcd96bea755d5734d318a548fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b74f7904fe8c778817707790db67edc2

SHA1
bb8eacee8dde936ec7108329742c849697ca2bcc

SHA256
786bf3edd689db4c36feb9fd02c7ee794135b9357d127586eb44844767b53c89

SHA512
c450057e612be1289c2de0d1f0c878a9adceed9d36e780367da7c24e74cdbb9bc0ab30f61a7c63aeb6316f9b83a9b17cb8b8030e218793ea70b84d2012887f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1023B

MD5
eab76b6a94391e8e71ea639dc3e41f3d

SHA1
307d8782f7be4ba38874104752307a72efff8fc1

SHA256
470797a5b5a9a5ddd41671c5f96ab6d5f04a8e9e61603cad0a14edfc735d0694

SHA512
df0680dbaee2633c9a4d753fb86fba158bc9b59a93624f321182aec0b5a1eb0db667333cad91bd2992abc7d7acefa3002761a17e0531fb35d6808c693a7634e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b1ebf17a4aa7b7ba95d7554209ca682a

SHA1
4b9434af1b71d6fb32e13428d16f2db45b6eec4a

SHA256
744220c4c346f17b67fe746db8e61323ef5f851ac0fca6321647982cd6f51359

SHA512
014734bf753219c317f68b7a0ac9cae163a2729dc8d13bafdb776045cf48c47fde0d52d9f637f55f80e5476f500eff62cbc27ec0c4957a0efdd8f0879697e1cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1023B

MD5
9b2fa702ea7ebf0ac60238da6b0d8f67

SHA1
2e74fdeaded513a5e649db1d71ad6318fcf02def

SHA256
f9a919c759f9d9e878aceff1da6df9ee54158583400076c61308cf9b91e6b4a0

SHA512
3c751bd4b7cb640d7eab4999d1aac2a06a996d61eed6d764f164cc9bea725cc559bb2ee646a85125c4c9ffdb48c695eb49c6586410df89c548600c5049925894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4b8214074df6faecc511ffce118056e5

SHA1
732d731ce3e7cab5c6b788264e2735ccd4c989d4

SHA256
701684b22382c8adaae517a3f5e4b3de8df2bc25d198f77362466b9792f256ad

SHA512
0d1acb5739e78f6f4822a7a869485f08cdd50abe91cd9bf5e984b3b5e59b1545e5ca42c0b7fe018fd293a93442ad7aa9ac327263e5d5515644aa0210bec1fa0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
909851eeb82339369871222c67127eb6

SHA1
c64806b5ac375e1f05d2cf992724e7f691e3b082

SHA256
b673eb03a87ec70b2c9e01a57731ecc50d929c99d25c7695c99a78e64d838f02

SHA512
d4c2391b4a08c734c4dc4bafc6965c45c99495bd1e1c86af4462d1b4ab31352c33d0f0e3e23c9c5fd8424206f6623ca91c850cf53cf1d4983f89baa48ca3ec02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
533e394717485073159c5b58df805bfc

SHA1
23d51f926089d86ac0092cd0d767457d50c97d87

SHA256
77b25f7469f14472ae93e8aa397853cdfdc11be74903f1def5795d1d8a4eaf72

SHA512
82433519ff4a74f0e54ce74d0f6c30c7cc800a349e9029ef17266463b30334922db7819935c6f515f40a8e6d6f3ed963da1495330a6aa08302fd194e6f71624b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85fd65bf6830034c8602d556aee0117e

SHA1
eb92fa597a92f77f8cf8b4f9fe4417cb5ab8fdc0

SHA256
1242d3dc447ec994698edfaa575466ffd19d222f83bd42d655e61b59b7bac6d7

SHA512
f98f028de7ff9cd665c81de142a58835630f0fe38094bd8193cc81d5d334f5220444a87c9c756ef2df0149324cd77b3fded1ee6cac59e3f823362e915ce4e79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6f3759fae3d247bd5e56982e243a842d

SHA1
dd0dec5bcf3f516d45a9ad732d4c90361f60610d

SHA256
7776c8a82b9d44754fe1d9cb2324d6a01929b4ce4078bf20f279e1f3367e825f

SHA512
62c28c8961147f9723aebd7a33f98edfef0c6556ee55946607afdb6822590dd5ae232f4efaaa73afe46efbd77e951e66ce9cfe5c1ab348f8eaa982bae0a34a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ef42dac35a44ceb7b37c0235bc9d662d

SHA1
f06efe7ebed3343939852e206df7764a49d9d177

SHA256
1af5fb257ed257baa00b6adff555b8fd20cc8671a1a1020761ab746bec60d92b

SHA512
c245fd68e072c9e66ea8a1b0cb813d7bef5302f2235f2c60b4fb37e9fe98de9a079fd12dd4df4786ccec3c41ce4a0132c6608286e608f9bfea2b925295b50af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1cb634207c4cdd12c1769a183c1af1ee

SHA1
3c03422b7c81f394ed856a7e4d66d30ee5f12c87

SHA256
c52791ea485551bccf8bfa7ee5fff8b859d4edbed3a89b1aad93f84d8c92df3d

SHA512
88bbae09a1eacccb7d6ec13501377b3d080bddd2b3ed770429c67c457b3784014800b7e811d3d79a9be077dc2aaa646c235cef1d28c8817997f7484be7b4285b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
269469e1ea764f589f12fbcffb2b73e1

SHA1
ee1b66bdd4b1bf9d4ac14d8d0e31dd08be467f69

SHA256
3714e3e68b0cb508b01bd36d3e60e6d6cdf9c70598c975324a4a8b637703a0f0

SHA512
c961aa35723387ab2fc97515d58432196d735425b62584272f74c4dd91dc989fb50461cc5c2c87adce2ce67106f219c7ab9202205ec2e2da85e489fc76692141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
56de043f61bfdb3325c297dd38987aae

SHA1
04e69d900d2f4a906a4b14d5ecff6d1ffa1481d7

SHA256
67d5e42f3d8e7fa62666a4682a6084e503d1ed8735b17d8290c333e07f6f81cf

SHA512
f9c7f8335c462bce1f29600fcea2cc65323843349b2bdb995e8ede85260de960b60540620e8e19914c9264f153fa9ba07ef1778582e9c45a6f6c6b470044c37b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1fde25672f6926ceec1637857cee7d86

SHA1
dc9282b2db2f2bed7959c3e922ca69d1e3b6dd24

SHA256
072a3eab72113827f16be07d629cb34d18cdcfb660d5fe6de009b6fb573ce5b7

SHA512
e898bf2a7c6f68057f4f1c3d61bb23d30299e7acfa6ace4dc1d29cd97cfc331e886449a2a92716a92e57654d4f859c69551eb7d64a1323e56406db278a7fe3aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0cea92e26be8a8285c784e0b48aa9ee3

SHA1
73ad0db3e56e0a4b98fe4ef9194a17ce96404331

SHA256
dc3915c4ead5ab0e06a6ecbe5c7e4b3b9bb37d9460013c5c06576868623475f3

SHA512
dab4d1854e405d22f0e51e09fb3fed8fdd9cdfcbf92d60bb973451be0b49e19eec083b8e15bc888145994f679fbe140ff50d840b23fc6e3f735c7e6163ece827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
57751861e11a4f4d7fbf3df1f26647eb

SHA1
b06e88204b5bad8b4ebeb7a1c1d7a90be8f6b1d1

SHA256
fb98c10c46f1b4d37a43fba5ed4cde41b74db726cbcf024e691f0e78f10fec2a

SHA512
52c323069712d94f4625dbb1422f59bb77649416ca63e23d0c1a8aef727d22686ceee1a98d5aa4b7826af03e29fdfcab111b52ec9d127a88aba20cc075a8d266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
efa84e3a6d8cefa04fa20adbf27f6088

SHA1
245082a77aebf41cab0c21d744e1072f3eb08627

SHA256
411fb3408257314b8f5dfd1f350846b2a8c4170b6e288bc48f5541e44f76a0f4

SHA512
1ba69b4e88991a98705d9317da4bde4393e633c9e730a44e866b1c8ec7b42be1795e1a14897edff53c88f941b4dc76f16a0d953dd40c51b6d0b6f16876fad4c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e65adbab851fbb970a7cbbba4f3fd77a

SHA1
47bb4e45926837eceb8d05086fc60da90ded8341

SHA256
eed57dcc9f20e3f0b7675a6fe2b97fc8b3876b207cfb3e6ac8e878a1f7156b29

SHA512
1b278ec5f3314a8bb749ec0c548703a21419fcefc6ba9f82ff5e5e361ab337d764d05a47567a03c898c953d69a83dcb406818debf61299e052482380027578ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
56eaa65d8f1e34bb3fb4cfc92e823cbe

SHA1
44f51bfc4de315470a0f773a6ea695d8d417edd4

SHA256
a4c63f79543171f89bdf645619f6e8bced65181d768f8860084845827dfe1141

SHA512
1bc37f011447180d6652830eab50c40a4e4fb791959c69ea04f95bb035385b5ddabf80bb3cbc80f0a2ccf1da0aef9a78f5bb25b644c6c585bffe0d73a566b1b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
edb83e3a89fe49bc8c7f4d496fef438d

SHA1
ffc09360b4670e42973799e73696295819d65402

SHA256
6169802dbed5ee0976e6f1d0c5a799436a3ea15c9e066c9e3b0357914cd286dd

SHA512
d5d73726112b4dfbf12e2d28538d65b681398942dc50f35a37068aa81e0bffe937ee88b23c6a7f627c46664020667715b13fd66553ad2f592b50308c4d2dd394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
710c85bc413cc71f0795340f1b642fb0

SHA1
2307aa4569c428345bcf3cd5d748da3c0631a1bc

SHA256
c725184e8219195d0ae1d24c234f87bf620b1a0eb8e941bd4a5053b7d0e24596

SHA512
2400ed67d4851cccb791cef871cee13d66d449ae2afe4bdc0bcb45ae1c6861b3632365046c0554ebb2d38743f393b55cac23fef43b535aedc4f8a0396f89943f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
63a57201b4fd01a0dc23738c1bbb1035

SHA1
d9c1701d1ef34bdf11aa16dd162d53934f99866e

SHA256
1d03afa5051120c24f383a986b31eef2ebd65d6992647713aa3d9dee98d63ca3

SHA512
7c5b488fc696edb11336f02538b88431a0859feb859c031cb50b7a9f07a90e9b23ba2f719ecc1e73e71e803df47a01da0d849996c6704b5b4138f13657c0e261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5de0dc8e2cd7324ee3e2daa6bf159b5e

SHA1
e1fbec388bf0c7e077af670c5230000a4febd6dd

SHA256
ea0e47c736d7573e19b69ed7a33d1f1494b7fdbe5cbd79881f32f7667651fb01

SHA512
37c99c147e70a78a8dd6f9153720c69a08f52ce9218cf9346708e0c7d61cf08c07afb3f23d8c144f1294e30cd882f00dd10fa7626ec312ca21d0865a9cfeec52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dbb7825e7f2f8f667b87e15c7e4a0179

SHA1
9aa4779f7abe5686edf38dc5af9ecd300a978070

SHA256
32bf9156c5787a251768ebbc1204e93f3fb36d50d90cda20eb713f139c282882

SHA512
24fb56317e5b94d221da45d3740e26643af0d9778601d3efe0f94e7eb977ea2bc9d56190f0ec583f7f80acda41354de56f0a0ea4388d3d28895815061d0874a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90076f01b46f9d1ad8d99fecec4cd571

SHA1
33a50b374d9a28be076621d8e81babb583726829

SHA256
905abd9b5102bbf7d632e989ee68bb9de87d182ab38cbe73529e6edc4210824f

SHA512
daac414813fa9df1eb695d832ba0f59e4b55297d5b9c5fc0a863b33f01deea38a7fe71358745e15607093cf40e3ae4be88394d6194c25b40ffcf510b8d9edbdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
804c7eb96816c695eb218697ad9106ee

SHA1
da5162f6cbfe3f0e992bd039e2018625221165e9

SHA256
5fa0beaf64cc242a9cadd786422e8a46cfdfcb8f92c99e6d880c8bf8846daac5

SHA512
48f024d95770d6ca9d441a3381740cb496977fcc853646f6306106eb4af9cbcd04f5bd56bc245ccd152fce650423443f0eb3ef2af494cda8b2295dc0d60d216a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
83b5f0aacb95a52e02d31bf1f8e81fb6

SHA1
bb179a2a97239f5d921951c087cfe9b6ecb43dd9

SHA256
58e938edd98725b6be6cefc3496798af9ae582a6f6aecb75390612bd5885af82

SHA512
adcda5bdbc64278645033d46adc021b86183c65edcccf17807d3014ae215a31768cf0d8e018c4e51a822f5c274f5c10f2d332f837ef5c6ec98aef2ab08ab29c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6854e0b99a25b639b7d881ab4b57aac7

SHA1
c01c195e602e7fb34ff1e1bbb992d311faf6a2dc

SHA256
85f5d9cc66055977bd5331cc4da5930f52300713c971f742ddb991412cf434ac

SHA512
dd8fc5f553e766fb6fcffe95222c1cd1aad1f460ccfb26397b0e13a981fc645c22e8d1a7836b3300ee3092d4bb5b275f8ba5741cd65ff1ac5f3a9cdde23a0c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
471a248ef4321d0d7e4205cc2d076491

SHA1
5f09ac4a428007b25c7abffac34b5d72df1f1c32

SHA256
73d4e3b2be482c33d21dd264aa17f3b2cabf4323f4b94dd5942d45ae120edb8e

SHA512
d14831abc058533e37de5c60b3f299d4a8b439c75787e444b50a0dff3bdd8fd74daea1a41286754e9db4c3b3511c2625f70a4076858e0c06c8a3731707be51d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
a8c8c4106945ded53fe8de26a3bfb651

SHA1
b207d19e816a9d449de1098df8994b1073d1661d

SHA256
edbe8d893c98da8a0a3eceace4d18e2bc177ab52bf543c60ec675bbf65072bd2

SHA512
a6099a3f98662a8300a86a67095250f07150fc6c8956312ca06b05749a2d46f2c43bca6439edfc8c447ced7a0a09b674afcc115ae358b3b4bb495c5fe429ec08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8de960bdf5439675bf2b4c902af25ab

SHA1
906f127008eac901e8272ae26576f687f7be4395

SHA256
07af135544fe9bfb6afbb50f7ade395d48e9fc6349f72a43b1580684eae8ec7d

SHA512
e83b4f8955172738565eea46b40de83d9dd953090238afbc9faa33a2980535aecb74655597be26c23493aaf47c9ed253d837505eea5fe98cd33b0746b7def353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a7e57310807898e75c554868bde14b3c

SHA1
795e9c00361b56c631183d5bde45ee59f436bf7c

SHA256
65817075053c963b60724b908d6434b5a64c1cf1dd1312732831dc8653146139

SHA512
819a5450017932d8a1d9ac730aff2dd7840cdae712e1c9f9132b88e697efa6f0209b523e0398bd45cde775ed5f486966c89b23e2aa69c539ec92b885d7869397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d14b9838d0b864a0a79633c5a731025b

SHA1
b5e9c2b36592d3712fe1f09d953e70aa139891e0

SHA256
1573c5d9b6f14c885737d5c81ff17f0f1daba7e4283865f97cfc67cba640cb36

SHA512
255a3b716d0fa00d04e6b569a63d1190a3d9947579585914a3d630f4650758e5f6e5613d4fe33842cad885a09c14df9a73a3230aeec95a758e95e38aa22baf5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0228f11e9c2fd76cd795d19c33faca9

SHA1
c12f0849123c8e6f02e565ce41c32b52056d1c23

SHA256
fb5da18c57788bf209292f550f14182f766af57b18c44f7ce01a0e339d0fe982

SHA512
2d473a005bc5372aa0cac4dc60e95e4cb5be274ccf16c6c35fc9c8d59641c06514b1fe7c71414ceb0e430a3c6018945185789e4a852eed08473b7e5ad5057e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
42a7c2e69f84721aaa6d1b5d15bf1fbc

SHA1
e2378b62698a12ae47ea885de8bee33cd7d06ada

SHA256
290d00a97fec12c48bc205f5921d65243f7785efdc1b8067d553314d1866c5ab

SHA512
86edd85ecca1da81ca0c6346e14cf7923be1b6936c3667bab9792021c2e6a242fc0e3b62300ad401afc0217ba1ed7ae836206036fd0bbea3b6845ece724874d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7cc002053cee223b1f84599ba5376f1a

SHA1
5bb8573b13dbddc5d717447635c0067e7775ab4f

SHA256
ce21cf5da9e54de82ee4843aaa1327bd4a536b4b38b11269b1bb036fac31744b

SHA512
5b347d851f304b3b42545e290d197aec0c0904ef3c80c11710f3bac80106885e061bb2e1cd91c6985e116e97fc803a089edec5abe005b594b371bc3364355220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4b44f097cc31adadf26cafefda49dd4

SHA1
520316e7f2f99d83fb0039ca758f5da71efa77e9

SHA256
4450d4a4b03cb56a4aa2c7aee34ae6d650c90ccb77946dbe2bc3008d3e8c4ad4

SHA512
ed11ea6838f1d2aadf9b067e55238be05b3e79e29c4f2b38c68d2cf1666462b37e514801942bb6f303443aebc1b2799ee9d63fe751c422d6eafb28e8cfbf0928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e4dad77ee52e226a7fb37ffb1657f97

SHA1
4c53800a54a4c7712613466ecc795ad8d3ba6d44

SHA256
4c39c004e82a5e31c17aba6ce4ebed840137c2b4324ee2b52c0ce91a25f8b2e1

SHA512
075bd12807fe9650051bb1d1c9eeaf86f4fd5c0069c02703e4ea6508a05cdbac08b865be2ce55f3791e7afc68fa4354095d575ccdbf1d6ac72bfc54ebf34a640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79844cc5b39615154d1acafebaf61569

SHA1
6dd58b8484c86b76aaec957ad86b6b387b0b0ee1

SHA256
33124e2cdd118339cbfc82f34adf08dadc5fa81a1bc50cfe1a87edf738bb9139

SHA512
b3bdf0b2d26822d821eef84a929730755dedd9f66b34e7fc75dda8b2e8b1ef61df83934feaabe4394da6f3ae6ee235e072dfeaeac60acccc52886d8fc2d5caa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
26308a3b15288ddd33acc9666d5b9582

SHA1
cd07b00b0d0411d5a0d16a30c4f769add31624b9

SHA256
8be6601611a65c12bd5f6ebc7c6d38ff86582c577deb02322c67fa00629a9473

SHA512
1660598366259fde07ddaa9382615f0b18732afd723dc50860e96a2e19adea5b66f61686a3935e7638277a60b9b1ab7eb8a163217a3b9515b4478871147f036d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
329002fb8ad74030a2defcd863c483de

SHA1
df524d6ac12690a7779c08cb9f26a9db31fe7527

SHA256
e6318c5a43c650f954b387e6ab1e5cecc7030df85cb3821d38d67a99197a4fbd

SHA512
4d7398d4b3ffce1d5bbc03e37913e76773ef270fe32a47b30c9e14a1a6e321c99b9e78bbca21f774b2b1b154c6f6d9b3423823920fbf2c035050b64447928769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809ee.TMP

Filesize
538B

MD5
e09e4d443f6867ab6b7a1e7ec0ef60e7

SHA1
b66fc9251865c44fbbe6acb2365b6a2ea5e26204

SHA256
0d27e345fc6d751e4c5b1213a5483cd82b0e8675f0c41d4dfaab3b1d383d15d2

SHA512
94082a087036c21e2a43ef81b9f0094f1b09945c28b1659e2d6c9539bce7822218dbd0341536982489d1f22728b5c3afa935f0d1d3c483f75378d45b2a02b108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab94496fa663874158442c6f030b8b0a

SHA1
4e24184f678fc81d9535bee1bbbd636dc0aed865

SHA256
7efdeab23c57c9d69c6d73d74e9341496a93f32d866d5e51cbcb320b9a048dc1

SHA512
10f8efd8236bc0ab6e158882c2912420768ab56ae1613b46db4d6046dca25b86961778c3d2f3aff65d298b8516e0a80b4459f2b029f740c079385f420b6b9827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
07d91daee32ef2e4f0d52f038de67944

SHA1
4c2a9bbf9fc379fb3a2eaffeecd210994043cac4

SHA256
c91c61f28700c9e9c31309a659896a4847b3e057e855f4c74e4d4fd63fdd57bd

SHA512
5353c59e5848b8f235a11fd1132c72cd6ff5cd604466e9203089bb4262e5bb39cbdc7d6c7456a3f675ff6d94fa6b5200d1b1843a3927e139651ec512d823cddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e36202fbdace800b0c271b94b30c143b

SHA1
d12bb437075c46117219524f416e7f623725604d

SHA256
b06162bd0392b37e3fadbb777632483c16639af239045ca86bce05a927e2930d

SHA512
55e57f8100a2b06f6645a51759ca027ecb584a76b46fc85fbed31a402befcff9ee26f44feb675ae6d1ebf7218f0328fb7c02d60a4e4a9935ac618c286109a185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
842d80b100c069dcae3a9b82ffe91fa6

SHA1
eeec5b61095cce1edd3b325327cdbc27f6016058

SHA256
ccf8f92130884ef613973ea2a786d8273d608d8defe27c984270bb24da71c79b

SHA512
60c6d822a7cd76d77dc4c53956b08cfe56ded3148b92ce7918d5490f9804c7f6e07d200c419f0cc6b16afaa8b9b7a477c70325de0626e7127d6afcb0984d1f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
987a442d133a0107562d38ed1f4eb09b

SHA1
8ec41c54c0cafd28c6e7a62cb20e047acd1d69cb

SHA256
1583c957df7df5f42e9e25e1b494027ed63e4d4c06f767a52f20a2a2bb992dcd

SHA512
98dec4994c1cf1ccc928c61045c69a1664680d5c079d0dc51c7fcd2d8036759abb17de0a92de41b729ec92ec8c3768bb703c4d8ff64d7aa4dd66566705a906c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2941ae282885e4ffcd97302c5ad57b4c

SHA1
18ef6f18c7e949ce0336ef798e5a06a3594b8d57

SHA256
0e5f52fe7f7f119907404f84e146052a9f96562235e51f527fdbb61cb71e5e2f

SHA512
b1dcce022d7e3b5c55a9c20546ef3eab32e1f1a277ea2eb83dbd3af6df014e38c9bf9c0f5a82947992f1996a39152a4132e2b5a08aeae7af84ace2a81387efee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
61014b0be26e808fdc4565d42b73b466

SHA1
9215184980b4260fb8733899604a457015245118

SHA256
b4fdb10a31ba79301a864951df0c1e813e187ed76fd3f90dd4091b22f1a997bc

SHA512
a1fd3eb90df6f143ef7c044ce65a47fc46839acb16c549bb55046dd55e69c8b3564c3815710cb8d0f33b6504307df47ebb1915f2db6830af082637da6e1b9241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a88172e45ff507a681c7b712e4679b57

SHA1
9e18c1ddb9ca76b9e7bf21ecf71222f091cb9d25

SHA256
4e7e7745bb6dae889c7f78b82aad61733247ea7fc65bae1e561fd0cd14996147

SHA512
d83862d4cc814db49c3cd54f604ab4a925b6559f8cec58dca77e45e8f48cac93a6e03fae9f1f8cb3ec25ca53f3614f21bfe681c23ef7834745a8af305c33aea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7911dff39e581a306890bf4ff479a453

SHA1
f2320a8ac3a12ce7e4903f15edff280748a2655a

SHA256
fb9b3a6df5ff9cc034833b35af343341cb26d9f0b34b6712f751c80d46a4d429

SHA512
c4e9a2858767644d3b5f086088d28713a7d18e8b3b4050f3c2b42dca94d25601bd77f1e888e0e3cf22b314b3dff77e68c0f3c1c0d20c897aaa8b17152cbb8160

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe

Filesize
257KB

MD5
60d3737a1f84758238483d865a3056dc

SHA1
17b13048c1db4e56120fed53abc4056ecb4c56ed

SHA256
3436c29dec2c7f633f4766acaf334f6c395d70ea6180c0ea7c1610591d5d89b9

SHA512
d34f42b59349f3be1ac39a57207f616a44f56a6c74157be8116fff5df75275928065065a89f10bd79849e58b14d1e5e0ea156be5996ff8ca4f5d854e107c96fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kno8DCD.tmp

Filesize
88KB

MD5
002d5646771d31d1e7c57990cc020150

SHA1
a28ec731f9106c252f313cca349a68ef94ee3de9

SHA256
1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

SHA512
689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx136F.tmp\KillSelf.dll

Filesize
5KB

MD5
8b49e96b0bd0fe3822bd4f516ad543ab

SHA1
3d04d3a4377e2e1888cc2be333b129daa8d2894d

SHA256
c25cbc60ff1ccca811239655636717c9ff4decb9190a557489389504b248d037

SHA512
46826285f213137cedefe379ece413730a36dcde016e5ac114743cb011e587fde503df1d70ea0e6c4213993749ac4d246e4c3c980b02e01239b392d0f5892e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx136F.tmp\MachineKey.dll

Filesize
52KB

MD5
819265cb9b45d837914f428373b06318

SHA1
0725f84eba20acdbd702b688ea61dee84e370b0c

SHA256
dd2f2d8c0a7d767be40b0f83ac6339ec86068e4ba0f4cd0e3e5b99050dd84fcf

SHA512
ae4dd3f773568072e86e694c72a08d06b9206cb704a22ced1a922bc04a61a504aee67fc32ffb4d39f9e75f74c533d409756d4d953eaf9ab89cc9fe11f702b30c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx136F.tmp\Mutex.dll

Filesize
3KB

MD5
6899249ce2f6ede73e6fcc40fb31338a

SHA1
385e408274c8d250ccafed3fe7b329b2f3a0df13

SHA256
d02a2c0c9917a5ff728400357aa231473cd20da01b538a0e19bc0c0b885ea212

SHA512
0db15d8050a3d39a14ebe6b58ebd68f0241d3ee688988e1e2217e2c43a834dff0959ba050d7e458ab6dfb466c91a3109ead350fe58fb3daa0753f6ca1ed9d60d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
d480b2dfcee07e277da7b1ebd9ba17f5

SHA1
7bb31dcc72ac2f6cc78b59c7c94fbe66a806db14

SHA256
e030fe9b793cabeaa425a591ec9d30bc96ec5251c3c11b894981ddedbc836947

SHA512
78ac4c5c596ca401c15f6ebe3e2fa4c876f425d98b504504113f83a4a73fa739e7f09603026cf2c9283535421a4e8815c0e0f6b9afb2dc1cb30e8788962780f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
b394ef987f28a453d14f80a37672c749

SHA1
7e1b5ccbeeae2b50a0c3aa15152a2d1ed000fcf9

SHA256
31b8a789f95304a7c9265d418e8a9cbef8251bbec1e9b6350e3d0504ac7e5773

SHA512
f96d75fd3816b9cb0dbd4ef2dc838f538b0af29abf7612294583e4a17edbb5f4c46cacb02a707b146020c84ec3645c4f8909b84db724dcf73cae9d01b3ab4972

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
81950cb3a95b6d4b2def7f7834d71759

SHA1
495cad86cfd0a0267c658f7b1ba615fe21ac6314

SHA256
d8830534188b61267a09d6dcc5573479dc52206fc9b6b8fc4025a3924491abde

SHA512
626721711fe58b0eeb37ec976041d91461a062d4bb6f1a859a09458427b49f243bb9b5f4af671ed23cac37215ea991c530e3de0b6fabe52faa7ca3af7f5a6c02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
013b7d3d23788110ea33aead30d9c5db

SHA1
f3a507cf475d579c674505bf10e36274ab58b678

SHA256
35720aa8b7121885dd3cb6f23cd1e5b106d52a2a3a989216f6530e1a747d9d54

SHA512
9649237e39dd65c3c72972bd924fab54afe7a671921332b5565673124473cf490694164aec0ac067046fc2af84dde7a8af28279cc2c19bea646bdc27715af9b1

Download Submit
C:\Users\Admin\Downloads\Bonzi.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\CookieClickerHack.zip

Filesize
20KB

MD5
a7bcca47b5413eb92250a45f86d1ab75

SHA1
915ad4c18ae188da9ab338ced6862c4efb670091

SHA256
b7f82523253c3a1f18de5c649a96132820d89274cdf7a8c5cd3f47a79e76ed39

SHA512
4a666fe25bbaf41ff217a07bdd19fd9e2f57dba228511d9ae92d3ee75adaeb952fd91d4d4472e0c73babfb86806d54ddbe3d603ae124545b89ebdf570db19d87

Download Submit
C:\Users\Admin\Downloads\Fake Virus Alert.zip

Filesize
196KB

MD5
90c5365511c57f96c7661ac882cd6036

SHA1
7f26a53cee4f4b87d281e1496b052c850a630c17

SHA256
2ecda0cfe475f7dfb3e4f52412634603b9e3de622ac23acae618dedc3f5f5261

SHA512
715d9396a149be26185b5d032d5c438b0ffe94a1be1000cc9fb24ea63d3c2b7d97237a440f83328a4b2139d108e78419353f098f58f644795a88897a8dabf8e2

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.zip

Filesize
223KB

MD5
a7a51358ab9cdf1773b76bc2e25812d9

SHA1
9f3befe37f5fbe58bbb9476a811869c5410ee919

SHA256
817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612

SHA512
3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\fb96c92a-b088-4687-b47d-5dbb0ecdb551.tmp

Filesize
4.5MB

MD5
33968a33f7e098d31920c07e56c66de2

SHA1
9c684a0dadae9f940dd40d8d037faa6addf22ddb

SHA256
6364269dbdc73d638756c2078ecb1a39296ddd12b384d05121045f95d357d504

SHA512
76ccf5f90c57915674e02bc9291b1c8956567573100f3633e1e9f1eaa5dbe518d13b29a9f8759440b1132ed897ff5a880bef395281b22aaf56ad9424a0e5e69a

Download Submit
memory/656-2340-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/656-2288-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/656-2261-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/656-2320-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/656-2259-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/656-2260-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/656-2278-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/656-2258-0x0000000000400000-0x0000000000D72000-memory.dmp

Filesize
9.4MB

Download
memory/1464-2680-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1464-2691-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1628-1929-0x00007FF901640000-0x00007FF901674000-memory.dmp

Filesize
208KB

Download
memory/1628-1928-0x00007FF7230E0000-0x00007FF7231D8000-memory.dmp

Filesize
992KB

Download
memory/1628-1930-0x00007FF8ED580000-0x00007FF8ED836000-memory.dmp

Filesize
2.7MB

Download
memory/1628-1931-0x00007FF8EC2C0000-0x00007FF8ED370000-memory.dmp

Filesize
16.7MB

Download
memory/2964-2692-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/5112-1862-0x0000000005340000-0x00000000058E6000-memory.dmp

Filesize
5.6MB

Download
memory/5112-1861-0x0000000004C50000-0x0000000004CEC000-memory.dmp

Filesize
624KB

Download
memory/5112-1863-0x0000000004E30000-0x0000000004EC2000-memory.dmp

Filesize
584KB

Download
memory/5112-1864-0x0000000004CF0000-0x0000000004CFA000-memory.dmp

Filesize
40KB

Download
memory/5112-1865-0x0000000004D90000-0x0000000004DE6000-memory.dmp

Filesize
344KB

Download
memory/5112-1860-0x0000000000140000-0x00000000001B2000-memory.dmp

Filesize
456KB

Download
memory/5224-2689-0x000000006FDB0000-0x00000000708AA000-memory.dmp

Filesize
11.0MB

Download
memory/5224-2676-0x000000006FDB0000-0x00000000708AA000-memory.dmp

Filesize
11.0MB

Download
memory/5224-2586-0x000000006FDB0000-0x00000000708AA000-memory.dmp

Filesize
11.0MB

Download
memory/5224-2597-0x000000006FDB0000-0x00000000708AA000-memory.dmp

Filesize
11.0MB

Download
memory/5224-2602-0x000000006FDB0000-0x00000000708AA000-memory.dmp

Filesize
11.0MB

Download
memory/5224-2663-0x000000006FDB0000-0x00000000708AA000-memory.dmp

Filesize
11.0MB

Download
memory/5224-2652-0x000000006FDB0000-0x00000000708AA000-memory.dmp

Filesize
11.0MB

Download
memory/5456-2639-0x000000001BD40000-0x000000001C20E000-memory.dmp

Filesize
4.8MB

Download
memory/5456-2642-0x000000001C540000-0x000000001C58C000-memory.dmp

Filesize
304KB

Download
memory/5456-2641-0x0000000001230000-0x0000000001238000-memory.dmp

Filesize
32KB

Download
memory/5456-2640-0x000000001C2B0000-0x000000001C34C000-memory.dmp

Filesize
624KB

Download
memory/5456-2638-0x000000001B7C0000-0x000000001B866000-memory.dmp

Filesize
664KB

Download
memory/5904-2579-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5904-2535-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5904-2529-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5932-2578-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/5932-2536-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download