c66900f029f679df634c4a08aa08b8f0ceb5197cd653cb659f4c3d081faf89fc

Resubmissions

05-12-2024 14:53

241205-r9qjzsvqaq 4

04-10-2024 15:19

241004-sp7s7s1eqn 8

04-10-2024 15:16

241004-snfnbsvgka 8

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-10-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKILL5F01A.html
Size

1KB
MD5

9b99168d579d59abecfdb6bc3fefa445
SHA1

92bb5304d8fca19659b55dcf4870e959fa9e4036
SHA256

c66900f029f679df634c4a08aa08b8f0ceb5197cd653cb659f4c3d081faf89fc
SHA512

d94433ff78f69822b6ceb07315a3d5251844ba005bbac060fffa0fdee311789962ab60d77e114e53f0ca283953a1f7033a80ef2c050e02d24be445629fda50ea

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4028	Honeygain_install.exe

Loads dropped DLL 8 IoCs

pid	Process
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Honeygain_install.exe
File opened (read-only)	\??\S:	Honeygain_install.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	Honeygain_install.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	Honeygain_install.exe
File opened (read-only)	\??\N:	Honeygain_install.exe
File opened (read-only)	\??\P:	Honeygain_install.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	Honeygain_install.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	Honeygain_install.exe
File opened (read-only)	\??\O:	Honeygain_install.exe
File opened (read-only)	\??\T:	Honeygain_install.exe
File opened (read-only)	\??\V:	Honeygain_install.exe
File opened (read-only)	\??\W:	Honeygain_install.exe
File opened (read-only)	\??\X:	Honeygain_install.exe
File opened (read-only)	\??\Y:	Honeygain_install.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	Honeygain_install.exe
File opened (read-only)	\??\H:	Honeygain_install.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	Honeygain_install.exe
File opened (read-only)	\??\Z:	Honeygain_install.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	Honeygain_install.exe
File opened (read-only)	\??\J:	Honeygain_install.exe
File opened (read-only)	\??\M:	Honeygain_install.exe
File opened (read-only)	\??\Q:	Honeygain_install.exe
File opened (read-only)	\??\U:	Honeygain_install.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Honeygain_install.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 306128.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Honeygain_install.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5680	msedge.exe
5680	msedge.exe
5916	msedge.exe
5916	msedge.exe
1652	msedge.exe
1652	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4972	msiexec.exe
Token: SeCreateTokenPrivilege	4028	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	4028	Honeygain_install.exe
Token: SeLockMemoryPrivilege	4028	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	4028	Honeygain_install.exe
Token: SeMachineAccountPrivilege	4028	Honeygain_install.exe
Token: SeTcbPrivilege	4028	Honeygain_install.exe
Token: SeSecurityPrivilege	4028	Honeygain_install.exe
Token: SeTakeOwnershipPrivilege	4028	Honeygain_install.exe
Token: SeLoadDriverPrivilege	4028	Honeygain_install.exe
Token: SeSystemProfilePrivilege	4028	Honeygain_install.exe
Token: SeSystemtimePrivilege	4028	Honeygain_install.exe
Token: SeProfSingleProcessPrivilege	4028	Honeygain_install.exe
Token: SeIncBasePriorityPrivilege	4028	Honeygain_install.exe
Token: SeCreatePagefilePrivilege	4028	Honeygain_install.exe
Token: SeCreatePermanentPrivilege	4028	Honeygain_install.exe
Token: SeBackupPrivilege	4028	Honeygain_install.exe
Token: SeRestorePrivilege	4028	Honeygain_install.exe
Token: SeShutdownPrivilege	4028	Honeygain_install.exe
Token: SeDebugPrivilege	4028	Honeygain_install.exe
Token: SeAuditPrivilege	4028	Honeygain_install.exe
Token: SeSystemEnvironmentPrivilege	4028	Honeygain_install.exe
Token: SeChangeNotifyPrivilege	4028	Honeygain_install.exe
Token: SeRemoteShutdownPrivilege	4028	Honeygain_install.exe
Token: SeUndockPrivilege	4028	Honeygain_install.exe
Token: SeSyncAgentPrivilege	4028	Honeygain_install.exe
Token: SeEnableDelegationPrivilege	4028	Honeygain_install.exe
Token: SeManageVolumePrivilege	4028	Honeygain_install.exe
Token: SeImpersonatePrivilege	4028	Honeygain_install.exe
Token: SeCreateGlobalPrivilege	4028	Honeygain_install.exe
Token: SeCreateTokenPrivilege	4028	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	4028	Honeygain_install.exe
Token: SeLockMemoryPrivilege	4028	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	4028	Honeygain_install.exe
Token: SeMachineAccountPrivilege	4028	Honeygain_install.exe
Token: SeTcbPrivilege	4028	Honeygain_install.exe
Token: SeSecurityPrivilege	4028	Honeygain_install.exe
Token: SeTakeOwnershipPrivilege	4028	Honeygain_install.exe
Token: SeLoadDriverPrivilege	4028	Honeygain_install.exe
Token: SeSystemProfilePrivilege	4028	Honeygain_install.exe
Token: SeSystemtimePrivilege	4028	Honeygain_install.exe
Token: SeProfSingleProcessPrivilege	4028	Honeygain_install.exe
Token: SeIncBasePriorityPrivilege	4028	Honeygain_install.exe
Token: SeCreatePagefilePrivilege	4028	Honeygain_install.exe
Token: SeCreatePermanentPrivilege	4028	Honeygain_install.exe
Token: SeBackupPrivilege	4028	Honeygain_install.exe
Token: SeRestorePrivilege	4028	Honeygain_install.exe
Token: SeShutdownPrivilege	4028	Honeygain_install.exe
Token: SeDebugPrivilege	4028	Honeygain_install.exe
Token: SeAuditPrivilege	4028	Honeygain_install.exe
Token: SeSystemEnvironmentPrivilege	4028	Honeygain_install.exe
Token: SeChangeNotifyPrivilege	4028	Honeygain_install.exe
Token: SeRemoteShutdownPrivilege	4028	Honeygain_install.exe
Token: SeUndockPrivilege	4028	Honeygain_install.exe
Token: SeSyncAgentPrivilege	4028	Honeygain_install.exe
Token: SeEnableDelegationPrivilege	4028	Honeygain_install.exe
Token: SeManageVolumePrivilege	4028	Honeygain_install.exe
Token: SeImpersonatePrivilege	4028	Honeygain_install.exe
Token: SeCreateGlobalPrivilege	4028	Honeygain_install.exe
Token: SeCreateTokenPrivilege	4028	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	4028	Honeygain_install.exe
Token: SeLockMemoryPrivilege	4028	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	4028	Honeygain_install.exe
Token: SeMachineAccountPrivilege	4028	Honeygain_install.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
4028	Honeygain_install.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5916 wrote to memory of 3436	5916	msedge.exe	78
PID 5916 wrote to memory of 3436	5916	msedge.exe	78
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 5680	5916	msedge.exe	80
PID 5916 wrote to memory of 5680	5916	msedge.exe	80
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81
PID 5916 wrote to memory of 4708	5916	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\SKILL5F01A.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff6db93cb8,0x7fff6db93cc8,0x7fff6db93cd8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,6802119645555000960,9959409904274934881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Users\Admin\Downloads\Honeygain_install.exe
  "C:\Users\Admin\Downloads\Honeygain_install.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2331C53A01D93A2D5F7BE758026A492E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
665650e0b3579dbc38da63b05f1e4cfd

SHA1
1f99d6ac004c87abb8b31d55aa95da66d5293c65

SHA256
f42b099df509c753b08b99e3ef3bd93d9266911ed1093ade56d985b5f44cdd1e

SHA512
2ee454e2d32a64d26d05c485bc795b933fe0054cc790c99dca0be91fb787adba50c6c825b851e0381f7516697fc48eca605878a2a9d20fa279ab61eb365d2596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_2B98B7FC39A7D21598AD99348E996591

Filesize
638B

MD5
1f3141476806488b1402d32e1a9b8534

SHA1
4903a2b25503fa9cfc4626fe55ddf123cd8621d9

SHA256
521d8e677b6c39266ed9c78a300477a39ef6a307a61810dfbbf586affe1f3288

SHA512
ebaa8e3084273f6c982b32d631df12e641200076004d19ecf4619ad5c00cfea5e706580387f729d083783a678c8887827d9350665b89e0cec7252855c19fd296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
06866f6e21a161b6533926df33349cdc

SHA1
0dd682d5f3fae21034b58dc0294098ca9aab521f

SHA256
5541ac938dd750d885e11c118a79533b5af9ac71256dff6b74bdbb799397bb80

SHA512
c7e0c67db61781482a02c907f5d25d3e75e8a6f1bf7d28b9d59ccf99d11b46f1e0145392afb0fad079bd1327765a657ecd2299a0bd5b76cd86f89d6afede882f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
7df0a4dd06549d80c6036e5cda18a58d

SHA1
ef784b60f353c50767fd42c8c08ae978b9783813

SHA256
0316346f81cdaeba63bf70003bab14f8d46c487f0dc2ca167e346637783d73c4

SHA512
8c19f1ab89f3d3dc3959fab88a9f2c5d0d85d4d290dec4062771b0fe2c047b2ea55cba5c9cc79e2fb935340ac485d71e27ffafbb23021583947ae0e0f12c08c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_2B98B7FC39A7D21598AD99348E996591

Filesize
476B

MD5
ecc4dcff6b785ec58100eac7d4cf637f

SHA1
b3f846e0cc14aa2cfca679867f309bc98ae9cfc1

SHA256
ec08ff60e206ceb498d02df931e71661bdb5ea263be48e60167ae8e4f9c3230b

SHA512
023aedf3336c0e50e5d28cb3d7f6594c144aaba650c2c263483f32982bff2b9982d11245ef946e2e0c063cfcd0cc8a1ed87506696a93d3a80553440429967aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
c84376916cadd54a466a242776620952

SHA1
1138c924deb45933e0699bea9db3873ac5f593f0

SHA256
fc527d714de2a8ec6d69769121cedfe2eb838c23bbdc9924c285d775dda56694

SHA512
f56d10c70ad2efd88ffc097771b84e9c9f7bbe5e6f2a90ca43cb709086cc10d949b578fc8d028738b0ba0dc323c44423e1d92006f78a604a3496ddcfa7f165f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51515910-c365-4f6a-b262-60514d9a6379.tmp

Filesize
8KB

MD5
2f57649302839ca578dfe5bd7a662546

SHA1
5aa1859d172a444d7a38f009a4b2f42582452382

SHA256
7865499b0456a29de280a77469f6f8b8c108c8f8129200fbc867e502b3c8fc2d

SHA512
cb1f4c2a2ceabd1a200c9e6814a3f814817e565c7fbed2639d885119270eb989d48717c38ab7d543b0b57459173fb8433b4cb98fc72e834e0d683ff021466f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
57KB

MD5
ca02f0538fb4f32d9e8af05e49256b32

SHA1
18c32fbd2c4d50d23afedac285d8c6cf429d5cfe

SHA256
3eba2798fe3c48ad8c745f120a8295164e00d7273586287a743a3229921f88cb

SHA512
a18274adca013b0661d17981d8c8a9ab3cd9367ba904be1deab74ddf0948963827447d56529197b0c30a74cbc3ed02b9bfe5f674912d2d1e71d6530e63d5c6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
122KB

MD5
697c818a4e87aa267b8df423be977be3

SHA1
972f967227b419c1296fc46c268de5b765a18522

SHA256
ebb8b638f0657a2c7d17a8bccf4a26ccad8a5dfe0acc5971205340eabe64ecfc

SHA512
98ec253a532ed04a1339b624da98366d0809c21a44c7208502e91a5e9e42b8477721473184068d562ee22d032664285d3f7d946a20d96b27b88d3199c4ebf40f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
21KB

MD5
8d975ae033af5e8aa546c6bfa89c06e7

SHA1
aa05b7b60a1211581b11e3b6e2de6f25126c0be6

SHA256
fad3d6e2697124cb7a2a3a62d4daef6df6fc4341287d648d2b9d697f5e290bd5

SHA512
729ed443f4676bdc5d531a58a5637eaecea90236bc781469f82ef5a306a89d25863ea15231b6d2a12370370205d9ec4878d7ef2a22568d8c426fe82529240c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
23KB

MD5
5436202f05a6b889367e5bf0f630261e

SHA1
5fffed1daf9a96427bd3fb974a459fe332318593

SHA256
094c89c2ea2898da52e197f87548c2090e2cb13690a7e0afeac832c247405e64

SHA512
54fe51e7262f82777507cadd07c48ab903f1f6e5e3e098b962abeba9a10b8b4a9222e12e8a033f167dbeede20005121141e6f4f341b1db077134ae9b7006f5b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
26KB

MD5
e1fd846710aa5e77add9800906d17ed0

SHA1
2d778c0601d18e7fd3930cbb4b0068b6eb3a05ec

SHA256
00b8d8ad266c164444fb240a4b07d4316020c74c087e95d37547b54ea1051772

SHA512
a00333708ea6f9efe940e8e5ee6ecb9b74063279238beb9cebf4847023a3f94cce34aa497f8a9ed99570a5407eca3adc9f469afd3553c71e6e8a05be83026341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
24KB

MD5
431c5047761ebe47b964c1167f2c2fec

SHA1
13131dd712d1e2634a0c9333332c2466d7f31d50

SHA256
82966b0524dd05e22fbbb6d08f4b3f5161064cfc49b55bf1dc4eb55d875d1b9e

SHA512
f6cb63ae7da2ee4d9405167ea729f761eee870a4a7d9804e80fd8daf8f581a64d752aafd56d2dd7e0b6f3d2f7f662f1fc29a49d93ced64a6a9ee0b3df31361a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
94KB

MD5
e02ca872657c14ade83e5233f77b05bc

SHA1
9bffb08bcafa7ac080cb839475a41eb802d478a5

SHA256
7b6633f1e1feff95d80c6b05c86e4200481413fc4364d1e80d82a70952649143

SHA512
427c08af168d1e3ae05a95dd61a19142b9916a74f0dcc7c1f6d032287b6b293d1e7f078a2ff3c2b22f3ef306ebd8a874338ccee469c215d98c0a11af39c75f24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
38KB

MD5
4fad09541ca18ec297be3eec955b5fb0

SHA1
c5ca976f2e9160b53d1564ab675503d9b181ea49

SHA256
e88ccdf63ff2dbc9f393eeb316fbcc861d6a389bede48f9420875d781890a68d

SHA512
b8697b03d3018f3fe5e0b7b6ea3c5778634a882ccdcf7641867e3e4ae58919b18171cf51e0025bc6c69f65055725e3e59c94cbca5a3e4634a29a878ed2592136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0a4f80aa563fbb2f_0

Filesize
253B

MD5
9a53f1ebc4c59f653d3c311742a5f411

SHA1
e9655545944713924f837927451b24b68abf9fc1

SHA256
48dc808e4f10817e9d7979ea4537666b9542a2c2171e9bf2f3a6c49faa61ddb8

SHA512
c8af0e0c9e9f05067ea619de7a374c5a2781cdbcd81bec05be1e213d755ce6b5e4da6f28c56db91b1168f26b18531c047013a219b376f2ccd635967e096bc7a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c45f5a627a8808e497dcc9e7307b526c

SHA1
39af527279166df4d7f8eb29a956f09c4999e022

SHA256
ea045bbed0a5da4b2b24df851d8072e4d0995a036d46093f7827380ebc4cf3c8

SHA512
71e9bed4120562660ab573a1ffeb7a06df8ef5ea1279780aaa252074f96ca9c29bf95f204de87d82e47b5dd758d0e3136cf885307a72fd67945c72c650c39d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b214793aed2d9f63b94751ce824da927

SHA1
bdbde848259afd6e2892a71d4a46c5a190cfb4bb

SHA256
3cf1b64a1b10eee731b6ee9c037fc0c2ce0328af8522420fdf468941c1b52bcd

SHA512
9f5ab72de7c0fb6cce4bec344ec5921bf6c6bc1499817e10da9399d1ddf9263e1b7c8369ac80cf8ee75b159235c191da436348828cf4f79b629c6fd1e419a514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
587B

MD5
fb15ecb0f5e19a07394d2f2dbb624342

SHA1
f361be7cdedef3f8afcb08a40004c0888854f510

SHA256
1c547524426c5724ccf43f95fb4c777e46aeab9315ef4b770abaf9fd3ac0cf62

SHA512
77dd7ad5546f064e6ffc6d7cdfa0cef4ba25adda4ceb44df239a4cdaf31139b3fa50bc616bc35c72967f89cc1b9c53fec77ab2eeeab0faaff09f4c4c66818607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
33363cd4a65883e17d7485778ccad53b

SHA1
7577e6c04b2f52a3bbae8aa9bc52e11f3e48ea59

SHA256
5d6ba6c27a56fc393e294a37ebe45f16f7797b5903385bb6f56f1d67853fc8ce

SHA512
e70c499406304241ff7a82e1e56159cc94a9e7ab193142a445cd7a94bad7db8c06456cffb3d0a3ac54d4b9dc6d285092453ca4e88a8cce21b3cc328a263eed91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d90e8c25980f6fda9dd85fa208e75b4b

SHA1
e6d96296733bffa4880d184088b4b88e14bb0547

SHA256
3536e3e2443dbcf7c8377454d21c4ad1475d8f7023207a1d42a91f2d1ca618ca

SHA512
714943f2c8e80c12804ab9bfe167e5665d249a69db87063da55d53026d538cace8f8c14df98745ba60e20f9b26416bc53415cfbbd205450602cb3610828a8473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cf82d36da5c674a8ae91595db6b12770

SHA1
d23482b067643d3f97cb4e291a0d8c987ee9fdc8

SHA256
896576a2a5d133c23a54233d52c8455e1ef9fdb87e722264bbe99b79a2fb89ee

SHA512
9117183c6123fa2634e3cfd94567bc70feca06b937e751a56b4b0349d89034313d3262552f0c30664195e723398526603a4654233531227c1f1221cb69b217f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82c91d4d7f06b658ff65f751e67c4e4c

SHA1
47d0939f247f509392b24deac03718a5aa0aa99f

SHA256
a59b5f464c1447441068b3085ae0fafb023504a666b7659a2a116073b8b600a3

SHA512
26c2d06679cb750b44b92b1d72eb66512770e29074a027118e4ee5e70dee9a1bb10146ee7fdfccb059b5b2d663d4011f84fb7563d5d870bcc7df32f1b68ace1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
31bbe5cdb442dd76003db8c691b69d63

SHA1
877b9845b560eb51a3786b857ec4477448ae294a

SHA256
ea1ec67ee44f9a883191a4f4b6c9ebd9beb6167dacbdf2d832463a080e528f90

SHA512
ad8f466ddf680171986cf87ea5b689a9f5e623ee94372fa486d5682f48e17c45864c0900d3b7db88846149b4b67046011b328f7c5e9d419853080fbf07af6950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92ac299d156c8305b6a1afe27a1c1061

SHA1
c53329c966057ab58800a8fea036989f936c3393

SHA256
3f1013e7bbaf571df8a973153e2cd4a1bd365536b645be4c9a7eaf55256d8b72

SHA512
66ffd27e4a2661750689189dd49399deff8f1694ccc1c0b4188dc417bc328cd2ccf8de05693ffa65e615549a7b3b890643a66a30198172127935425868a9ac45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
18322f46a2ef6480e976219b29ad1d27

SHA1
700750384b688ef9c2c97cfa1f080a5cd88cccae

SHA256
a350423d2bd0b2d3bdd7fdb38a67d936cf05be6a34073a64448ae3d8eb297042

SHA512
97562c890060de56d6555492dd861df9aeb098d0288ce741ff37d5eafd30eb31c7da6e22d74c740108071551ac41668bac792ec75c52053c540eb9d97ca47b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8c3665150d6f7da44dd24080ee3dfd1f

SHA1
eb441ac4fa44bd9cf34afc0c7d2758f6ea739472

SHA256
4fb619e8513b9a844a8cca517ba8c5cce849564b3c90c149dc21eda3fb5306d7

SHA512
2fc9e33483002ceb5c44133000ef992ae69f48710327f95e19736e64f727b8d1da308be4c9bd496fe809a8275cac57b83ab23f8f082424026b9305730e93af8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
843646727cbf92c4dba0a8d93701e38d

SHA1
5da62ed0c244c7b739c6d6309a1be5b9bd0dd681

SHA256
24ef1dceeb92c2dc9ad35a564f07ad0233bc2646b359a41177c82a35f983a548

SHA512
e106f434e21fb73059087f27b1c24fb6705dec983257a2e47d3e470275c842c0599dbc5a6ada079d04e915da4cac2a408d063693f9c2e41e2ba5aea311d048ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
72cfa953c610e0ac430233f49f85ad7d

SHA1
960cc93731929c73da88ea1d705f46a00df7f240

SHA256
e646d0c1d612958b6705f92d9fd2bee81dc41da306917dfc8c886b41a816b3e5

SHA512
4f093502c347124805d1a08664a6c4c484ff73a5ebb210d9a7e2d2cdcb4058413b5dca6d90bc7ea15475480ba7ee518d6537cc99bbf71b71cfe77ec4e96df098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
de45970df6e6bcf4324d963e8f4d2134

SHA1
bfde1f373b79ca38a06f8ea4f54ba8298dee62b1

SHA256
137204a2211efba089e760ff8f97517cf6dd51ac73d5a9cd483f67cdb90abe3f

SHA512
323fbeb824935fa2e673ea6ecf84d93c735ddf690d37b7f6e879baf05a02faac2d65b414a848eb74cd897a205f61c520c1d3ffd7d99c5446df3858afc30062d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
2a1d550b71b0991e4088f70f29a25d2c

SHA1
2d8d474e569ef829b139a4159b1dd83211aa213d

SHA256
1c6302d4b1561150ff81b603d64cfcd0846552a1600c6c312f8f6340565fabd8

SHA512
4f7e9e30f2f6c1cb2a423ffdf0072d3595af947d127ba893173a4bccd5b1a5c7a69d72cddb706c3397699a792d76069c330388cdc405afe5a345cf5dfd981ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ed8aae2d33af9e11ae371f7f04badc28

SHA1
4e2e755b4d1fc790b41d8b6d91f4a77aa235b287

SHA256
2376fef8c1d3e7c74836444847e3132e5cf9220987084bd86eb28158928ddc9c

SHA512
4c365ff7b12f214eadb3d21e935191b90ba1c0a243661a08492fb3bff1bbe27879dc0f6ec12865f18871673be263cdd32e526474e172ba696fabd2ccfc4e9de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a78.TMP

Filesize
204B

MD5
d2141af586107f9fbe9518990cbbc6be

SHA1
025c59f76ccc4e5e61f7c9477e0c8a9823ea27c6

SHA256
1ea115afd45a938cc9eaa391388175e4feff5ea27db400c50ab7da2a87946cfd

SHA512
e36654fbc267861a399e8b5d7b6d873a666d2b28cee67d952d5a42e59cd286924d7d178db12f6d61e25c1aa2b6692dff4392251833359d24ca46baf82aaf8487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
774c60004305b84e8cf6bf286064278e

SHA1
08c84bda5fa39e1bc8d6bbc5d77009a5dc549e21

SHA256
3fea0c9dd946372d0558164d6333ee16a6f46f5d49fd1403e0a249e4c2d8ca6b

SHA512
7d72d9f8b95b760ddfff7faa3c16c0aefdc5d3d2c760f4fd6c59066b18bfd1344ef47bdb710fbeef70ece9338202df7eb25ead6de3507adf1d0926a697890b2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d01eaa8ae38690f8768f71f29ca82ee0

SHA1
e40841ddf46173660388198f8fc93997de8b11d4

SHA256
229553b18e13675fb2279e0ceb65142f889a6b7b30fb949ad3c8b4f3cdd83f55

SHA512
635e30402ffdfdc9895e43bc4ce6a84dae178899fbf21a1fc94da2ac8f6ace441803bf2462a216fbd05d085e1328813c54e472cecb87ee38713268c3938fef11

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4028\installer_logo_large.png

Filesize
15KB

MD5
92a8f755b579ffc8c3f86ec87076f45e

SHA1
cd5536b089a281807eabe2def1e6f4020e2b124b

SHA256
71a8107a9f5e4464519fb74b4e83b7f7af86812399210f55a2505870391aec66

SHA512
11857b0eefbacc7faf7e1056124319c3acfc82eef0c1769a3ad7945a1019b85757fbd8f620a5bd360652c7f877a8634df744a3cee0fb0f7a07689522024d06fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4028\installer_logo_small.png

Filesize
5KB

MD5
743d8274c5efa5b66c12eff6d89f819e

SHA1
655ab5d69e17883d3651792d7c3ff7e133e9ab54

SHA256
54305db25aef864e71e02d5a1cdadf831387d7b850a80512e041d9fadc0c5438

SHA512
9f261f384932990796143b95cef3540e962757c7ada9bb0485df084f3c8391f28d31ac1eb78478c67eda56ffb1cb238924b107c7ed8e1c72d37cdd6acccc75ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE4AD.tmp

Filesize
550KB

MD5
8259dc74965f3c8e91d152862580a773

SHA1
d2d029f9f9be25be3c5526c5a52449c034c673e1

SHA256
84f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9

SHA512
50903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE59E.tmp

Filesize
630KB

MD5
8ecff5e8777908818edd94721ddc349d

SHA1
a3ffcfcffae1b44261c1b1a64917ac898c40b9e2

SHA256
1c450659c7681df9df21b20412c9647e7e8e5bf0f2945c48b1ab51f330f2516b

SHA512
8418049fe52dcf6e294cf58d200b7a7d8e704ba592b3f59243c4c5a4d661c60f8db97540badd9a1718547a0047b39316ec7917c43ddcb8a71bebad49e7baaf08

Download Submit
C:\Users\Admin\AppData\Local\Temp\updDF3D.tmp

Filesize
1KB

MD5
91d0484055bd80300fbcc7e546bfd0a2

SHA1
8e8024a1db97cae891cea172035e0ecfb24579af

SHA256
89f930d218b2afc509d8d217ee6b6ff8d29c5772cf2e2234fc0f8a46ef1ee13c

SHA512
2ee8859014b416282ba1e0bc4510bcf7cf290b1ab4a1d8040e76981ff14fdae69935ce0f180653519c86c187d5f997b83420060f3b0101906529c13dba6e1579

Download Submit
C:\Users\Admin\AppData\Roaming\Honeygain\Honeygain 1.5.0.0\install\Honeygain_install.msi

Filesize
4.9MB

MD5
89ca17e0e21a5a0951899a87a50915c9

SHA1
6d3d6c65b422b6ff2e473580eefcb0e767123e49

SHA256
35c9e82daee05184b803a76276b556802da4b76119cb9dc649bd0bae9b3e00f6

SHA512
95dae81f840a4143a497e06b58ef5fafe41b246f8e1b76fc4911612d24d57d267ab1cfd0c3372a80f0d229bd4e3a6df07775d2f33c9995beecb5304faa281d69

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Honeygain_install.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 306128.crdownload

Filesize
24.5MB

MD5
e5d5acd2bc76a50accda70ea55c40ebf

SHA1
75b649e01d35e7010d5d60c87545dc7ab47a3420

SHA256
67fb9596b6c5d0b12c9f44ea8b04d5843101935ea65e179835707f3efe715802

SHA512
3a3e318c926e70e485fbfd42db924fd4dfb8a44596725885372c940fb9bdbeb64a98c2374d4f5c3420e62ad5a67e7b9ed1b1338d83b7888280038ed15ff2e60c

Download Submit