hxxps://github[.]com/pankoza2-pl/trojan-leaks/blob/main/AIDS_NT[.]rar

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/trojan-leaks/blob/main/AIDS_NT.rar

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4748	7z2408.exe
5276	7zFM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
66	raw.githubusercontent.com
67	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\7-Zip\7-zip.chm	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\it.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lv.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ro.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\readme.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\bn.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\co.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ja.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\he.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\th.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ug.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\id.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt-br.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sq.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\cs.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hu.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\kab.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ne.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\it.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ps.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ta.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\7-zip.dll	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\de.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ms.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\7z.sfx	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\az.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\es.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ka.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ru.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sq.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\co.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\eo.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\yo.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\descript.ion	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\da.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\es.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lt.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tk.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7zG.exe	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\hy.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\nl.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ar.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ky.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ru.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\be.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\yo.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fr.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lij.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7-zip.dll	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ba.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ku.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\nl.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\7z.dll	7z2408.exe
File created	C:\Program Files (x86)\7-Zip\Lang\bg.txt	7z2408.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\br.txt	7z2408.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zFM.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{CE520E01-59DE-409B-836F-FA4C19F04114}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll"	7z2408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 323531.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4640	msedge.exe
4640	msedge.exe
3396	identity_helper.exe
3396	identity_helper.exe
2628	msedge.exe
2628	msedge.exe
5424	msedge.exe
5424	msedge.exe
1144	msedge.exe
1144	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	5276	7zFM.exe
Token: 35	5276	7zFM.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5436	OpenWith.exe
5604	OpenWith.exe
4748	7z2408.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4960	4640	msedge.exe	84
PID 4640 wrote to memory of 4960	4640	msedge.exe	84
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 2884	4640	msedge.exe	86
PID 4640 wrote to memory of 4388	4640	msedge.exe	87
PID 4640 wrote to memory of 4388	4640	msedge.exe	87
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88
PID 4640 wrote to memory of 2804	4640	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/trojan-leaks/blob/main/AIDS_NT.rar
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ffcafda46f8,0x7ffcafda4708,0x7ffcafda4718
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2364 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Users\Admin\Downloads\7z2408.exe
  "C:\Users\Admin\Downloads\7z2408.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2629682826471397380,16792615562677605311,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5604

C:\Program Files (x86)\7-Zip\7zFM.exe
"C:\Program Files (x86)\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\7-Zip\7zFM.exe

Filesize
597KB

MD5
f4378a6d33895e7193c02d30fdfc555a

SHA1
3021cd88b70a371e1e688d0dc448d33d05f799e8

SHA256
8aec21c22111e1bbd955a73e9423a11c2d70b8d6d75f5fde9a89a0e8304c3d81

SHA512
2168caaed04ed4a3e4f360a3eafa3519a91f31fda95140b37e44fd1759b3f5a07e09c3c8ba70e366784e700970843afd69083238e9aecac9a6106c4fcb19f809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
41KB

MD5
c79d8ef4fd2431bf9ce5fdee0b7a44bf

SHA1
ac642399b6b3bf30fe09c17e55ecbbb5774029ff

SHA256
535e28032abf1bac763bffd0ba968561265026803eb688d3cb0550ad9af1a0e8

SHA512
6b35d8b0d3e7f1821bfaeae337364ed8186085fa50ee2b368d205489a004cb46879efb2c400caf24ba6856625fe7ee1a71c72d2598c18044813ecde431054fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
1.2MB

MD5
0aba6b0a3dd73fe8b58e3523c5d7605b

SHA1
9127c57b25121436eaf317fea198b69b386f83c7

SHA256
8341f5eb55983e9877b0fc72b77a5df0f87deda1bc7ad6fa5756e9f00d6b8cac

SHA512
6a266e9dad3015e0c39d6de2e5e04e2cc1af3636f0e856a5dc36f076c794b555d2a580373836a401f8d0d8e510f465eb0241d6e3f15605d55eb212f4283278eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
70bf88134ac2a71e6c6332bacc2f5c6d

SHA1
3bbdf9302317db33197b88b4b0e5387cf6dd24f6

SHA256
941927cde74e21c9cc296603d619f31fcc1f9c6b833895ee2fee7a5a93a5c9d5

SHA512
91a8f2abbb0c13c09b12861b710cd0f5a70cb6c43121677fd2ce4ab4a6345641beca5299e417b609c33404d055459f8cb83d5191bb5a07285eb3b7351116c611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ab2d8e03175b8e110852d06419146b98

SHA1
d0f3b59e172ccc64eddba5cbc4e26474d1257d18

SHA256
ab57233769179c4890dad319cbe32ec78ddd2cbe1fe39ef0bb90968df1cffdc6

SHA512
004fdb8c85f0c105b8ac56bd840954d1f92434b2aec5a0612717edcd449105ed74109d3cd6e98a404723765c0da02759ff3b1934c200aec2f17815c2b00a0646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
717B

MD5
95d72dfa1ab3d0e67f60fe411d1a49eb

SHA1
67c8214ed8c147849e7489cf5635972e1bf42eb0

SHA256
be32e4f04cc3a98078bc20e46fe64e47dfeedb3d4845dc71b08fba0aa7b04b1c

SHA512
dd9c73a3841f223ffd6c232f9dc2f4c899600d2c083d96605bfe2a75f27f41f46d7a0a545a0b10556b6d8c4210f17f1995575e030890945dbaf232ddaa9ee44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
aeda5d51ff753a7ea2536d2977c75655

SHA1
726cbdf956d70785de9befb18ea5578ea64c50fb

SHA256
44f21c24caaa42753b8cf278799654f59ee91a7f3718f9e92e136714a3115f80

SHA512
a4e7326839c4a93368ac9f83afe80943616aca14b4e89fd12ca259233f2b962acf93215ad222e6f5361bafe987080085a354b37d7d109bcda34ab0c198a74121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3cc7ae3e521475d429c0fe204a1577e

SHA1
bfaa760343f591853eb543b6f4c5a048d47d7e36

SHA256
5abb3eb0900be6700ea22ada097459490b0f50a46ecd5bcb39a6d31a945b8d6c

SHA512
d52978cbde6775b8cb86372f6ebec4335f980223367a461b6cd6b81886db197d12ba8fa59828bd55fc75b3c68f8b58cd2a6d7e0913eaff24945ac62619411c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4a53576b741610fcf82778dc63a5c87

SHA1
cf3f88afd7017aee3b34bd9a9c046b2927f76b36

SHA256
d9ea74fb1db26ae44448323c5b596258fce7e536cff4a88a2ba587dd84b7dc9f

SHA512
c489857e68494e08eb8bc15c9da7e83a4fd17151aafccf05e3c30da61d582185458e489aa09efb3eb71ca209ec04eeb8bf4cb795abf5d23e78dafb9f5b1da297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
258a3718496e56b0ae87bfdf8e02d02a

SHA1
665e85e0056946345c83c004f9d0986b10fbba91

SHA256
993a3028a0fb9e2af67a27afe111ffca5fdddcf7023c4b4b7dbbc51d501321b8

SHA512
b359a4c76ae755e6327b47c5cedebdf89991c3da779c7a9d37b73a9bead0f55360760d98e6812bb15007e0ea0bd0e8255c00b963c26342ac0bd60c21109a2067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4659d1d68badea121eb0606c09c799b

SHA1
b4f696d21d7785084b85abe8c90eccb1a7fabd82

SHA256
3d3f7acac0004ea79553b49b767030227f1e912329a7035c4297871b1266faf6

SHA512
41234c11da56fa2faefb3f196529fb5724dc3fdcb53efdd11e7ee4e3a962a36cb858a233061504f19d83bce85ea030e6a74510e3912de81c5998d5947658bc31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
87fc2194cc3847011be26eaef0504cb9

SHA1
1337f70ffeb2395355feb048c886210cab5a431e

SHA256
05fc2bc7bcd4bf24c6d903b2eec18c10d06cec3fb1fc83ced07c156d6c8e9b55

SHA512
6abeebd3610ff1b0fdc205778736e43164ce88636251a4c2df31a5652a2f747460649c323886a6e89a2cd221c63402980b6f5c960761793adbc9b920e13d0772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c4cb5cb5a1a71c3704a5704e146ffc09

SHA1
8e00e4394bdf937f1c0d3c64805f9525b1d68e96

SHA256
d2505a7e8894f00511178f8372f1958bcac983dcfe21905de5fdd72973395560

SHA512
aea0d3e7ece1369834a3173d04fdbad549a6b06bbe52464f9157445210e0ea7f7cb1ccf51932fe021bf3c2317378b27cf545061a3f3a246671f7ccc3999c57d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55f1cc56e04643434a512b66490ea682

SHA1
ebe523f0d6831f9f057fb5215ef485a843dc29db

SHA256
6f0ea59f1d9d864ceb9c430a162e1bf1fc40570f6e989c07e719707e61562e52

SHA512
658492079c1035e8ca0fb5daff466917fc2818c21f6c892b0961ede952624f07b3f9d4ffc4568bbdb1d7e55816fec0812a26842abd58f1aea37bbe14235466a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c2e45f5d76923868444f14781902bdfc

SHA1
ee3838aae5069dd9e4cdcd3b0a50802e6a1120c1

SHA256
0b972d89e00e80e4bd5f7e357278471041003cbda884b9fc0272b61fce02ba27

SHA512
8fd3aabcefdb7d5243190be49b047a413e57d7a38848b3694a857b21c88759b2deea78b31be6b1b63ac73c33978075826f2a6d18668860cc7ab3efa77e0896cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c7a0.TMP

Filesize
48B

MD5
8e9bb75d5dfb021b45861a83a3ab8fe2

SHA1
37732b0a3641ae9a43c99d742e4dc4c13a3529ec

SHA256
0d2b6b118f55c85e4dfb3583020e23ef0a9f71d9a767fc6e61f8469abae7c120

SHA512
3ac32df7355f7acbcf3589e7650ba624215277b374db8e1ce49a35d79bbd1321d5b1b3c62b77ecda20fb1a90e4b69b86a59a577189e0ece2b8a3895514cc6d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ba345bba0abc076dc265868f31709400

SHA1
c79e720460a82390cd06f6a4363f067b2fc39c6a

SHA256
a986d970f2c94aa8c77833f03b3d8062e36e022055c816d55e1fcda9148c11b9

SHA512
bbe3c83686c3ce26203b198e1b6a8f2d3babe67cd022e51b26151c413c66f7633483232f30e8ee605b213df2d3bf7d97c63c41a98c9ba151afa9dc12844c0169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53e49613f8e602e6be42cadce3ab68b2

SHA1
36e20c73a9273e52fdcf54391a8f457450643334

SHA256
e44e666fca666de8a510d9908b255ba5f311d77173b5cb9d22c911806f6af1ce

SHA512
2a78710b82de79f19cac6df2be598b0715507a557524045fc65dd412a3488a7dce55aecea4b09d413868a039ae48b8d5ca542508dcb4166fbb0b3b14b4090e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fdce77cf365722f87df26748265d5e3d

SHA1
c2406ef2508e85fbf3f75fc89cae73ee34debe9d

SHA256
10f041cbb3e21d4d65b660da6569b1e0c596fe4282dcf3dd219a07301dda048e

SHA512
1aca1e6b64ae36f70c66bb09c7ea7982d2e958d39375ee8162485392b52e6a3a762271427f49969ba799a016da0249a89f4946ea4d12ebce99e6099bc1b70af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c163576fb55eea1518aea823e1350cbf

SHA1
c306e6c3bfcb40f1ce8f1bb3bd7be49a31ec48be

SHA256
9f85dd91d08068a00e328e718f4f197c030067d84814fb96ba6c6d70541020b4

SHA512
c0f838745cefd87fed5a1e1418b3dac8c80c8c075e30a57bc2fb45a0fe0181aeeee316779fdf34cb9de8b0c3e4cb6e8eef6fcfc55d22cf03c23078884931af14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a09863274498b33c5ec90aa8db3d5afd

SHA1
6c4968d445d3944194ebef1c452c5c1b422f4985

SHA256
8e49494db4f394ab1dd2c2964456c590cba8b54fefbec632d726f4b48ceb8446

SHA512
8fb0715531dee06063c150edcbf2992452d31d4172b3ac462809dacc88ad09e6d90ed630aea76e6c25c19c876577f4bee44e13cadb57568981c6e40bfc77f355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
ad2648b28b66a1fe44b9ea1b4dcbbdd2

SHA1
20130ab81fa1395e1dab68373184e196e0c1d424

SHA256
23aaf7df115216b11c106d77296c6b8f4035325d0f5c2cd1d41fbeeb169f3724

SHA512
e3ea539574ec8d7bc6c3c32b8d3c2cacb3e93427f94ffd663cc5c73d297220f348c88299d2ffda76b68b2affc657b1896311fe7309ca900e7cc3d9fbfb8a4e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cc97.TMP

Filesize
367B

MD5
561605bed93141c3ebc7fb51caf96b0d

SHA1
37c5347df92b240867bff77a25d9b7fe380e32fa

SHA256
d62877bb05a1f21035d5649244e469c2676734493d4c62fe45e2bed08a387e64

SHA512
c64724aca4c6de3e64e778f7403ef83278e45ad8591d3a0dd6b4e1ef27b98dafccf3e1d150c79f573ec3fc9cf2eb942fe9b186a220f53e5c5724a465da0dd3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5ea5be622cc04a84036e10af779bfa7b

SHA1
b555756071473276aea33312314f9697dbe8ddd5

SHA256
662e2a40a883f39e7e6e05ce58088d75ee708a28dd3e28b4cd344c5c3bc34296

SHA512
81b2fe275e68b55cccef0231535741c8ecb945ad98c686086ad7d986bcd3aa84e0752aef551aa004977968dc787b8dba04735a9d4737d13a69e6030a77500e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62d7314baa213d4f8dd7149053261054

SHA1
40007b926b4b8a8fa0edc17e1ea26ae6fd95a539

SHA256
c7d332c2fcdaff78225fd3ee474790baf914d0fa227c6bddb6801ce615c82e3c

SHA512
bc5720c1098738d5a54e91a060b90a2c111d156cafdf4d66a65865b9337952c10a1c098fdda7d599ba5194d464fbaf5579e725b33c1134403ba928581580edab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49c669a748e673e0dac259d7e66ca64a

SHA1
232dde5b0e1efd310245f76d134852012ccd96bc

SHA256
382b7923208c802ec02f2f950a7f6853ad94baa70330c8c335f4310784127ef1

SHA512
21b73e7e24617b848dc6fb777dc86a4a6e631e385c4ab49bca3310ad607364af8978f2b1b20c1785701f7c11046e6f253079af8ca95c831ebda05c79c91c15fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0a0106c72abaa566db06a4f0d4a6df50

SHA1
7e5819c8011160203cdc6c8c9e0f58546b8cd7b9

SHA256
58744493f790b15019523c9e4823ba96538a9d47a97f3528ee9159446aeb4e68

SHA512
f5db55e998cba51252a192320a325f6bee718888b23680fea06b794ea384b89e7680abd4329c2b9373081a14b8c9b11a5dd8d9b4ce7b8a12940dcb013ab1c887

Download Submit
C:\Users\Admin\Downloads\AIDS_NT.rar

Filesize
634KB

MD5
6130816a444466d3ef237bfefae80c2c

SHA1
bd5e7be0fd74d424191cf9dddf0f6b4e0a2871b0

SHA256
52e0a1c02a0378774da69231586464c8c9fee1b36575786b5424fefda2f90418

SHA512
e83d352d104eeb89731bc0578384b5265b6270169aa4d198567f87334114850cfd453963891b47d581948a7d2d0e9ba511c5c01b7b6d6835f1b2ca376269182a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 323531.crdownload

Filesize
1.3MB

MD5
d646419d462f0206a3341aef0aa5e3c7

SHA1
eb4b809bbf91804e9bb17be36e9469818601ed91

SHA256
faa87251336d864b877a5e6c3e9c9a5e250318be2fdfc8a42ceadb3a956e0405

SHA512
7f6c46c780fcb5fc10cc5405221179ddecbbb871c578ca3d9e3a74141271b383bd83e8f9d75c98d7e9d406e9b935d52a6b04913d654169e0b30f0719225e7dd9

Download Submit