hxxp://roblox[.]com

Analysis

max time kernel
159s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-09-2024 16:18

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://roblox.com

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4432	ArcInstaller.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ArcInstaller.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Control Panel\Colors	ArcInstaller.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "225"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 872522.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ArcInstaller.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
1400	msedge.exe
1400	msedge.exe
3988	msedge.exe
3988	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	ArcInstaller.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4432	ArcInstaller.exe
5080	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1016	1400	msedge.exe	78
PID 1400 wrote to memory of 1016	1400	msedge.exe	78
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 4180	1400	msedge.exe	79
PID 1400 wrote to memory of 3116	1400	msedge.exe	80
PID 1400 wrote to memory of 3116	1400	msedge.exe	80
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81
PID 1400 wrote to memory of 4100	1400	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a2eb3cb8,0x7ff9a2eb3cc8,0x7ff9a2eb3cd8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,9023534915226682096,1628275752610520315,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004B4
1⤵
PID:1476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1744

C:\Users\Admin\Downloads\ArcInstaller.exe
"C:\Users\Admin\Downloads\ArcInstaller.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4688

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1744

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2280

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a38055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_FBCEF2048DFCB4EE55D00BA204530C64

Filesize
1KB

MD5
553c1c0b6a2168b7905cdd2fbe2dd322

SHA1
b0a482a9c81ea29eb587b76a3412884ef6d8ac8d

SHA256
10d0eae6779dff334381c3a5c139297aa835008c0e8730dd298c294ebbfb4916

SHA512
669824c581ca2e99deead56e57e5a87a8780ca1c5ab6d77b8779ef0dec5bf2c841541fc1899b2a09910d041504cce1179f7bccafd02766d4247cd5c9459f62b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
8efc4d78abae6d0581c60b38e5dd91c8

SHA1
4188c19fe28b4422bda662781a91cd8869d20c2a

SHA256
73a75cbc52ba483ffa609908eb2a826c99efae7ab3993bd78f0bce4066f940f6

SHA512
92b70cde40df338c88f0c65915b1aafdb6fe3435ff8d02ce9c836c7939304a4437daf8a5c921e8788c4862435bb0e52b2f60774d6b6479c09f75822b2488f482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_FBCEF2048DFCB4EE55D00BA204530C64

Filesize
536B

MD5
60a41479546edde57dfc21ebbbe7edb0

SHA1
f9de5889f91efae32c3da6840ddbe257b2c1fbc3

SHA256
3181e9ed757e98c5389f1258a97177a244da07546dc0f7fd9d69c270aa648f8b

SHA512
ed32bcaadbf213e9d638e987b82ff42170af134b4483516f5ef774d484a7026d2e7c5638a52a180838755fe486381223af55adabd65db77f32966e118bc4acd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
d68beab74d43579c7d0e1d89f8fd3b60

SHA1
f8bafdef6106aab6982008c8111b9d0edcc2ee71

SHA256
b8e87f66c1735803f6e2e50980434b1cafd847246f12069d3612e7790ed10df9

SHA512
c1b24e5fdf44ccf62ee030c7cd5f866d60fa07893336cdb52327e8dfe288b42c9a782b3e94339194a7da9c1200f65c119b6508d70051bc17f33d940279a36240

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\3htu421o.feq\4knki3uf.iwn\Publisher.qkouhz2ds2gk0w5435bumkcrozad3zua\identity.dat

Filesize
2KB

MD5
a9687a21cdfe5a1eb84d2cfa4ddb7874

SHA1
73b9e2a1d7cc8881caf20db8eeed6204f8d46063

SHA256
a149fc62021d8db2acd3a1ab3f9486898d59ef2c21c950c8e52d98164e172e74

SHA512
030fbfb676ea727409d4f18438989c8039565f2144efced0ac22c68951946e64c85bc0c38e876081c35123d3d5baa9647eff171e7a1368832a04ad1ca92762da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
671KB

MD5
e9134332d28ea5fba4b792cfe7257651

SHA1
b8b2bb69ed9229f7f0130046639708dd2566db3d

SHA256
c85d3f0641426066d7a1fe7f9fd11478af8be7a1887599c86acdb3eac0c88700

SHA512
247321aa2e9542e90b9438510bce803ffb73d075275f88bbe42701049c9e7e2d7c54c15f545856a801a242e497db759c4a0e5a6ceecaace427d7c517c7f4736e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
767KB

MD5
d409dd3fa29593b44e36e3cfd33a8fd8

SHA1
93a77d50a58b74ae2e8dd8a0fed85bebf57f8cc8

SHA256
aac8a8f1d0b6cb230ada3ab6437d6c419c7320fd2d066ffa73afa17b770d7c8a

SHA512
96402cc94e204dfb4cedb18e10f0451e23162d3c070acef9099f223a1a4a8d59d02a248c8281af8c5bcbfbcaa7a808494a4ec61971c7f9090c5bd4326b45dc65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
799KB

MD5
6bac3d39781ad7021b51459acdd6c3e5

SHA1
e44b716f84a7d207b8e569d04f9620a50fe55846

SHA256
2a31e055a22a1ae194b6c3749eb6792f0e0531d7ea93de7bcbe8dc96fd400369

SHA512
3eeeed895412240618cb9c86ac755a203a056bce293273e61518bc4e82ef2a8c44cfc28ad90d7a7432d131a07bef5ccbf5533e758cd9c230a11a053fdc8e7cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
783KB

MD5
f0b93bbc51b6ceb7c647025ea21290f3

SHA1
71f079f6b3015da7f75f4e30c4a357c498a2cfa1

SHA256
6c2f2ddc04411a145dc3ee790397679294d0a05705afbc514d9975298ee25d3d

SHA512
95386521bc2817d2471609dbfb6cf0c0fae499be8e3518363c919bcfd939a8e013907e6ca36f30593d1e56d704aa497c782298ec4279f1d84ec55ddfd625e831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
1024KB

MD5
f9a4572a226935dc015f442e0c73a7d4

SHA1
2eace3e46c8440993e99d2968b0447bf7cf043c3

SHA256
7ba768dbfd5b3d978ab8b18e8ca9a7b2e40f5ccdb3c9f031f08425e349a15558

SHA512
d4eda724c7e83dc5fbd2dfbf7969ecda7c3203fe12ebfb3b17efca0d0cc3e715ed1d76e67dcbc5ea5d0e1beb42e23e074cc742c481705dcfdb8f68c45e83dddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
1024KB

MD5
ef492a5cc7eef81b1d0d2a499ca71a81

SHA1
c81120fbbf029afaccb66153ac7a83da9ce4244d

SHA256
db48e2c97a0ef06124216cf8e1784db7515ff4aacccdbd0d137327c165d78701

SHA512
4d8b9adcfb87e54599f52ba030740700fb15aaff1d5a47dec0a51a4c55a43acc565c8bce80f75218253522f0d2af1d71b70dc73fb9b28631c8769cc18984d9f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
082995121e337c823beb05826f50e69d

SHA1
ff40a7f856aa4c9c5eb0f6280491a870f9eb9e79

SHA256
ac5a7c0b00e80249c6cb2d39483dc6a00a3dcc6e87e8c6db5ec54b4bd94bc29b

SHA512
b76a8c0bbe8fd4d8ba287de96db5ecb3feb65dbeebef02eb119c944172fd3d19c34fd8d372a2a3ae72afd534ef59f5830eab4827348692f5230417fbcf41f8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cf093c30c9833e11f7dea1f9e7500594

SHA1
649d31c1374749a30eaf94c1fcd8f1ae09ebf0aa

SHA256
93f2e65315368799142415cb1010549fee06fed9886c7afa637430cf35a89643

SHA512
51741ab06c13fb768d9d4bc562e9cf9fdd93933e67cf45b8dff4765a26be424d9b6def7733482434ee15cc29e376792a771829b43f282cf46317c8e428bc6898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
824B

MD5
6762f0f7ead861dc23ca39b3f0a22c8a

SHA1
10f79ff801b3060ed3e8a892d44864b45bb97775

SHA256
6a6f19d0c5c0fa4cc8195adec20273b9c2eb3fa111be2f8fac044eec0ae5c4df

SHA512
9270b5bbf03ae59087f5c1fbd9e5bbec7477544b7bee086a5479f72212c7d0b8ff898fec5ffea8d6509b12050f9d8650cf97978ef7e71746d40d922864b88537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
513b9fc452e6c5ebbaaf7c52237ce9ae

SHA1
48b796fb870690f7f289e088d60d1dcbbfdb50d1

SHA256
785cc5cef26a8ac0f24125eee808bb1e07ef17a4b141121c168b4625959bf545

SHA512
1ae3c69f15af5f93cb005b9ab708b6b50be7c088060bc8c4b46135bc33e204d367a982405de34e9543324b9999cbd153a6e62370c6cca4514b3546f382c1bf06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b588baaac1b066a96a7de092310aca2

SHA1
ab02cb10789a31b29477d6b3f80ff61386ea4d5b

SHA256
de327deee2a2beba4720dc56e524ad334b1e7039e9e1f2b28ec1071e47243420

SHA512
f5e8d0dadb72754485867f4fc56c13ad1128eddf48149cbfa879a48581327105b3092c250a6c14a642ba2376e3a043968b66be6b6243be68c75afbcc8e46bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
595cd28ca45287a987ce0cedd6fdfe9b

SHA1
d7ee5f6b211c0cee9df3955f605702db28970369

SHA256
ba56115d395da12c092241a3f1c033efde632493dd5dfe1f9edba399b62b704e

SHA512
2971d7f54d9c6f2ef5356461bb177e91a35efa8997be502f6ec8482eec645e28e6c3141bd342c8664f009faeaa2e099aa16f1f220fa3380d961ccc9b1f2613f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0eac436d53f33f3076d5926e63423bc3

SHA1
9a1f9fac48779c7a014739d1956d639dbe2109bb

SHA256
ff4268bc3b6b8377ef656bc3bc1b64e8386420a9e965bce71171e75951c45b65

SHA512
3013c592ce81a185a30da5593bdf74ed7e09ce61326ef60a238171cb127b8172cc9ef8e871053a43491cd84e6d8d4fa5568bd97dcbc216004f566f3054236901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b919805e12e0ee8f89af918e0e9201e

SHA1
49c24b4d1e26a3120aa18c4bcb6a8d7ee33a660a

SHA256
85c32aaac00caac42a29cd4361fb8cbac3c1dfb3c625363f8c9a1631658faf52

SHA512
e9547992584267094fbde5ca575cabcdc409c84af6f830b5e7248537101cfea31699947483228b6165cf9d63cad93f6420ccbd33caa91bf852268a754f949c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da0209f04c74176c7d62bbbbb938492d

SHA1
bbc4c92013f9ac41c718879d9f88c6f5887aa10b

SHA256
8d3081223fa02ec6c3d93337eaed75cf2da9341461fab87cba404b009682b13e

SHA512
c4d679a293ec77f0452790f5d420e63f78b3cd2a3081a4993a4f9ba02472ed02533d59d8b64ddcad4f718326a7eb0d66bcfba5f646997cb4f5cf0e88793241b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fddbeb1919428e901897e8239abea7c8

SHA1
fac4ffb51348acc086e5e01ebcd8ce8572f625f4

SHA256
c896ce60861105b332ccb639fa91a53a718030c20b34021d118f4f2e3b6f14d5

SHA512
ee17b80f7c541c4b296534d9b22d6878cae4bc8fbc55d3a59ccaf8da41177281760a97cdd66bbbcce714925c4384a45e2fba079834f08a6322c1cfc245083021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6722090a2dea8e461aebd97faf6e7381

SHA1
21585209d138daddd6e0154dac719602a101b46f

SHA256
7ce206e3cd6de41706fd073b8dc3c631b4752c2d1de4498e2a9ab0de5ef54fbc

SHA512
e9879c0060293374fd717938aad5e8679bfd521d9b90b3b5f0346a90185b39946290908a2ea0a1108d9fb0e11a18973c24fe7269ddb6b5ed8ebc492a03f34928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be220dea04466d66f1a8fe3b51804720

SHA1
09872b08d12d5d8a7594ad7f41b57377a36f5162

SHA256
169a042ec5637360dfd81127c79b90bb339903ab67f0a1340cca4f1741d120bb

SHA512
d1777f2ad1827f0956227e6f49087cfa10c6cef1fc658a138f70ffd00b28cb45682188f5f6d94c412b209b4da93f841a26dff8546ed802a5f866d2a286b35fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
486ccc1e9a2fdd8a8a1e43b6cd4f177e

SHA1
181a5047d1b6f34bb8c7620377412f1e6535ae59

SHA256
fc78a04abe07488530bfa86654262232791dc3e93b39ff50666b9d7dc844849a

SHA512
74ef14b7ad73400039f9dfbcd8b7abb9c8072831a4db0ac69b39481dd658e4b49cca9b9da7e1e29e47bc25a13d800b0d1c1b4e4aae1e5f29e6c7eb528c2f42ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8e23228883a87eda9314447666296179

SHA1
0ab830a102720dd7da074d6dd46986d2dbfd104a

SHA256
aaf96338b801a158a847b18246954f358806a2e433e686163d985fb1c077299d

SHA512
8b36f465e6fa56ed15897d8308fdb42f648e435fa3cbf513670632b386cac5ee25be38a824e2d5f1d140cc278fe2d9dcd003d454994b29aff8f7a3e0540723a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd358efb461fd4ff7597a5d4f65f041e

SHA1
d2a1fe9be7adeb681543e5c58d951cfb3dc4a93b

SHA256
c8169afb5197eac5e516dc079a762435d7bd3207d892c87058c7241d1da14b97

SHA512
be1f776669ece09a3437e01f475f9e1b7a2d089d671f51f71dbe69241ae50b0e692c1e557d45c6e0b5e0b67498cef9618c77816e548a55de98009aa480370d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0720446a2e340130c7f334fdf2fe3720

SHA1
57cf8c9a5e85f41bd54c60aeff2018aba3cec2a9

SHA256
47a1201fa5705f1d9731208a25dfc6fe06223456683eb9cc850896f043169093

SHA512
4417d43d4c25311350a444cd293fdefcd131e07b3ab3e1d430445e23764a4367d7853de91a4c2da05bc83da16e3fb89bc75986ba408099ca518c02f73680ccb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57afb8.TMP

Filesize
875B

MD5
8f2a1150d9c366ef05884f77b9299266

SHA1
00e30c0c2a421ed155f0e4e6223f0c6ae5bae1b8

SHA256
13db6d8fa02e4009a569ea2b309fd7751f9c3d2408b52b4432c3d42b0fe8924f

SHA512
3f6aacd05862f747f2b74f2ca7ab13dfd59a785ad5638f70489d2eebd1e1d20b2fac4345e29ae4cb8f8a9219201a2f17cd45aea20ee80b7dac2ce2f9bfca14de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e266104181b53a57b063312e29d379e5

SHA1
2abeea82fac8323770addb0fd361500dc9d8e788

SHA256
19576980ef87eb9b07f4922f22c9310b4bac4b1072886b5fdd9b62832d547fc5

SHA512
0ff6402650367d6b6dcebc880e144993c49fecfbff31e2f1c1ded52031a27cfd9122fb1752c2036ff5286e4a5762362aa3b9a3254e61ac3d21308a5d71728570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da90e46e07055a9403fca06ff5ef25f5

SHA1
c8371877b9dadc1fde5fb7d5b7bcc2866539fde4

SHA256
e25f4045a72904d4c93cacde74ccd8b2b240c5e07201a564fa2ce50c50b58778

SHA512
dcbd12309701c7026e4f873b9561843011549c1d9cbbcfa9ba0e95e484a5739868de170d7991aee645974db24d778db4bb42577a379659f1cfdf90caee511877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
122ad8aa587d73fdd92da51137d7434d

SHA1
f3665277661cbc64c2209c010225380bfebae1d9

SHA256
eb0f97095320d4756c361a0a483f07a4bf96f58c1c27b775b56e79d68e66aa34

SHA512
5c486b3c23095e30db02e202ba5e9fddb70272d2bb6f95ccfc97bd5e4f1688be2024dabd54f4060399c38f49ec53c02fc9283e489a6566980f81367007c01418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a2e6a1e2b03781a4e532ce0ce887f7c

SHA1
fc4fc348db8616b100e9bf9b3330f319b3b9581f

SHA256
82a6cb012e0e80e5bea977dc237611f443bac431d2140b5c47ba56c7611ebc4e

SHA512
6e705783decba2ab23bb09404a682acccc30eac23260f9cc4ab0f7d417edd6c236a384ac8984a8263ccd6560041202b5f00bbe4da54939754c53e2712cf392f5

Download Submit
C:\Users\Admin\Downloads\ArcInstaller.exe:Zone.Identifier

Filesize
56B

MD5
cf04ed1f08249b733362096f48990704

SHA1
7b2ef53bdb871343866b941ecbe2a996cf0221d8

SHA256
316e3ad4f088ace08b06176aa82eb87684a1fa90d14cda986ef231cab6f0e2a9

SHA512
aabc58dae56e088fce1141e04a0b4303c52a73633e10ffdd278ecee987154c93a5fcb0ed32e88c8638a4027617fed5be00088e26f45f4ed0b983e1fff62b3523

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 872522.crdownload

Filesize
1.9MB

MD5
b90aa298d71ac2c6023f3f6e00f395a6

SHA1
3b27a7f934d9dc6c6e70960ce5112787c2cb28e6

SHA256
618d2a40bc0df0b2869ae805f721994563756cadd3d2f7c42bca50f09b462b9a

SHA512
c5ae10e8ab6202ac1baf4c67b77ed23824937c0917420124e3687e212a04d67d193e3064f619863bd2bdb8ad91a36a3e8d389994cda8c15231e7bdb14ce14c42

Download Submit
memory/4432-790-0x00000219B09A0000-0x00000219B09A8000-memory.dmp

Filesize
32KB

Download
memory/4432-794-0x00000219B09E0000-0x00000219B09E8000-memory.dmp

Filesize
32KB

Download
memory/4432-795-0x00000219CAEB0000-0x00000219CAED6000-memory.dmp

Filesize
152KB

Download
memory/4432-796-0x00000219B2230000-0x00000219B2238000-memory.dmp

Filesize
32KB

Download
memory/4432-798-0x00000219CAF60000-0x00000219CAF68000-memory.dmp

Filesize
32KB

Download
memory/4432-800-0x00000219B2240000-0x00000219B224A000-memory.dmp

Filesize
40KB

Download
memory/4432-799-0x00000219CAEF0000-0x00000219CAEFA000-memory.dmp

Filesize
40KB

Download
memory/4432-801-0x00000219CAF00000-0x00000219CAF16000-memory.dmp

Filesize
88KB

Download
memory/4432-806-0x00000219CED70000-0x00000219CED96000-memory.dmp

Filesize
152KB

Download
memory/4432-808-0x00000219CDE60000-0x00000219CDE82000-memory.dmp

Filesize
136KB

Download
memory/4432-807-0x00000219CDE10000-0x00000219CDE18000-memory.dmp

Filesize
32KB

Download
memory/4432-805-0x00000219CAFA0000-0x00000219CAFAA000-memory.dmp

Filesize
40KB

Download
memory/4432-804-0x00000219CDDD0000-0x00000219CDE0E000-memory.dmp

Filesize
248KB

Download
memory/4432-810-0x00000219D0130000-0x00000219D01EA000-memory.dmp

Filesize
744KB

Download
memory/4432-811-0x00000219CDE90000-0x00000219CDEB4000-memory.dmp

Filesize
144KB

Download
memory/4432-812-0x00000219D06F0000-0x00000219D070A000-memory.dmp

Filesize
104KB

Download
memory/4432-814-0x00000219CF340000-0x00000219CF34A000-memory.dmp

Filesize
40KB

Download
memory/4432-813-0x00000219CDEB0000-0x00000219CDEC6000-memory.dmp

Filesize
88KB

Download
memory/4432-815-0x00000219D0710000-0x00000219D0742000-memory.dmp

Filesize
200KB

Download
memory/4432-816-0x00000219D0740000-0x00000219D0756000-memory.dmp

Filesize
88KB

Download
memory/4432-793-0x00000219CAA70000-0x00000219CAAF2000-memory.dmp

Filesize
520KB

Download
memory/4432-792-0x00000219CA9C0000-0x00000219CAA6E000-memory.dmp

Filesize
696KB

Download
memory/4432-791-0x00000219B09B0000-0x00000219B09CE000-memory.dmp

Filesize
120KB

Download
memory/4432-789-0x00000219B0990000-0x00000219B099A000-memory.dmp

Filesize
40KB

Download
memory/4432-788-0x00000219B01D0000-0x00000219B03B4000-memory.dmp

Filesize
1.9MB

Download
memory/4432-837-0x00000219D0780000-0x00000219D0790000-memory.dmp

Filesize
64KB

Download
memory/4432-846-0x00000219D07F0000-0x00000219D07F8000-memory.dmp

Filesize
32KB

Download
memory/4432-848-0x00000219D11F0000-0x00000219D11FE000-memory.dmp

Filesize
56KB

Download
memory/4432-847-0x00000219D1230000-0x00000219D1268000-memory.dmp

Filesize
224KB

Download
memory/4432-855-0x00000219D1920000-0x00000219D1996000-memory.dmp

Filesize
472KB

Download