hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbHQwT2hRSERLSFVwSWlheU92Y0RuQU9PUmh4d3xBQ3Jtc0ttRVFNQW5TalRsdkhBalVIZW55c1lEZWRTZ1ljMzdKWW9xNTZneklTQklIZF91cmtoNnNmLVRIdWNhX0ZjNVd2YTdla2lLTHhSNzVZX3RybndOdWNkZWNRRjVKbVJERzVLZXNhenplSFZvWk5jb1NKTQ&q=https%3A%2F%2Fdisk[.]yandex[.]ru%2Fd%2F4kjP5TyaYnIpMw&v=Vyny2dyYHlg

Resubmissions

18/08/2024, 04:58

240818-fl6qhswhla 8

18/08/2024, 04:50

240818-fgnzxawfje 8

Analysis

max time kernel
390s
max time network
387s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHQwT2hRSERLSFVwSWlheU92Y0RuQU9PUmh4d3xBQ3Jtc0ttRVFNQW5TalRsdkhBalVIZW55c1lEZWRTZ1ljMzdKWW9xNTZneklTQklIZF91cmtoNnNmLVRIdWNhX0ZjNVd2YTdla2lLTHhSNzVZX3RybndOdWNkZWNRRjVKbVJERzVLZXNhenplSFZvWk5jb1NKTQ&q=https%3A%2F%2Fdisk.yandex.ru%2Fd%2F4kjP5TyaYnIpMw&v=Vyny2dyYHlg

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MM2DUPE2024.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MM2DUPE2024.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
4280	winrar-x64-701.exe
5016	winrar-x64-701.exe
6084	winrar-x64-701.exe
5756	winrar-x64-701.exe
4640	winrar-x64-701.exe
4528	7z2408-x64.exe
6052	7zG.exe
4964	7zG.exe
3312	7zG.exe
5616	MM2DUPE2024.exe
5504	MM2DUPE2024.exe
5372	Bridgewebbroker.exe

Loads dropped DLL 8 IoCs

pid	Process
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
3572	Process not Found
6052	7zG.exe
4964	7zG.exe
3312	7zG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2408-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MM2DUPE2024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MM2DUPE2024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{94753412-744E-45E5-AA5C-DFD89270274C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	MM2DUPE2024.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	MM2DUPE2024.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 569778.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 783874.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 305675.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
2416	msedge.exe
2416	msedge.exe
4928	identity_helper.exe
4928	identity_helper.exe
4712	msedge.exe
4712	msedge.exe
5240	msedge.exe
5240	msedge.exe
1776	msedge.exe
1776	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5872	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	taskmgr.exe
Token: SeSystemProfilePrivilege	5872	taskmgr.exe
Token: SeCreateGlobalPrivilege	5872	taskmgr.exe
Token: SeRestorePrivilege	6052	7zG.exe
Token: 35	6052	7zG.exe
Token: SeSecurityPrivilege	6052	7zG.exe
Token: SeSecurityPrivilege	6052	7zG.exe
Token: SeRestorePrivilege	4964	7zG.exe
Token: 35	4964	7zG.exe
Token: SeSecurityPrivilege	4964	7zG.exe
Token: SeSecurityPrivilege	4964	7zG.exe
Token: SeRestorePrivilege	3312	7zG.exe
Token: 35	3312	7zG.exe
Token: SeSecurityPrivilege	3312	7zG.exe
Token: SeSecurityPrivilege	3312	7zG.exe
Token: SeDebugPrivilege	5372	Bridgewebbroker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe
5872	taskmgr.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4280	winrar-x64-701.exe
4280	winrar-x64-701.exe
4280	winrar-x64-701.exe
5016	winrar-x64-701.exe
5016	winrar-x64-701.exe
5016	winrar-x64-701.exe
6084	winrar-x64-701.exe
6084	winrar-x64-701.exe
6084	winrar-x64-701.exe
5756	winrar-x64-701.exe
5756	winrar-x64-701.exe
5756	winrar-x64-701.exe
4640	winrar-x64-701.exe
4640	winrar-x64-701.exe
4640	winrar-x64-701.exe
4528	7z2408-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3664	2416	msedge.exe	85
PID 2416 wrote to memory of 3664	2416	msedge.exe	85
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 4852	2416	msedge.exe	86
PID 2416 wrote to memory of 5088	2416	msedge.exe	87
PID 2416 wrote to memory of 5088	2416	msedge.exe	87
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88
PID 2416 wrote to memory of 5020	2416	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHQwT2hRSERLSFVwSWlheU92Y0RuQU9PUmh4d3xBQ3Jtc0ttRVFNQW5TalRsdkhBalVIZW55c1lEZWRTZ1ljMzdKWW9xNTZneklTQklIZF91cmtoNnNmLVRIdWNhX0ZjNVd2YTdla2lLTHhSNzVZX3RybndOdWNkZWNRRjVKbVJERzVLZXNhenplSFZvWk5jb1NKTQ&q=https%3A%2F%2Fdisk.yandex.ru%2Fd%2F4kjP5TyaYnIpMw&v=Vyny2dyYHlg
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9da7946f8,0x7ff9da794708,0x7ff9da794718
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1352 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1280 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1408 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:5612
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,7325718865149028638,12616880312285883143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:3588
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:184

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5872

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6084

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5756

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\7c7e5162ce0e4397b89ffd34a72e30ca /t 2932 /p 4640
1⤵
PID:2156

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap11991:76:7zEvent14736
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap20196:76:7zEvent1903
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MM2DUPE\" -spe -an -ai#7zMap25799:76:7zEvent7806
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Users\Admin\Downloads\MM2DUPE\MM2DUPE2024.exe
"C:\Users\Admin\Downloads\MM2DUPE\MM2DUPE2024.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5616
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BlockcontainerProvidercomponentReview\C1o6obg6IuLvwsHHoWguXkGs5L9yuTY1gloU5PxoJg0pdJaoJVCxI9BLobQS.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:6140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BlockcontainerProvidercomponentReview\LdbM8AUhWyybGzCHUzdZnwTR.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
  - - C:\BlockcontainerProvidercomponentReview\Bridgewebbroker.exe
      "C:\BlockcontainerProvidercomponentReview/Bridgewebbroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5372

C:\Users\Admin\Downloads\MM2DUPE\MM2DUPE2024.exe
"C:\Users\Admin\Downloads\MM2DUPE\MM2DUPE2024.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5504
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BlockcontainerProvidercomponentReview\C1o6obg6IuLvwsHHoWguXkGs5L9yuTY1gloU5PxoJg0pdJaoJVCxI9BLobQS.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
43KB

MD5
e352d970a4f70796e375f56686933101

SHA1
20638161142277687374c446440c3239840362b4

SHA256
8a346ccc26d3ae6ded2665b27b443d6f17580650d3fdd44ef1bb6305bee37d52

SHA512
b2c95bc6a7bd4cc5ef1d7ea17d839219a1aa5eba6baeb5eab6a57ec0a7adbc341eb7c4d328bcc03476d73fd4d70f3a4bdec471a22f9eb3e42eb2cae94eeb1ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
1.2MB

MD5
0aba6b0a3dd73fe8b58e3523c5d7605b

SHA1
9127c57b25121436eaf317fea198b69b386f83c7

SHA256
8341f5eb55983e9877b0fc72b77a5df0f87deda1bc7ad6fa5756e9f00d6b8cac

SHA512
6a266e9dad3015e0c39d6de2e5e04e2cc1af3636f0e856a5dc36f076c794b555d2a580373836a401f8d0d8e510f465eb0241d6e3f15605d55eb212f4283278eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
698468db61d20730b3bdf727d59478e2

SHA1
3685f39f0526bdfb0e8fa6d391b99ab6cd3b8c7b

SHA256
c6cbe23b1fa1612a8525d02e4c75aecaf08a022e85b5277d756c1dc28ee01cf8

SHA512
4adb77475047e462aa724c01c346dc1de54c1b78476286b040786e2c377a0e674955d385b1a312293cf08e15f4759f7c14ec5e7d3d460f50d501f1fbb20f8438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
0e9d422a89eb5914aaf675f5a7d2d1d9

SHA1
434d8fe9f80a002dc95ec0b2eaa6485c7aa42487

SHA256
3b3e60e0965055b12f367ba869b6d93d8ded5d89b991e25a9afea7260021e463

SHA512
00a5ce4cafd1bf7be97a63501731ea5c5872b400f332480bf361166ccec9248b8ea29ea8d3289bc6e44c4009726f4d5fcb0a46af00f66b63cdc3d0f2c73094c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
369b28b92a836387e3866c951131175f

SHA1
cc69a46637626cd8eec641779dc6f712ff60eb5e

SHA256
9c9b574e142cdebace60e139a0dcc777185c069ba901a1eaba7d00128453873b

SHA512
ce07daf26e25bc5752b7d3fbcef1814219369fd0d95d1321cf08fbb9e05ec6f8391df86aee24066a6436e95c4d67f447e344a417247ca85080b186528230a4de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f73aa238cb80c663bafb3148e9f0bc13

SHA1
21e59a8dba3ee20041c36003482a91f14bf02cff

SHA256
47352ad500475770c2b76218c98cb79699ac4449223172c846a6f42da5b16fb1

SHA512
b7f02556f43cb7c556bbb1f495ee6de7cba0b5bd21d651e424f41c4185b07b92b3627b8e4dea153600aaded216e3b205c1091f4f9cc8a1b0f62b20dd784f013b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
255cd99c1eb205e6317de860004acdd9

SHA1
f5779ba01f502ed899d07e5121370bea839ab848

SHA256
104ba3508b5d43a4e47af400a352d734a2572b2a84092c4a3f39dac0f9d30ad2

SHA512
1d9877ba1fbdf1c0d02a8b5635f47f2281f4ad81c174bfd8bc4baadcd65d9707a91d49808f2a01bcdcfe5ff1babbf2d27e81fdf6e329165eef2791929604f8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c7b8fbef93f4d5ea48b0ab6499623de3

SHA1
567afd297782c388f98eea422046f849e191cbc9

SHA256
76133f2080128f7c1f443baa1ddb1320676251efa22f9fc4270ea403660c1bd1

SHA512
a6777412769017e2fca84dae7b5b279f0ffda2db23119e134d197fd66a09f042b2bc9612a9b893c0d4dd68241a090f84b3ed39b370bca7ca252f7fd770ecacc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27b87ca96db83becb453f61731d04190

SHA1
4a560faf194688ab8ba7727e41df8dc268d2b533

SHA256
d73159a09a9183d4e9d8405932f1e7c86efeb94813ce32bd843ac1d317f49360

SHA512
158c718d54ed2bed37fea0e3ea8fef0f8e3b3c650dbe6cb74f3d1cebb53e81f969d619f8f6d59f7025939be65b87e02f03f5205f342be276b79a143fb105ead0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0be9494512f1c3b150037246f756c228

SHA1
0cb3d80056eaf674a6a257ffb24114ea4ccf229a

SHA256
21a3a258178164398dcd9b1e1fb47897e492214e9adcd8c21c040c1b5d5af9d5

SHA512
a3894e015f7d6af5ba3f78275a0f56d9db44fb8fa8c674c70948bfcbe2f74e528ee4790262a6c0d2193f846658e09af8a2c8fb7995044a9eac5019e7b7a1c46c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b6095c74045b3628ed82e0d8b252d2ea

SHA1
35749e99dab47f875433184ebbfbd12223ba3672

SHA256
658f66e72340ba15af38eaa6e70b162730c1098e82400799c2846e6cad890edd

SHA512
5a59ce35605dbab1571f537b78a8d2996e977975dbbac9fc788ada188c23d0438f3ee4d141218e6f05f554f7098b85f78b80ca098cd3ef509c2c173c7bc04bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9329d2509e23a1c57b22c44d613b11f4

SHA1
9404dda780bd90faa56366a257b6fd4d487b5c9b

SHA256
b046247902f53ee216ff82853332d73af7e213e8ff1615dc79a026a84ebb85c2

SHA512
e10957f6e9edf3457ef4ad042ce77ba890d6d1ea7e07337158fa3c5a93e325889211846c815a41bd76ad85246182c7321a7ec2503534902bedfd919a0e9a8f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
72253ebc757ef6203fae7b3933dc8e68

SHA1
1588d73995bff34c362b24a31704a1025fd43e2a

SHA256
c4e41e43454cb2af463d5261cd037b1c5b86b7b627c9497ba761ea747a81f6ab

SHA512
0c099087ecefa5f65fd309d8914e2f763ff369e5643e85a7537761618a46af25f3c291bc4c023b88da302120b2c93e491f5faf58ceb22b4abc3897c9278c6927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9413c3e1e34fd9fbd6d3db3f5dac140

SHA1
835845a0c10dc0fe8395ebeb4a2a0e75815536f9

SHA256
441a88f60c30ba8d9ab8f897240ac29a55c3d21d25071b91db3dc5d1229e4280

SHA512
59a03126f8c51e86b14c75365dc6378f3f5ba73a5763cbfb458f21c6b89c07cc2f89d2c1aefc7a74864636ae40fa898b40cf38bdb05e739be6adee375435ccf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8ad3346cb57946ddf0519e06d484c75b

SHA1
59c081ceeffb94783ac6c25194c7d204854e9669

SHA256
007124861283074a8cefae6abed3ff292e73d963bd6a3e4aa8fad52a998403fe

SHA512
4d122ded41c56db544d5fd4855622e6563ea00a4f6cef4b7a9e06581f81c7ca8b8d744459e5a6f149ec41ff64bf1812132b3333a847904b77fc882861e1216c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
61333272d07297477f0953473f60ea06

SHA1
c9030cb735a6504e657e53b9bcfcd8e8b5aef8f5

SHA256
b16e9ba2487889832532660cd9b6958ebf7ddae32bf8fd0a48ceb724e77769b2

SHA512
708b5eef2f5cea03735c8ac600e3b825f566a3c277a5a72e2961d0e5b5adcb4b8b68fbb7d04717876ab93a6055aee3d34bd96343ffe626b43316d47b8bb1eeb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
471b64cbc859f51a34a513d620a68a71

SHA1
3d7f0f9a23eda806ce0d864dd50a83d49380fae3

SHA256
bde180ef5030ac1e3454fe421c17ba3fcfaebfce8dabae027db8f0e1944d4a29

SHA512
00e916503f4df8921ace984354d6cb2a4b6e052a79bf485492d4c73237c20c3232a4f38748e40792303baf0cc6c5112d30ad7d4cf492feb65fd5751ca85a941c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d62b8e66b2b9f124883b0df6fda313a0

SHA1
39a572de46b797393aa2c4d0243cf81b403c11ba

SHA256
233f24044424633d0347e3d4dc1d585e166e0b30adbfbfec5ac664a4d792fef7

SHA512
1ea0b3df9d61325aa587bad105ddeaf21ade2f509e1d927aa6b2d6ff654ff114d730c792c11d0fbcf0158b9b7e06e1322718ff9a5b9b412d0782024513516619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582268.TMP

Filesize
204B

MD5
59953562488b9658f757723567979486

SHA1
1eb4861d8b13a17e326b7ca4c76944ff61c05fe5

SHA256
be0cb90cab8929dbf5185acc9523f7056ccbfcd68446c658c22c979565127c06

SHA512
26ce30b83d30b0a916e72dcbd483ff2dcf9795441247a9c66717464faf6b2da63b362ad1eddde6ce102dbb76f2c4c57358e2864f17397a81efbbcde7fb4ec5de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e40d973ecc9c70468914a54d0ae993f2

SHA1
a1b0b81bf22f584453568ed8989a236e798ee4d4

SHA256
20b1030bef122b331cf5be7980da8089d78af455d3a9437c582dbea7bf9775e7

SHA512
67c20f529150501d9a6263e01348feb4938823358af0701a150605b6cff597e41ab4c13b207311133e7cce841a5be64acb4c097d1c807347b0f5556022537a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
07d24063d017b329a3a6a79198e3cceb

SHA1
4d761b5bf3b7becdbcd2dabf03db9388512ebd85

SHA256
cf341edef801ce2b9515053be1e04acbd8641e803bdbe6cefc43ee6d9d698f5b

SHA512
0d053f4e6e63496f1494238b1ce2960dc7db1bc9931fdb0be7a0b6fd741e170b8b2d177b09b5583df998e66cb8b46a325de3cb25735e1c141f0658c36864ad9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
70f6b6dc95cec5918e8dd658bc99504e

SHA1
d654b96d74fbbe92bda48966e6c79f3a768d65cb

SHA256
001c8f892a058b971468c41fd2bf5b81cdffd39805d725d74198e3f9d5c336f7

SHA512
dc6983f6d534db693e930ff17fe2c169b06afd9c4d0714725b7a367cbc45a9f10d54473b29ae2f669b00736a0c051231c2bf1220b2382f2356b0e5b2cdeb9d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f15a1d828aea10406b8d2201c7ef688c

SHA1
aaff7be79c069a0403023a4f494288ef35a8c72b

SHA256
143350bb51d95e618e76ffd6c12ce687cc17a22f6870598a014e27766439bf9f

SHA512
3682d4663c35b87470cbd1d5525e99af65fcda070fa5e73cc56933d2d3ea81d34d6104c5f5532a8065486d6f1fb71044b85454c7fa9d662fad82798f56ff1cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
406e683ee84ae3dacc27aeea0358a748

SHA1
bc03976d3410c2cd2a248f76edd1c9064a86db71

SHA256
545ffd23c1df082d5408777c139467e1702bd2d75d4cc99a47cda2b8261feac0

SHA512
7eeb7c271b132aaafd0662f39ced4000e5ff251461c0b0af599078706826058503229e4ffb7b28807efd369796b61e3ceb3ec63620fd572acb4f456a4dc0961a

Download Submit
C:\Users\Admin\Downloads\MM2DUPE.rar

Filesize
1.4MB

MD5
8b282fe5836abc8d1b45fbf965c4cd04

SHA1
3fd24b189382e6138f70f31f4d39fdcb88fe5270

SHA256
a2852bff75818b7f007b55f6eea8798a23d2f1bd237213c1e350dc60da097ac4

SHA512
9b900c21ada6f486b544bb228e853e5766830e76aa598bf09156baee579eb62a620da740e50862d205063375ee33d514e6c906a3a0374dd7b593f182ec8d631d

Download Submit
C:\Users\Admin\Downloads\MM2DUPE\MM2DUPE2024.exe

Filesize
2.0MB

MD5
c9989b190a0fd69d1845d3ade254bfe1

SHA1
b0c25f9a9cafd7a8cc8cfce97275b6b02d20548c

SHA256
807ca2f242ee9c20c7aff366c381a2929ca8b0dbcaae89628200c6c11c3bbe0c

SHA512
46dc363a704617289f41834c4752e237d79538cfabc1f70d39dc88d014608faf8a8a3bbdb2641c4c8a33d2ff87e1cd80da580214e656a0fabb200624f8750fa3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 305675.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit
memory/5372-1150-0x0000000002B60000-0x0000000002B7C000-memory.dmp

Filesize
112KB

Download
memory/5372-1148-0x0000000002B30000-0x0000000002B3E000-memory.dmp

Filesize
56KB

Download
memory/5372-1146-0x0000000000860000-0x0000000000A1C000-memory.dmp

Filesize
1.7MB

Download
memory/5872-503-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-504-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-496-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-497-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-501-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-495-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-507-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-502-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-506-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download
memory/5872-505-0x0000024790890000-0x0000024790891000-memory.dmp

Filesize
4KB

Download