c66900f029f679df634c4a08aa08b8f0ceb5197cd653cb659f4c3d081faf89fc

Resubmissions

05/12/2024, 14:53

241205-r9qjzsvqaq 4

04/10/2024, 15:19

241004-sp7s7s1eqn 8

04/10/2024, 15:16

241004-snfnbsvgka 8

Analysis

max time kernel
571s
max time network
572s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04/10/2024, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKILL5F01A.html
Size

1KB
MD5

9b99168d579d59abecfdb6bc3fefa445
SHA1

92bb5304d8fca19659b55dcf4870e959fa9e4036
SHA256

c66900f029f679df634c4a08aa08b8f0ceb5197cd653cb659f4c3d081faf89fc
SHA512

d94433ff78f69822b6ceb07315a3d5251844ba005bbac060fffa0fdee311789962ab60d77e114e53f0ca283953a1f7033a80ef2c050e02d24be445629fda50ea

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
112	5540	rundll32.exe
113	3156	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
2404	Honeygain_install.exe
6124	Honeygain_install.exe
228	MSI7A53.tmp
3244	Honeygain.exe
6104	HoneygainUpdater.exe

Loads dropped DLL 64 IoCs

pid	Process
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
2556	MsiExec.exe
5188	MsiExec.exe
5188	MsiExec.exe
5188	MsiExec.exe
5188	MsiExec.exe
5188	MsiExec.exe
5188	MsiExec.exe
4020	rundll32.exe
4020	rundll32.exe
4020	rundll32.exe
4020	rundll32.exe
4020	rundll32.exe
5188	MsiExec.exe
5540	rundll32.exe
5540	rundll32.exe
5540	rundll32.exe
5540	rundll32.exe
5540	rundll32.exe
5540	rundll32.exe
5540	rundll32.exe
5540	rundll32.exe
5540	rundll32.exe
5188	MsiExec.exe
3156	rundll32.exe
3156	rundll32.exe
3156	rundll32.exe
3156	rundll32.exe
3156	rundll32.exe
3156	rundll32.exe
3156	rundll32.exe
3156	rundll32.exe
3156	rundll32.exe
2556	MsiExec.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Windows\CurrentVersion\Run\Honeygain = "\"C:\\Program Files (x86)\\Honeygain\\Honeygain.exe\" -silent"	reg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	Honeygain_install.exe
File opened (read-only)	\??\M:	Honeygain_install.exe
File opened (read-only)	\??\U:	Honeygain_install.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	Honeygain_install.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	Honeygain_install.exe
File opened (read-only)	\??\V:	Honeygain_install.exe
File opened (read-only)	\??\P:	Honeygain_install.exe
File opened (read-only)	\??\R:	Honeygain_install.exe
File opened (read-only)	\??\K:	Honeygain_install.exe
File opened (read-only)	\??\T:	Honeygain_install.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	Honeygain_install.exe
File opened (read-only)	\??\O:	Honeygain_install.exe
File opened (read-only)	\??\X:	Honeygain_install.exe
File opened (read-only)	\??\Y:	Honeygain_install.exe
File opened (read-only)	\??\T:	Honeygain_install.exe
File opened (read-only)	\??\Z:	Honeygain_install.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	Honeygain_install.exe
File opened (read-only)	\??\Q:	Honeygain_install.exe
File opened (read-only)	\??\N:	Honeygain_install.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	Honeygain_install.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	Honeygain_install.exe
File opened (read-only)	\??\L:	Honeygain_install.exe
File opened (read-only)	\??\O:	Honeygain_install.exe
File opened (read-only)	\??\W:	Honeygain_install.exe
File opened (read-only)	\??\Y:	Honeygain_install.exe
File opened (read-only)	\??\H:	Honeygain_install.exe
File opened (read-only)	\??\M:	Honeygain_install.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	Honeygain_install.exe
File opened (read-only)	\??\X:	Honeygain_install.exe
File opened (read-only)	\??\A:	Honeygain_install.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	Honeygain_install.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	Honeygain_install.exe
File opened (read-only)	\??\P:	Honeygain_install.exe
File opened (read-only)	\??\R:	Honeygain_install.exe
File opened (read-only)	\??\G:	Honeygain_install.exe
File opened (read-only)	\??\I:	Honeygain_install.exe
File opened (read-only)	\??\B:	Honeygain_install.exe
File opened (read-only)	\??\J:	Honeygain_install.exe
File opened (read-only)	\??\B:	Honeygain_install.exe
File opened (read-only)	\??\I:	Honeygain_install.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	Honeygain_install.exe
File opened (read-only)	\??\K:	Honeygain_install.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 48 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Honeygain\Caliburn.Micro.Platform.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Xaml.Behaviors.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Text.Encodings.Web.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Honeygain\HoneygainUpdater.ini	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.Auth.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.Common.dll.config	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Caliburn.Micro.Platform.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Web.WebView2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\WpfAnimatedGif.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\GrowthBook.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\hgwin.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Countly.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\HoneygainUpdater.exe	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.PlatformServices.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.Proxies.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Bcl.AsyncInterfaces.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\WebView2Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.DotNet.PlatformAbstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Threading.Tasks.Extensions.Desktop.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Sentry.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Facebook.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Hardcodet.NotifyIcon.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\msquic.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Google.Apis.Auth.PlatformServices.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\LiveCharts.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\LiveCharts.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Web.WebView2.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Honeygain.exe	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Microsoft.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Autofac.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\Honeygain\Caliburn.Micro.Core.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFB5DE71F5AA72817D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5109.tmp-\Honeygain.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5109.tmp-\msquic.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFED0C59F22D98BA87.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6030.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6030.tmp-\Honeygain.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6030.tmp-\hgwin.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5109.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5699.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{AB2A0F4C-A18E-4F8F-8FCE-C510D13946E6}\MainIcon.exe	msiexec.exe
File created	C:\Windows\Installer\e594cb1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5699.tmp-\msquic.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5699.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6030.tmp-\msquic.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6030.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF65D1B30CA2BDA46B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5109.tmp-\Honeygain.Proxies.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5109.tmp-\hgwin.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5699.tmp-\Honeygain.Proxies.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5699.tmp-\hgwin.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6030.tmp	msiexec.exe
File created	C:\Windows\Installer\e594caf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594caf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5699.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FA1.tmp	msiexec.exe
File created	C:\Windows\Installer\{AB2A0F4C-A18E-4F8F-8FCE-C510D13946E6}\MainIcon.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AB2A0F4C-A18E-4F8F-8FCE-C510D13946E6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5699.tmp-\Honeygain.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6010.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB4.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF2AE57E822F6585D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5109.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6030.tmp-\Honeygain.Proxies.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4F22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5109.tmp-\CustomAction.config	rundll32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Honeygain_install.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HoneygainUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Honeygain_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI7A53.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6124	Honeygain_install.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000908a982beaea54420000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000908a982b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900908a982b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d908a982b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000908a982b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4F0A2BAE81AF8F4F8EC5C011D93646E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4F0A2BAE81AF8F4F8EC5C011D93646E\Core	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\PackageCode = "37BFEB0D282D6FA49A481907DEBA8002"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\ProductIcon = "C:\\Windows\\Installer\\{AB2A0F4C-A18E-4F8F-8FCE-C510D13946E6}\\MainIcon.exe"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4F0A2BAE81AF8F4F8EC5C011D93646E\Updater	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87F45A54E3EC37E4A9C35636860D2B76\C4F0A2BAE81AF8F4F8EC5C011D93646E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Honeygain\\Honeygain 1.5.0.0\\install\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\Version = "17104896"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87F45A54E3EC37E4A9C35636860D2B76	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList\PackageName = "Honeygain_install.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Honeygain\\Honeygain 1.5.0.0\\install\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\ProductName = "Honeygain"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4F0A2BAE81AF8F4F8EC5C011D93646E\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2096	reg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 959453.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Honeygain_install.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
776	msedge.exe
776	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
6096	msedge.exe
6096	msedge.exe
2452	msedge.exe
2452	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
5188	MsiExec.exe
5188	MsiExec.exe
2900	msiexec.exe
2900	msiexec.exe
228	MSI7A53.tmp
228	MSI7A53.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2900	msiexec.exe
Token: SeCreateTokenPrivilege	2404	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	2404	Honeygain_install.exe
Token: SeLockMemoryPrivilege	2404	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	2404	Honeygain_install.exe
Token: SeMachineAccountPrivilege	2404	Honeygain_install.exe
Token: SeTcbPrivilege	2404	Honeygain_install.exe
Token: SeSecurityPrivilege	2404	Honeygain_install.exe
Token: SeTakeOwnershipPrivilege	2404	Honeygain_install.exe
Token: SeLoadDriverPrivilege	2404	Honeygain_install.exe
Token: SeSystemProfilePrivilege	2404	Honeygain_install.exe
Token: SeSystemtimePrivilege	2404	Honeygain_install.exe
Token: SeProfSingleProcessPrivilege	2404	Honeygain_install.exe
Token: SeIncBasePriorityPrivilege	2404	Honeygain_install.exe
Token: SeCreatePagefilePrivilege	2404	Honeygain_install.exe
Token: SeCreatePermanentPrivilege	2404	Honeygain_install.exe
Token: SeBackupPrivilege	2404	Honeygain_install.exe
Token: SeRestorePrivilege	2404	Honeygain_install.exe
Token: SeShutdownPrivilege	2404	Honeygain_install.exe
Token: SeDebugPrivilege	2404	Honeygain_install.exe
Token: SeAuditPrivilege	2404	Honeygain_install.exe
Token: SeSystemEnvironmentPrivilege	2404	Honeygain_install.exe
Token: SeChangeNotifyPrivilege	2404	Honeygain_install.exe
Token: SeRemoteShutdownPrivilege	2404	Honeygain_install.exe
Token: SeUndockPrivilege	2404	Honeygain_install.exe
Token: SeSyncAgentPrivilege	2404	Honeygain_install.exe
Token: SeEnableDelegationPrivilege	2404	Honeygain_install.exe
Token: SeManageVolumePrivilege	2404	Honeygain_install.exe
Token: SeImpersonatePrivilege	2404	Honeygain_install.exe
Token: SeCreateGlobalPrivilege	2404	Honeygain_install.exe
Token: SeCreateTokenPrivilege	2404	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	2404	Honeygain_install.exe
Token: SeLockMemoryPrivilege	2404	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	2404	Honeygain_install.exe
Token: SeMachineAccountPrivilege	2404	Honeygain_install.exe
Token: SeTcbPrivilege	2404	Honeygain_install.exe
Token: SeSecurityPrivilege	2404	Honeygain_install.exe
Token: SeTakeOwnershipPrivilege	2404	Honeygain_install.exe
Token: SeLoadDriverPrivilege	2404	Honeygain_install.exe
Token: SeSystemProfilePrivilege	2404	Honeygain_install.exe
Token: SeSystemtimePrivilege	2404	Honeygain_install.exe
Token: SeProfSingleProcessPrivilege	2404	Honeygain_install.exe
Token: SeIncBasePriorityPrivilege	2404	Honeygain_install.exe
Token: SeCreatePagefilePrivilege	2404	Honeygain_install.exe
Token: SeCreatePermanentPrivilege	2404	Honeygain_install.exe
Token: SeBackupPrivilege	2404	Honeygain_install.exe
Token: SeRestorePrivilege	2404	Honeygain_install.exe
Token: SeShutdownPrivilege	2404	Honeygain_install.exe
Token: SeDebugPrivilege	2404	Honeygain_install.exe
Token: SeAuditPrivilege	2404	Honeygain_install.exe
Token: SeSystemEnvironmentPrivilege	2404	Honeygain_install.exe
Token: SeChangeNotifyPrivilege	2404	Honeygain_install.exe
Token: SeRemoteShutdownPrivilege	2404	Honeygain_install.exe
Token: SeUndockPrivilege	2404	Honeygain_install.exe
Token: SeSyncAgentPrivilege	2404	Honeygain_install.exe
Token: SeEnableDelegationPrivilege	2404	Honeygain_install.exe
Token: SeManageVolumePrivilege	2404	Honeygain_install.exe
Token: SeImpersonatePrivilege	2404	Honeygain_install.exe
Token: SeCreateGlobalPrivilege	2404	Honeygain_install.exe
Token: SeCreateTokenPrivilege	2404	Honeygain_install.exe
Token: SeAssignPrimaryTokenPrivilege	2404	Honeygain_install.exe
Token: SeLockMemoryPrivilege	2404	Honeygain_install.exe
Token: SeIncreaseQuotaPrivilege	2404	Honeygain_install.exe
Token: SeMachineAccountPrivilege	2404	Honeygain_install.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
2404	Honeygain_install.exe
2404	Honeygain_install.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe
3244	Honeygain.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3244	Honeygain.exe
3244	Honeygain.exe
1504	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 4276	776	msedge.exe	80
PID 776 wrote to memory of 4276	776	msedge.exe	80
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 5568	776	msedge.exe	81
PID 776 wrote to memory of 3380	776	msedge.exe	82
PID 776 wrote to memory of 3380	776	msedge.exe	82
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83
PID 776 wrote to memory of 2848	776	msedge.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\SKILL5F01A.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff381f3cb8,0x7fff381f3cc8,0x7fff381f3cd8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Users\Admin\Downloads\Honeygain_install.exe
  "C:\Users\Admin\Downloads\Honeygain_install.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2404
- - C:\Users\Admin\Downloads\Honeygain_install.exe
    "C:\Users\Admin\Downloads\Honeygain_install.exe" /i "C:\Users\Admin\AppData\Roaming\Honeygain\Honeygain 1.5.0.0\install\Honeygain_install.msi" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Honeygain" APPDIR="C:\Program Files (x86)\Honeygain" SECONDSEQUENCE="1" CLIENTPROCESSID="2404" CHAINERUIPROCESSID="2404Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="Core,Updater" CHECKBOX_1_PROP="checked" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_FOUND_PREREQS=".NET Framework 4.7.2 (web installer)" AI_SETUPEXEPATH="C:\Users\Admin\Downloads\Honeygain_install.exe" SETUPEXEDIR="C:\Users\Admin\Downloads\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727814542 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\Downloads\Honeygain_install.exe" HG_DETECTED_DOTNET_VERSION="#528449" TARGETDIR="F:\" AI_INSTALL="1"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    PID:6124
- - C:\Users\Admin\AppData\Local\Temp\MSI7A53.tmp
    "C:\Users\Admin\AppData\Local\Temp\MSI7A53.tmp" /HideWindow REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Honeygain" /d "\"C:\Program Files (x86)\Honeygain\Honeygain.exe\" -silent" /f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1896,16985695449931944753,10439563737803204949,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6198DA72AB283DC338DC7D7E68D09E1C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EBD255C0320EA00BB052C7157CEA2620
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5188
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5109.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734484 264 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.InitEventParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4020
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5699.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240735921 268 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.SendStartEvent
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5540
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6030.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240738375 272 Honeygain.CustomActions!Honeygain.CustomActions.CustomAction.SendFinishEvent
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3156

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3588

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Honeygain" /d "\"C:\Program Files (x86)\Honeygain\Honeygain.exe\" -silent" /f
1⤵
- Adds Run key to start application
- Modifies registry key
PID:2096

C:\Program Files (x86)\Honeygain\Honeygain.exe
"C:\Program Files (x86)\Honeygain\Honeygain.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3244
- C:\Program Files (x86)\Honeygain\HoneygainUpdater.exe
  "C:\Program Files (x86)\Honeygain\HoneygainUpdater.exe" /justcheck
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6104

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e594cb0.rbs

Filesize
3.0MB

MD5
28699a679c5e333d8da9dfa814906d27

SHA1
2bf91dfaaca0566a3ba4693ababec99c883a56b6

SHA256
6851b449d9bf4a2e7b41deef8ddde61c6a5930a3b4add4e1ee1ad6ecd8a376f6

SHA512
b1221dbd655f7eb305ec5e367f0cba6ab5f61f19a923ac289a800a3fa302124c2c08fb6f846989c614f487e86afc04dbf730769d89b79a26b6a6f3d9b557b0fb

Download Submit
C:\Config.Msi\e594cb2.rbs

Filesize
421B

MD5
716a3f18370c1d4cae7b2019f1380171

SHA1
49fc5a03461b42cab66a589de3437c53e784d1bf

SHA256
308feed3b42e57836e1e40242ce1acc0ff2bd8dc81bfd8af9106e43acce5cc5c

SHA512
35cbc42c4807a83adb19d86b220626fe495886a44fdbfbad7d6d9b427abfa9693a2e9410c212dc025c330706d4486c152dfc927cf0bb995004ebfa50faee2333

Download Submit
C:\Program Files (x86)\Honeygain\Honeygain.Proxies.dll

Filesize
9KB

MD5
580f33384253251956fa5375a02186ec

SHA1
932463d19275a688302205c3c24e6ff1c588c1b8

SHA256
71fddb3a0e0341665d754e90c44eaa393dff95b355ed79f90979e046846ee044

SHA512
80db64005e718668951c972c444c70260a2362f51b1ad3653be131b95bcc0bccc90c316270223a4eeda287fdc1c8b950b1a5738032e7929d92c187058192e886

Download Submit
C:\Program Files (x86)\Honeygain\HoneygainUpdater.ini

Filesize
218B

MD5
35d05fe6861003ace0bedfb8c8782ce4

SHA1
2daf0ca2ec4170323ae951f083c6db62ec029672

SHA256
93d57ffbaf389de91799321b739dc0006702761ac7287e333aa7cebf3cd27bf2

SHA512
42b5fd5d722312b959fef0e7f509a4814cc0acba40760160cac9033dabe40416b11f62051190594d281e2f4b7eabbe4713c78e2be8688cf9509c4738db451c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
665650e0b3579dbc38da63b05f1e4cfd

SHA1
1f99d6ac004c87abb8b31d55aa95da66d5293c65

SHA256
f42b099df509c753b08b99e3ef3bd93d9266911ed1093ade56d985b5f44cdd1e

SHA512
2ee454e2d32a64d26d05c485bc795b933fe0054cc790c99dca0be91fb787adba50c6c825b851e0381f7516697fc48eca605878a2a9d20fa279ab61eb365d2596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_2B98B7FC39A7D21598AD99348E996591

Filesize
638B

MD5
1f3141476806488b1402d32e1a9b8534

SHA1
4903a2b25503fa9cfc4626fe55ddf123cd8621d9

SHA256
521d8e677b6c39266ed9c78a300477a39ef6a307a61810dfbbf586affe1f3288

SHA512
ebaa8e3084273f6c982b32d631df12e641200076004d19ecf4619ad5c00cfea5e706580387f729d083783a678c8887827d9350665b89e0cec7252855c19fd296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
06866f6e21a161b6533926df33349cdc

SHA1
0dd682d5f3fae21034b58dc0294098ca9aab521f

SHA256
5541ac938dd750d885e11c118a79533b5af9ac71256dff6b74bdbb799397bb80

SHA512
c7e0c67db61781482a02c907f5d25d3e75e8a6f1bf7d28b9d59ccf99d11b46f1e0145392afb0fad079bd1327765a657ecd2299a0bd5b76cd86f89d6afede882f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
d8037813751f38776eadc2381ddf49c4

SHA1
bdb99b54ff1587d62760bcb4c13afb20e1a08657

SHA256
a53a3086df03f430a302f21e425c9bc8bf6d4b6ced45fc7d31ce001f305dcb3c

SHA512
61ecaba1ff1e64ec4469b680f09bf0f4ce19e810be69c1d9405fe88320c17bca2469d6b20295be0367271b62ed8482c37ea169a347f1c26658b444ff29c70252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_2B98B7FC39A7D21598AD99348E996591

Filesize
476B

MD5
d1d5c4fb62635d93ea52d379f1d198c8

SHA1
8d370278236b31cad33c1edf777c6eb97fe3cab5

SHA256
acab5bd3956c756fd893e10f0902062538c003985dc304fe3759f34efb9c99ca

SHA512
11e581229d79626006f8c636c7deed7f099b36d2c94f0ad36531925c5ef67488d17bacedcafd8d838172b4135d82c271f883dcff600c09e8ae7c399bb132a6be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
7a49cf37844b2a48d2c457e4ea560c02

SHA1
86911b34dbdda21ac10d203d58dc90273734bc0c

SHA256
afa5a11fa84adb54c546063ab9bc4950209b4c65ed08a2461045a512ef2bade6

SHA512
4fd3d15b5e2e13cb245881a243098789f0178339cdc675d19a89f15cbe9a52c8cff0ecb3d6a1ed6f69b110e02f39b19da3e1f55b76c57d2723a7c6a477185cbb

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\3xzu2osc.newcfg

Filesize
4KB

MD5
8f331ef7c5db192342ff80f225348c07

SHA1
e6e4776dadaca0e587b6919afcbb53b6b4b39889

SHA256
af80805635dd0771913ecc96db1a59cf73c4ded2a0b3d2a56704246f63fc504f

SHA512
4af123b06e63054dfcd43437bfbc1bb4025f6812095203e135db01808d1d76fbeeca6d3c9f8cab63e4b09a342b3b114bc7faac6ab40f074f6ebfec97205fd265

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\4snh5lic.newcfg

Filesize
1KB

MD5
5529b08721c6ba031f9e6b0069c1c0af

SHA1
d19694d388b0d8bb941c9d764b22bcfd16809c27

SHA256
0065e25bb4ecee04b6f2affb23beb4b91cbf74ea3b5fe98600af70e2f8ee2eb0

SHA512
0b82da3035208cfe802909a8f73b933613cc829f21b1b6c5fddec07bffb84926fbd34ce42f69f765e390390f64ff561d38a5219c41b154a2b3395f0ecfd6ffc7

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\5kuzduuz.newcfg

Filesize
1KB

MD5
90ab94a0e3b508dbdcfe37c207fb0d1d

SHA1
ce868b5e2b724790f56ac5246c57f9c92147a39a

SHA256
77cde932b98d54d81d78cdfc0837feb3a4cb9baf25cf3ef33d386a3904951c78

SHA512
681295d57ac7ef56a235d83539fbcd7071a182b106a41143d58be3170ab2c355465b9330e93ab7dbefcaa9967a153e9b1f28fb66ad743403eb75be4260955de8

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\av0djzii.newcfg

Filesize
1KB

MD5
e065f05ac0a901f1179bfbf9b37e0e0b

SHA1
456c22c211dcb45e9e047d5face7ee2d186c15c9

SHA256
7b62a0644d90c3d26244d60d625cf1a4bd305b76414634e739154a76ceee189e

SHA512
372dcd2239006bad91d5aa223f9d0286fa6c6a201d8ebec1f6f89a5cef790ba5ce773e2821d7c85cc5e5864ee4b405fcc406d97f5ce46c2fef6c0a18001d8e88

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\d0gs2c4l.newcfg

Filesize
3KB

MD5
1a19d69e0e927d7ccb8b797b1d1a44d4

SHA1
6081a61afad28db78cc0097a455052dfbba7d5e0

SHA256
1df41235342b568b3227e03739434d9fadcc8cc4ba0a52cb02f2d128513765b8

SHA512
9a70419826fd0188df611f008c6171bad1b8f73d876bde9fb2ccf6c6124fc7c711bdf6c451fcd40a2bcff43c93df04d610a2bb70b9b1dd168ec0d7cc986c2aa6

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\dcsdowxy.newcfg

Filesize
3KB

MD5
88c4a0f96f6a7b7f2d8464893bdcaa10

SHA1
7982651d48e63eb7dee8fe558f19a02b468d0df4

SHA256
45e14aa0be47876f645f8cc887f19a43e89dbf6f0121294c24e474916fd9d31a

SHA512
dc74323503ef336eca320074b76266c0d3e8964cb9b4f0903f198917492d8429d4951fdb737fbe7814f62603a54ae9dc9ce6372cbee97a21f7f8133c4d28bd00

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\faglcbiz.newcfg

Filesize
2KB

MD5
2596314aff96faced9eb6e253ad5a3dd

SHA1
44677f5faf439e4583cdb0218e70f3dfdac9501b

SHA256
86c3eb8ed3b33df1c1ee626aeb78d5f2af8ca16142b34519b5affd240ddb1f23

SHA512
6fa7a4d31edee358a149532e1b0ded65c0ecae6c3ef4cade618c79e10b73987ceb1f8f67ce06840a512b3c2f71e1f3fabdb8d814eb0df3ca20a258ad5f489c89

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\fuzed0h4.newcfg

Filesize
3KB

MD5
c21825f89efefcaddebf94a5e490fef6

SHA1
969db7469133a3dedc2a09708d7082807c802b68

SHA256
2454e695b86fdefdb27d6b09da633a34d83f59e3a8c89ebc4c5284fa6c2c350f

SHA512
803ad73e38700c2e9008c2dbccb97ccf78ae15a5c7febc4789cdd4439bd96ddc538a6c7faf10b92252e60ccd36f9c67bc3ed080b3aa8c5afb2702a2409e1031d

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\hgz0jzdr.newcfg

Filesize
2KB

MD5
9c3294db1d251f380ded03503a4a9843

SHA1
02578d7e0b4b73ff5de1add1b3d37a25264f6d5c

SHA256
1cdc2b4f251f3c71a7131019245f8c65d77cb3d126f1c0c5f9f27108e7388572

SHA512
bc0dce8411bd344b15be75ba5d9a660bd6c2341834b448bce18a5b762dc6015172c94b8d8f6307bdc931188a81409cc8c3392cc31f53a05c0140fd17cf3d27a9

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\j3e0mx2f.newcfg

Filesize
1KB

MD5
48c75ba6dffd06d24790a7e5730e9b9a

SHA1
e55ef617091934dd5f6deb2270defd9dbef805b3

SHA256
9e0ad795cc57c3abbed51618bc604931343828ee859eec477bd5599d50fb0b36

SHA512
2f37f72be5cd610996da3ed57e6e282ec22cce2b8dfedaf1fbf706a7ff726858c4058b8f2c256da9603ec8625367190eac94f41e893a465430991723cd31334a

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\mkmrj2uc.newcfg

Filesize
3KB

MD5
a35c2ceeecc8116c6bbd5a6822648889

SHA1
90a33069271b92265594bbabaa25579fd9030cde

SHA256
eb2372a176834634489ddc8264012689627290049eabfb7b7cae6e99b005627c

SHA512
a82d224f668d7eb98b506d7d99006a0ac8865c0a167d6095a8966d5b7e10813a33efcb4591f4ecc351ff53a5ebf8f8145ba10761c765c9127c5a2a4fc0b087af

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\user.config

Filesize
1KB

MD5
ca9791f332672697e3cb4b135bf0b284

SHA1
8fbf103a4f2edb7a9019b5709db71d57ec31a8d3

SHA256
9c3558b8dd5850d8085a8a84a4195cdae8c9ff555e33572f08f751370963cd07

SHA512
a4360b7ccdc50642f7a991f208e0affde4ee90d88402c38d035c4065e607e4f9783ae22b51c5453f56a8f9a80fb61775bc2f5c0c8bd6cb0c88068729880f5279

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\xb2jjl5z.newcfg

Filesize
3KB

MD5
bd31c7346fc997ad0af32738e90f5bcb

SHA1
34b9c31f1e0a40954c973f55a6cb32314b1a2c36

SHA256
e3413a1193f4bde417648bda69bfe7c49fe9652e03c53dd4d135f860c281449b

SHA512
3d67b695978bde8ec7d53106b83ac671eeb747dfe000ef50bac6fc6de9288fc7dc5e110ac312baa4b4a03044951684e3b65b9c65d0e8f5e8c69eeeafadfb92b6

Download Submit
C:\Users\Admin\AppData\Local\Honeygain\Honeygain.exe_Url_epbi3eytgcbwwd03t3prrswshfoqg0m1\1.5.0.0\zi5jlpvj.newcfg

Filesize
1KB

MD5
169f7394ff32b13efe02443e948c6ac3

SHA1
5d196f5aad9772f73a0734ca46586ac4c6389699

SHA256
618c21f5a32fde6bd5bcb8d85868fc1263760604c3a2f98c53b884a42ade4054

SHA512
9f416355e20a1024cde977ef984dc5c874f5fcf46aa74758c13cffaa175e44c85f575a983309e2fdfa91854d6ba88b169d4367647639773060357422336a0492

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\noqjedrv.bk1\53v1wbt0.0l2\StrongName.rxsdcoe0fgrkusatkm2iulf2djbyekf3\AssemFiles\countly_data\userdetails.xml

Filesize
1KB

MD5
14921dec3e0fab83b3ec874fe02fc63f

SHA1
12bac21929bb3aadd4d24b80294b45061f613bfb

SHA256
fa538bf6c7ed503b921c021892093d52765ac90c037d230a78a93fcbca471519

SHA512
2644b2edf5f3ef2bb8847f8a8845b94641b04069cdea68a6974710078254132ff4c097adca977048657405def877411e24b556ac7148db5d725313ce2d6ddf83

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\noqjedrv.bk1\53v1wbt0.0l2\StrongName.rxsdcoe0fgrkusatkm2iulf2djbyekf3\identity.dat

Filesize
514B

MD5
e831d90e323f1b22b0c71282f13ec487

SHA1
90437b1e50d16976d7a9845f5e86c25c18d50464

SHA256
1c19142a86595dce3c5a617f4011ffe52002d9e721cf7a9aa67878042a10489f

SHA512
e48f75bfb83dcf0815625ea59669a66781c5544cc222578095df39a89caa1edf611853700140c01e864a49ec0bd112668314cc7be0023c4cf6b5b8b6458bb727

Download Submit
C:\Users\Admin\AppData\Local\IsolatedStorage\noqjedrv.bk1\53v1wbt0.0l2\StrongName.rxsdcoe0fgrkusatkm2iulf2djbyekf3\info.dat

Filesize
64B

MD5
79f297ecdff08bc6f5f328d518660a2f

SHA1
fb37facccd846f2a86a40d3f9e487bead526abeb

SHA256
caa8d9ccb57fbfdb0435cd6b01118c469cc9723a74d0530770f917db3b5a6f1f

SHA512
ccf04a4b253fc59ffb25a165bbdc9f9c0c57da243cb6d4db0ff23aa9ec818c2def66124b124dc3267dc30e88dae983168aa31f68f7e6a88d79556b4b5142dc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94217f69-566b-4a73-83de-9f6ea92859a9.tmp

Filesize
2KB

MD5
ceec635f5899358333107ae3b56575f4

SHA1
fa5c7b2f6c92a0d33ed57ce33184862e2de5970f

SHA256
73ccad7e534b0fd0f35cbbdfce42ed91d838bc73c1fe3757bd5d73534997ef91

SHA512
97d17179fc64a67c8baf136fe26accb652684852665b9784cd1f6853289a7e86d4c0214b6837a89a21ad708b8a7766048a0455a979de420d214563c2e47dd291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
57KB

MD5
ca02f0538fb4f32d9e8af05e49256b32

SHA1
18c32fbd2c4d50d23afedac285d8c6cf429d5cfe

SHA256
3eba2798fe3c48ad8c745f120a8295164e00d7273586287a743a3229921f88cb

SHA512
a18274adca013b0661d17981d8c8a9ab3cd9367ba904be1deab74ddf0948963827447d56529197b0c30a74cbc3ed02b9bfe5f674912d2d1e71d6530e63d5c6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
122KB

MD5
934c8a60af59ce68d706f7a0654731fb

SHA1
e15d628ca1d74e207b7edde125e5494d0023414a

SHA256
07f777f60eb7d81036f11cafe704376a7868108e11cbd20b4fba36affa4bb8e8

SHA512
e353ab4f9e29a8b3e79501ec088dd530632dc1265e2df27d2f502502c610674b5a51097f7f2540330af48ca5c3562cfdbe51040ce3e31cf161a8af61f94d8a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
21KB

MD5
8d975ae033af5e8aa546c6bfa89c06e7

SHA1
aa05b7b60a1211581b11e3b6e2de6f25126c0be6

SHA256
fad3d6e2697124cb7a2a3a62d4daef6df6fc4341287d648d2b9d697f5e290bd5

SHA512
729ed443f4676bdc5d531a58a5637eaecea90236bc781469f82ef5a306a89d25863ea15231b6d2a12370370205d9ec4878d7ef2a22568d8c426fe82529240c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
26KB

MD5
e1fd846710aa5e77add9800906d17ed0

SHA1
2d778c0601d18e7fd3930cbb4b0068b6eb3a05ec

SHA256
00b8d8ad266c164444fb240a4b07d4316020c74c087e95d37547b54ea1051772

SHA512
a00333708ea6f9efe940e8e5ee6ecb9b74063279238beb9cebf4847023a3f94cce34aa497f8a9ed99570a5407eca3adc9f469afd3553c71e6e8a05be83026341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
94KB

MD5
e02ca872657c14ade83e5233f77b05bc

SHA1
9bffb08bcafa7ac080cb839475a41eb802d478a5

SHA256
7b6633f1e1feff95d80c6b05c86e4200481413fc4364d1e80d82a70952649143

SHA512
427c08af168d1e3ae05a95dd61a19142b9916a74f0dcc7c1f6d032287b6b293d1e7f078a2ff3c2b22f3ef306ebd8a874338ccee469c215d98c0a11af39c75f24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
23KB

MD5
5436202f05a6b889367e5bf0f630261e

SHA1
5fffed1daf9a96427bd3fb974a459fe332318593

SHA256
094c89c2ea2898da52e197f87548c2090e2cb13690a7e0afeac832c247405e64

SHA512
54fe51e7262f82777507cadd07c48ab903f1f6e5e3e098b962abeba9a10b8b4a9222e12e8a033f167dbeede20005121141e6f4f341b1db077134ae9b7006f5b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
24KB

MD5
431c5047761ebe47b964c1167f2c2fec

SHA1
13131dd712d1e2634a0c9333332c2466d7f31d50

SHA256
82966b0524dd05e22fbbb6d08f4b3f5161064cfc49b55bf1dc4eb55d875d1b9e

SHA512
f6cb63ae7da2ee4d9405167ea729f761eee870a4a7d9804e80fd8daf8f581a64d752aafd56d2dd7e0b6f3d2f7f662f1fc29a49d93ced64a6a9ee0b3df31361a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
38KB

MD5
4fad09541ca18ec297be3eec955b5fb0

SHA1
c5ca976f2e9160b53d1564ab675503d9b181ea49

SHA256
e88ccdf63ff2dbc9f393eeb316fbcc861d6a389bede48f9420875d781890a68d

SHA512
b8697b03d3018f3fe5e0b7b6ea3c5778634a882ccdcf7641867e3e4ae58919b18171cf51e0025bc6c69f65055725e3e59c94cbca5a3e4634a29a878ed2592136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0a4f80aa563fbb2f_0

Filesize
253B

MD5
42893c28f6d42cd96415b156f816dec6

SHA1
e54263d756ef3015d057b46169ced0626fbab481

SHA256
524310f691a5a06fe2dd5acf7c405a31cb4ea8cd51279d068be0693cf96cae58

SHA512
f40911881d2fc5f2997e3612c0d61a9361796728a705403ed2070dfaf5022b027c3e0aa4be4b089f14bd3183021f728314ecc70552cb73a648d277efd44d33ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
de9026f10617a6ac6335df3833fa64f5

SHA1
80e8e5a77bec0570015673a7a6c0e640a99c47fe

SHA256
9e1be3fa5119f9cb42e46ef64b348c2b02d619c84dd8c2472d83e5eb9b052432

SHA512
25c09523a223c42be69824d0ddc4f02e9d9dba087cd1c5298cfcf7190f7f6389c47b03d4789862764e24ab028595537de59329a925d6d57eab5135f1a28f31cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
27312f92e16955199abeec8cabf3bf6b

SHA1
02d25fa033834c37ed6c6caa945401b098ed65b6

SHA256
c2226724ecd003f04dfcd3204d32279ca2ced7ca3e4dfd3eb59c3d8a95c7f0a7

SHA512
83939299a2ff007204d44bb37ae81faaa4034288b28c517746037fa00ca052aa11081551eb86aeb8de070f5563491644c754b1b98d1e43e667b5427fa33821f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
a4a444716872706f2b92795a498ccb9b

SHA1
a2f50dd7ca07b8241605e4260a999908f126d959

SHA256
3ac3c0c075cb5a05ffd586e7d92648b5c5fa00d9a061bad42e89c238f1e48a34

SHA512
e2f1b174576aed4e2d3d159933157d22eecae7e78fc87f1229c51cd0def3d358a6e0a7825e00fb9ac540075ca21c69dac904dd786b997fd4ff54e125a43586f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
46ba0fb216a19def485faa1cb3194fac

SHA1
e5012d4ccd6f722b99ed2c61ac2363ed5dbe75af

SHA256
5d841f9174a4c96272d3efaa2b5ec6bd7602451c5a4da6acc539320536c1f589

SHA512
83f16884944faf436d9b9e4947a445de3936e29799ad42fe441ed07ab406cf137784e30929bea76b0635058ea3b545c6ec02771477c352604e1bf9531a6b99ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
87d1f6650eb45b7b000c0d37de745559

SHA1
504bfc2e72d4884db1d92feae0ed3f675dab7ab2

SHA256
5abba3e26cd8b3e0221b63ccb86e09953c94c24947aaa30c1f282754e1a0f492

SHA512
025884d30ffca40f29a129c9d77e2c26e5afbca47ba9fb863e24030efe2a8d0e666c4126d8955653028c9b3d8f4029814f94ae0bcbe8e96e212b0ae7f1761bd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
8386e68390b83604137aa132184de39d

SHA1
6a331fe67628d6eb509d2ca9d28ae5c07ad911e2

SHA256
b3389509ee88ccd0d14865a02fa0ffa2c65d7a4ddc678220a7ac5ea2e543d1e4

SHA512
b98c2d5ecd23f58eda6a3ebefc04612d33d87e2ce21e7866f2bdfa0acfb74ae2983574c38b087cceb682ccb83cecee65fb08f2ed81b2e36477e960259ada7267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5311338a701d4340c5497fc191dec23b

SHA1
d77b81e3df8d0928a6d4433968367e11a9513040

SHA256
dec09b5aa282706692a1883e9e6dfd4daf90ec3aecef309883620b2b28bff7ca

SHA512
5cef00510e3f0f1b3e732914b2afcf76dbcd087a3d20bf8fce87d70fb3dbb036edbae7e29f00c855534c55b92dde72220beba39236002c72875f2997251853d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4843ecc451cb26527cf3f71a3df7d996

SHA1
81971b4c342d90b5937fcbee9399620e837847e3

SHA256
cbbf8779556a10778520eebb81890966901a71f9e296f7a2dcb3b4cadd04f14d

SHA512
5c2509f661787d8ec4a5cf1902d6420ffdfd8fb9a08188ab2edf8b3af1ced6cfe021bb1b63ccad57991b55afeb3758dfba5bb2aac771836d7b905944f6869758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
cdd9f2563db705b6793ee75a5ed5fe43

SHA1
e095df522750981ff3b3acc1583e568e2768acce

SHA256
82a1c67203901186592933f03140c790891b3a415acc7875ba6615b016cb440b

SHA512
15e422c183b6b708cb2471481b43d1fec3e0bd34972316f5ce80ce71a150cd8a1840d450503d049d8dfc39d1b8e845e5f1df803fc4dc4ae65252be98d32a2a12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0c7dcd82bd318b1510e4af4f29ad9d18

SHA1
05efee3d745f9cfa2f025400f7bb609e9ffd4a5c

SHA256
a0766fda343e6f071b36b99587bff906d19e2a6e4fbed954233c23ec87bc11dc

SHA512
dd51b299cc409f3d6df02df3ac6688bb650b45ad9e2f6a25233d6ebf451f21dd45c3032dbd6402a96361a4f180a154cd4b6adc4e9b509fb85890e0ee52f6784b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2facf09fb613dc0a8f15c035a47ea156

SHA1
c6f8ae307d3a3e292496e0236fd4258c523e56bb

SHA256
81f24c270ac1d17b0c4bedb53be421f8b1bfac12b5df1964629bee8491cbe2f1

SHA512
b12a1f37c82eefc181e5562da65f8951558a8d1b837d1b007be5cbd360f8a6b4879a024df307d9d4bc62d1e19011b603d49f2d13627121f2e1cf5c06a184fe84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e0e715fcd7f75a36b20524534d7731d1

SHA1
4ecc959d0f8eefd0ca0b1a8b6d83076473acd1ce

SHA256
1fe8b90dfdda8c573dfb9571aba72919c013560c3758db95b84fc949a3714e78

SHA512
696a3665396ba40c6ad5bd730b1a26fc915404e846ebe292c0bec3ab7001e5ddb11b499eb83db52eda09db1ab1f6f9e1a9818a498bb85c639b3ee3b79881f063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0aebed01644a4910fbbc43eea43dfc10

SHA1
6bb021c4b1a925677be882323777e5c559e332c0

SHA256
64d6104e772245b27efb7bdf8c1ef6e81ba559b9ff79d90239ea48c6610582d0

SHA512
4b760583661f346723e8e99f6864c772d5cca22875b995bb656aca95759fbc9c63aa1ad50dd6fd2da2da3178d7a4e1d3c7ae134d70a7514b72ad8e6193f4c5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
34b7d9516290aaf6e264daa479e42bd6

SHA1
8674d7b7232ad3f1f37af7121a90858b0a12aaf6

SHA256
da3607fd6139d40c48714624b458dff77e2de764de5a193df15512c229e919d4

SHA512
91356d11188d8f0333fc5908b002b9a6d32d6eab51b2777f4da10180d3fcc6843fc745d08a93bb329107d767fbb467f3707eb763b65c7bd672ee27c71ea37cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c1c7926729de3e8960af31f9c8966ba

SHA1
872759b8a9d32fd99f069eb3a2c69c4d42c1e721

SHA256
9487076f6da0b785cbe08dc3cc9c8e51ff580e05c637fcb8697f065edae50be2

SHA512
ef364d64aea1f5c3c3a85e276574e80e8331988b93ff1218867dfb911295a55851391fb359f84e97a89a0193209500ce77bf2bde7b1ca6fa915f45ac2afd4d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
904a93a78954e3482af1c4d9511afc1f

SHA1
c7fe5a8128d7f28c2af217fe66db131211d66b93

SHA256
002fd7a0d0d93dc69ccb49a2bb4512e7229e59944b68a848452cb8e57b94a130

SHA512
d1161d9904ec28568f6b27cb37053aa8b7ec65c72ae9ad7ba951eb4b636d4c2e5b6fc885943dc669e6b8e813a32201d89f1a39ff84c947d2c8a620cab2337f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7e23f9d1079d6eb3175d6927ee5db84b

SHA1
6645d2ccd49c5678568f85bc6281dba86cf6e61e

SHA256
1b10f6ec338b76ad7e053ddf9f23e1014096a9ea4c6e6a8a9f4e3d374e868fc1

SHA512
26f1a27bff17d45c3795916138956c4849610298c7af78d6e87a8573e25b9989e43e7cd5a9736bd63ad83219fe1e55330604df507d794f1a48bbeaa9c2ea86d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1bddb978d58f1b04639421f354e5b86a

SHA1
72da7a29521c9698799bf668b22df636bbace0b6

SHA256
0f2dcc1ca01358d92c90667e41f0a20854db51696a12df8ffb5e95c1c803a44f

SHA512
4c56367638bee692db9951adbd0c5278fbf9f8f04ac7cb73456e8d46f8a656731ea11eb0f9cc7c1979500dc4ddb8d0789e0f8903ff0d931656c6d9d82ca21ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0f8b6caf5887b83ff6c7da5f97442802

SHA1
db090d2a66e655e8f8e31aadb6c51c6d228829f4

SHA256
478ba7949c2d8a4543acf6e560c57a90eceefb79522458cd71f7092f6c1bfba8

SHA512
4ab8fbeacb4158a4a61bf767b1be3672a5275abbb08997aa257514a1a7b5ee7a33a224d84836501e3320e78c86e62ad828f42385fa0a53f17df2d5e88770cef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
119ae3841be3dde71a32e9c6271be221

SHA1
556533fc2ebf81917d955551663e0fa77e8a7f9a

SHA256
f6fdc65fed77ca3debb8a8551c33ce7035c52e07a31590b4702819a270cdc9a1

SHA512
6fb83413252ef8755d3b4cc6deabdf3ee7823b677331b134a3b80300fd35643ebdfad8ce3b9717d279d614956eeab3d041d0ef845f0f6f405d98357fa110863d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
68224189b6fd3ca3466ecbeafede7730

SHA1
663f1203dde5919e25308a91a84aecd8e7a53abf

SHA256
ca57b23f66fe860378a836fadde82248f518bd8c2b77e06f83e90c7710874c8d

SHA512
9088d61dba656227dbd81aecebbf2849fb03fb4724678a1e041f3fb2ec7a0b694855eecfc9567bfe5aa52a10e839d1711cd15b4d2ef1b0d2dc413d3dd237d05f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b13fac94f8463d6fcbc96add4141c327

SHA1
a1afdc571428981da8c7d35fa75f5eea5e9e638c

SHA256
a012ea1aaddef5dabd5eb6ceb7e96641fcd1553e20887c1f7531ed8aea28f049

SHA512
68d050765e8e94c025ef58ec99422dd3ee28e58137e7dec29197371b5f0a714b8b93681adb10e402a666066f33ec19d5785fbdeb905ae9dd7b8c770904d68627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2438109a6866bbd44cd7f3b2b535598c

SHA1
18bf6bf6406a3fb3da5b80a8019911ca7f8ff175

SHA256
ab4f77415983747ba64658daf1ca0eb30efa0227a804cb79b4402fa49766f2de

SHA512
038e163bc3c23d4e94b8d199809c1fbcc855d605db800e30f101fd57fad94c7cbe8ce0ded50be751ca8cc2c442fff46046f66d38361b83159262ff9adf1011f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f56091f15bbb3c4bb938105e80efcbe3

SHA1
aa44d230358e0003e06c42fed5988420293ee8c3

SHA256
286d71066cb32b8b83a67fb2e72a51cbda3eda3e67a9ece3a0f40183b64a8f2a

SHA512
9b6f9f4787c9107f708dc0bba3d242c8748f388bb4df577232f311b0c02245c862036ba77a641330b37d05ceb1bd918b8a1e52eebc012a8b5cd89e2ad6de0a50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a4605b1b26d4cefb750c5a4d135e1f83

SHA1
27df922e9438f1d4d1b585c4e7225742dad32073

SHA256
4318ee12830cbb6709a416efbf5124c09ee93a1ea9d0364cdc3abd5bd9fd50b1

SHA512
345967b93a78a58b3010be7637df7cb470c16a829b1fc6270201c480dad53e72216c1b453152e8e8d3d6ba1136d12cf9fc4626bbb9d4b1c6102d968fa624b668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a22539ead576f385999cdab9761ac0f4

SHA1
2b1ada5133066ecc9cafc0a25f2e376b67d1cf3f

SHA256
ca83685e68c5d9f899ee8e86565069daff242c74bb1e61953ad7418d118c728d

SHA512
4a0ff46630061c052d1276cdfe3d3b98d63d0c970c21a6f117126c65ebeb9b4ff5fe4e184ff544a5cd7bcc0ae476235f5af73d3ba97ce7f2d9df8c562088ff31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3228cc989a09717e6252b1f5e5e05f16

SHA1
798c1b9b3635bc6011957e0fdc0e776063ff42c5

SHA256
90fd0afaf2156c9e0450f4d09e229265d75ea2a6ec6497d143f8bf2bcfc13019

SHA512
f61455d67a86870d6f35e7169097d196380472340493d9dc97699a4e085838f8d8a83ff43bf5ddaaba83290d8216b5b1fd726330fbe27eca56200b14c6686cd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8b4c3d8f3e80d12119adf130d776c92f

SHA1
4b944575601d7c3f818c561f86b6fe048fdfea48

SHA256
0f64b011e34ddd406ba7db5a5df0826a3a924da4473155ec060372d79ceb328d

SHA512
5524bdfbca7bd05356fd6092148eaca8bfe7864df9a4359984f60c21803a4991f6270e332358d7dbf69f0506c5815989ff487049aa06d65ab509b4008d5cbcae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ca37147cd3fcdbca9ac6be1da6feca3b

SHA1
e36717665569259b3ae32e20bbe5c9b1527f82b7

SHA256
d673c03714f6f10ff4f562a1ee8dcca93236426bb3fd1448ea20191ae205777d

SHA512
0f058bf6c8e3e6f8b8b2313c19cf389fb1cf104b695af304748385deec7ba3350fb2118d509486d359d49a254982ec85c77832878b93640fcbcad0ae8910f05d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2a5a01da17103a0679471116d263f68e

SHA1
3860816ece0e46b8b677ae0d8c3c57d477670730

SHA256
a2e7c2d797a80571a7d4c892beff651f40340c6704c575f564b511914126cd1f

SHA512
9dea9315985811a7d3070fa709ae7d9862be7500d541c2fe765a2f24e1ef9fa5ae2ff44fdbfebec12c7f32817b1e8a9383022707f525102882d5df830f2f9061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
dd5c8dcd8247ce632ff0b34918d26022

SHA1
ada72956e83c2d992aec86c1b1815f9577c0be0a

SHA256
d8c0086e10ffdd03c2f03cbfb9e20f069fa3d48df3a09150e1852305df580d07

SHA512
8e8fda5236d4b9c01ac933b045aed329d3b7fb6830eda7da82302fe9b49f1df5c929e6a017c29509582d251445c0f601137b2c4adb55449235f5362a160aa8d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b3e88d317a04507609f7bf1394728937

SHA1
c31eb592bed45efcf235f511e9e53834cadf7572

SHA256
abf7a7b9111506b8f7a653a4fb7266327b78183d403dc1945b41fa5fa040ecf5

SHA512
9e0a0705fe2911b4c300ccd7b940e82d5797222a71e94853c30d1104d69f900065821da92d09c246ca7f658d162e631509e72c47ccb07b7218f48f91a26fb88b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3603ee24475fcb2b0b593a12d928d99d

SHA1
ca2d80c525edacc0a02f5750964289f9f39e1ca1

SHA256
09fc123a18b34fc75ad8d880ed09a9e3cd325ff787b2e6b93eff13316b4cacef

SHA512
c1c7a28f15813b8f3a628312f7e4e5fda6e74f29d6c2b8e9daa689faa6fdb7b8d40e044995a346868052cff62aa1157c784e413eacd288a2c4f4772a50e3409f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
90103f005e4d268e3f306c8e0288b918

SHA1
e7edc026ba083eac02de339a6ba9d6996e96c032

SHA256
380b4a621f5ce95cf9295f008c078342427c1ae3c4b5c2af877832beaeca0943

SHA512
9b5497d34717a35d0f5be318f1f1c980b3678b431945134dd1ce309ab7f8ff828ca88b832f79a8065c6c06a4b35338acd90d7dc9675b150bf9fec9e00356c484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3165bc229631b1cc796b77a2d2bdbb15

SHA1
67420bfcd70b7025ea1ed997ea600f7157337a32

SHA256
77c68cbe4bfaa1290a6f62b17a39f7a384bd93c95b7a8d81a596f34a816cf7ff

SHA512
befc7eb974739d461ed5cd627c30745637859221875cb45d7e99724be670042a1f721c742cae46a9a53f1525fc6f590ce9a8716bd7eb896012651a77897b88a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
85c8d0bc87a41945c3ca8bf52af3feb1

SHA1
f8cee2d37103a2ea1cd8f26a2a54da1bdbbd902c

SHA256
2432ab1edeb8278597b6ed7a248465b9f50ffc08f05683edbe92fa33953844da

SHA512
fc5ea241737b56df90580ad8d0e4f1787c0511ab287651aaa6ad5d597894f308d95e514fa25c3ed255baef6ff359fae2ee67e92669ffb2117668f3acf5e1a9e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5843ca.TMP

Filesize
204B

MD5
7f07b744f78073b9128275347e854553

SHA1
d8c79b663619ae8d273550f632412642c4ccc678

SHA256
5868c70bb34b1d6a8a464666e51cf70c7c02b37327f8e56b97cbb9df984a8a69

SHA512
6968dd3954f0539f1003f310538e1bdb2ad3883e12a0cf6225daf3b97807156b033a8189d4c1b33294f37d90db0f19f01bd232a8d504d90e9a169c1ea1f4a72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
af693f0c14aeb093d65f975e32f2a4e6

SHA1
c244ccd4a72c98c6cce8547ecdbb78e62b7a42a3

SHA256
95e6040f61d1993bb00fef379bfd36dc455f3a668140401484666773b39a2919

SHA512
19ecb9d620a6cd314a673e2dbbd319621afafd7ebf3fb29e1ea94cc9486487048e6b3a2551693177a60e05e408934f1f65570e19ba2db21d9ae8a83de922acec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98d47a5fe224b4cd3eecf1257168d2a5

SHA1
1cb7e38a82e5141325bae46bb5c39b36fb41e517

SHA256
5beefb9867672169f243570f61159e87645a7591ee92ba9c1411470be3ff0161

SHA512
9e3e85fd49c6671c020afdd5ea99ad779e63e0ec60e6dd0330d96931a4c81c3532f4ff1d20d6241a2e2b951e20bdac58b7bc544da62ecedddbcb980637a228c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7bed5724b32d57957b074337fe1a8d47

SHA1
887959646797afbf30501c8a1a9b820946d8de8c

SHA256
29cdf8225d020976d8ef6c9d4fe8d630d0a3e091bb92226c0917db111058002e

SHA512
c8aa757a00a3b19f36791719ffe327504aa78bea12872879f72433c23011dbe0285df1acd8ddf05c3c21c8b7f2f4f29584c68232b497e30fd9c81ffce0911eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19d1c85f120447edc988012071871ec7

SHA1
254e58b706625d8f5c49905e4477d937bed25006

SHA256
4f91147e861dcef98f60df7a726435836d9e8c0da2d9f547d7a04e4a79f6cbcf

SHA512
dfbff9523b9b6255462a90c0ba73669b63cd0dbdb304d693a4ede9d22e782705e59df07cbcbda56a013a844706c540b2fdbac4e8634e234326981da844f06616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2c0a11ed1c620fe0c9c2db1c1246bd44

SHA1
924fc09ef13ec20a1b493eba2aad93365d28615f

SHA256
f20538f98f74008b61cab6644c3c5073efbdde3f4625614769b555101fd15d34

SHA512
498096298f8ca6d4971ea615909a13cceb73685a1bb3e5264d8917da24ae310d34834109b782ecf42506bbea7b0f01a618022bd84f790189bda8fc6e60ca0992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
975a7e23aa160232ff6b87218c00b717

SHA1
a4048cda4ba2e90beda98cdd17f441de747c197a

SHA256
28acd2f1b03feefdea774ad9a666527be120e13b74d1f55332ddd0e6124fbaba

SHA512
d20e72be2ef3b1b5acc9eed28327bf252d988be5e608bb1199a3614614a0a39684d127ac7367b59596e8edbb4de1751ccaeca9b3a5f4dcee450a37e7c8a8999b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68d77c9dd0c66c2031e6dba251d0222b

SHA1
43a99473a8ae2fd2c72cbf09e0c409725e02307b

SHA256
58ef979fb80c9dcac997548850a1279f306d916a9cf0b7d7ec1314b18cc257f2

SHA512
3af6918c9ff1f6160576b4ed9e2f35429d18c8e5ca126175e9af60676cd231dc62bd4eb3df4d1d294636632d05640bf7e12e18ffb05029eb8dffa16fa902047e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a2d2c0bf98ff4089903d8c6671682571

SHA1
4c97bf508c66b7ecd8b2f18fb1ffec39d081b243

SHA256
901427cad4f23a1afbaa642a8b32ae1a5ed549fc82927c772cf5e9a906d50c52

SHA512
9492a6405cf7e9e99ad5cf72763005e63fbbd2ffe797edc822a4de3194589fa226509047eb4cbbf288e861dd4858991ff1471b72d7fd0cb325a924c8b4d1d6d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
aeec27978ca244ed866aff64de811431

SHA1
1ce5edcba530eeba980111fcc8acb6037188f1ac

SHA256
117f2df6b1ebc111691055afe099f3a055cbaa2b55fb29b7b78657c31668b839

SHA512
93c3021325743c39d6ceb780d1c9f3e8714a514cf51cb1f06494a6bae314599f8e9ab6d59e961cb64d6a26a7af6379c0d2b1240d6f8f16192f963ed7b35a1a4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2404\installer_logo_large.png

Filesize
15KB

MD5
92a8f755b579ffc8c3f86ec87076f45e

SHA1
cd5536b089a281807eabe2def1e6f4020e2b124b

SHA256
71a8107a9f5e4464519fb74b4e83b7f7af86812399210f55a2505870391aec66

SHA512
11857b0eefbacc7faf7e1056124319c3acfc82eef0c1769a3ad7945a1019b85757fbd8f620a5bd360652c7f877a8634df744a3cee0fb0f7a07689522024d06fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2404\installer_logo_small.png

Filesize
5KB

MD5
743d8274c5efa5b66c12eff6d89f819e

SHA1
655ab5d69e17883d3651792d7c3ff7e133e9ab54

SHA256
54305db25aef864e71e02d5a1cdadf831387d7b850a80512e041d9fadc0c5438

SHA512
9f261f384932990796143b95cef3540e962757c7ada9bb0485df084f3c8391f28d31ac1eb78478c67eda56ffb1cb238924b107c7ed8e1c72d37cdd6acccc75ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF77E.tmp

Filesize
550KB

MD5
8259dc74965f3c8e91d152862580a773

SHA1
d2d029f9f9be25be3c5526c5a52449c034c673e1

SHA256
84f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9

SHA512
50903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF9D6.tmp

Filesize
630KB

MD5
8ecff5e8777908818edd94721ddc349d

SHA1
a3ffcfcffae1b44261c1b1a64917ac898c40b9e2

SHA256
1c450659c7681df9df21b20412c9647e7e8e5bf0f2945c48b1ab51f330f2516b

SHA512
8418049fe52dcf6e294cf58d200b7a7d8e704ba592b3f59243c4c5a4d661c60f8db97540badd9a1718547a0047b39316ec7917c43ddcb8a71bebad49e7baaf08

Download Submit
C:\Users\Admin\AppData\Local\Temp\shi287D.tmp

Filesize
5.0MB

MD5
b40e4304f279119d9345be970babce41

SHA1
f76f5b30e7c333efcba1d4e19215ef1fd21d6943

SHA256
06285446d57089fe85b3b6127bbc92508773af458ad5cf20abf4570d41c0fee7

SHA512
ad7e6b30b3ba32d641737f499874f23ccda7c4539def0465d1723d579c79c5e3e981df8526d31f2eb79dc0fe572eb4b71a780eb63df11170d4b6a0786f588299

Download Submit
C:\Users\Admin\AppData\Local\Temp\updF23D.tmp

Filesize
1KB

MD5
91d0484055bd80300fbcc7e546bfd0a2

SHA1
8e8024a1db97cae891cea172035e0ecfb24579af

SHA256
89f930d218b2afc509d8d217ee6b6ff8d29c5772cf2e2234fc0f8a46ef1ee13c

SHA512
2ee8859014b416282ba1e0bc4510bcf7cf290b1ab4a1d8040e76981ff14fdae69935ce0f180653519c86c187d5f997b83420060f3b0101906529c13dba6e1579

Download Submit
C:\Users\Admin\AppData\Roaming\Honeygain\Honeygain 1.5.0.0\install\Honeygain_install.msi

Filesize
4.9MB

MD5
89ca17e0e21a5a0951899a87a50915c9

SHA1
6d3d6c65b422b6ff2e473580eefcb0e767123e49

SHA256
35c9e82daee05184b803a76276b556802da4b76119cb9dc649bd0bae9b3e00f6

SHA512
95dae81f840a4143a497e06b58ef5fafe41b246f8e1b76fc4911612d24d57d267ab1cfd0c3372a80f0d229bd4e3a6df07775d2f33c9995beecb5304faa281d69

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Honeygain_install.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 959453.crdownload

Filesize
24.5MB

MD5
e5d5acd2bc76a50accda70ea55c40ebf

SHA1
75b649e01d35e7010d5d60c87545dc7ab47a3420

SHA256
67fb9596b6c5d0b12c9f44ea8b04d5843101935ea65e179835707f3efe715802

SHA512
3a3e318c926e70e485fbfd42db924fd4dfb8a44596725885372c940fb9bdbeb64a98c2374d4f5c3420e62ad5a67e7b9ed1b1338d83b7888280038ed15ff2e60c

Download Submit
C:\Windows\Installer\MSI5699.tmp-\CustomAction.config

Filesize
1KB

MD5
01c01d040563a55e0fd31cc8daa5f155

SHA1
3c1c229703198f9772d7721357f1b90281917842

SHA256
33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f

SHA512
9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5

Download Submit
C:\Windows\Installer\MSI5699.tmp-\Honeygain.CustomActions.dll

Filesize
10KB

MD5
d876384fc74128455bea88850a5e9ff0

SHA1
7ebd2ffcfe7c9ae2db01a2987735f63fff5e59c6

SHA256
a607b2a081de1e4b73a7fca055dc20e455173e5b875b12afb4724254c4a1891e

SHA512
5dce0c1603a611b1bd400c6a025aa98a18d35244053ca280367df60678fa74abc7e97e1558ca13245fb6d8212305c7c5ca5f9db44eaec4145dda49278f92660d

Download Submit
C:\Windows\Installer\MSI5699.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI5699.tmp-\hgwin.dll

Filesize
6.8MB

MD5
af3bc5fa1aa84f38eaecabc55c15d1c4

SHA1
fc06c5c508f9f3c8e8337e93f0af266e161bdb53

SHA256
a69519c0082a22e14b6b5c0f11e95b0c53186724d01d2c08e9a862438d1e52f4

SHA512
a7794a691f13841e4149b5146261e422fdc40cff7d7d23a1be9de5b77c408aa593922cb4f49d2a29ad2a72aaed1b86491dc75e9eb672e489a82024dee832e9d9

Download Submit
C:\Windows\Installer\MSI5699.tmp-\msquic.dll

Filesize
1.9MB

MD5
3247e146ffb02fb3d542ea75e21bf46c

SHA1
7c96c2e5bd73d5a895e13afc3a8106251d3434fa

SHA256
9353e700f5d9dbb03552d6b4d2bc52ae625ef508957e1a7234e09c4c377d40bc

SHA512
f690db8b0709b593091aa523c6995af06b54fe010966907653baa83940ae499900f19899b76b00c2096373bb4c39f8c0f26b8b3a0547d4f255c796011c80d37c

Download Submit
C:\Windows\Installer\MSI6030.tmp

Filesize
3.0MB

MD5
eb7d79628344e4fb741b9100ddaa3e37

SHA1
bec4bd44318b00af78fcbdeebc997ef05c2477e0

SHA256
64f44ef2c1d17b4142615a6e1acad91377b69b00efe65e3a690c66b138de755a

SHA512
9c7883ea2bd6099cd3183976fa047b8cc4d4779adfe73edebd9d7b916af7fec7b067c0c79a1fa99605aec65d7d52ec3929809835def6bfcca79d603708ce698c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
fbf451855bf84e3525e43512510cce40

SHA1
10b6c43fae204f0587b62eedf7998334b22161d8

SHA256
8d015180e4c233c5b5f9140a6bff12ec3b7b8a5aefa50b245e41a2dc924f2a1e

SHA512
b02ff636aae5adcdea47d98f08725568ba68723277ff10319aaccb1bcbdba8fbb89a3ca05f9d06f5ba686de25528937e150526a7570404633c39c371320a03bf

Download Submit
\??\Volume{2b988a90-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2eaf23e1-c00d-4767-a72d-610c77e45ac9}_OnDiskSnapshotProp

Filesize
6KB

MD5
992099305b056ea688da3b41d9e2f912

SHA1
85163d32bb2c7960fc77cbda0f326f53df5648ed

SHA256
cfd9db3076c8bba27dc1b187380246d7d293143b55db393fdae43be3dec8f0c7

SHA512
7ed4130adabf8c201d45590341b96e0e9aad436a9f2892231dc3a123f4fb5b4ea0b3eec1ea479f4ac96b7b6705475ebc89a382f9ae07cd424eb3cc4f665528b0

Download Submit
memory/2900-1057-0x0000019F541E0000-0x0000019F54CA2000-memory.dmp

Filesize
10.8MB

Download
memory/2900-2235-0x0000019F541E0000-0x0000019F54CA2000-memory.dmp

Filesize
10.8MB

Download
memory/3244-1309-0x0000000008DC0000-0x0000000008DCA000-memory.dmp

Filesize
40KB

Download
memory/3244-1097-0x00000000057F0000-0x000000000580C000-memory.dmp

Filesize
112KB

Download
memory/3244-1156-0x0000000008810000-0x0000000008820000-memory.dmp

Filesize
64KB

Download
memory/3244-1117-0x0000000006C50000-0x0000000006C5C000-memory.dmp

Filesize
48KB

Download
memory/3244-1115-0x0000000006B20000-0x0000000006B44000-memory.dmp

Filesize
144KB

Download
memory/3244-1114-0x0000000006880000-0x00000000068A6000-memory.dmp

Filesize
152KB

Download
memory/3244-1113-0x0000000006820000-0x000000000687A000-memory.dmp

Filesize
360KB

Download
memory/3244-1112-0x00000000067B0000-0x00000000067B8000-memory.dmp

Filesize
32KB

Download
memory/3244-1226-0x00000000089B0000-0x00000000089B8000-memory.dmp

Filesize
32KB

Download
memory/3244-1110-0x0000000006150000-0x00000000061B8000-memory.dmp

Filesize
416KB

Download
memory/3244-1232-0x0000000008A00000-0x0000000008A0E000-memory.dmp

Filesize
56KB

Download
memory/3244-1109-0x0000000006090000-0x00000000060DA000-memory.dmp

Filesize
296KB

Download
memory/3244-1108-0x0000000006010000-0x0000000006024000-memory.dmp

Filesize
80KB

Download
memory/3244-1107-0x0000000005EC0000-0x0000000005EC8000-memory.dmp

Filesize
32KB

Download
memory/3244-1102-0x0000000005D90000-0x0000000005DCC000-memory.dmp

Filesize
240KB

Download
memory/3244-1104-0x0000000005E30000-0x0000000005E88000-memory.dmp

Filesize
352KB

Download
memory/3244-1121-0x0000000006CB0000-0x0000000006CC2000-memory.dmp

Filesize
72KB

Download
memory/3244-1105-0x0000000005DE0000-0x0000000005DEA000-memory.dmp

Filesize
40KB

Download
memory/3244-1106-0x0000000005DF0000-0x0000000005DFA000-memory.dmp

Filesize
40KB

Download
memory/3244-1103-0x0000000005D50000-0x0000000005D7C000-memory.dmp

Filesize
176KB

Download
memory/3244-1100-0x0000000005CE0000-0x0000000005CEE000-memory.dmp

Filesize
56KB

Download
memory/3244-1388-0x000000000D120000-0x000000000D8C6000-memory.dmp

Filesize
7.6MB

Download
memory/3244-1391-0x000000000DC20000-0x000000000DC96000-memory.dmp

Filesize
472KB

Download
memory/3244-1392-0x000000000DBC0000-0x000000000DBDE000-memory.dmp

Filesize
120KB

Download
memory/3244-1101-0x0000000005D20000-0x0000000005D48000-memory.dmp

Filesize
160KB

Download
memory/3244-1098-0x0000000005CA0000-0x0000000005CBA000-memory.dmp

Filesize
104KB

Download
memory/3244-1099-0x0000000005810000-0x000000000581A000-memory.dmp

Filesize
40KB

Download
memory/3244-1155-0x00000000087D0000-0x00000000087F8000-memory.dmp

Filesize
160KB

Download
memory/3244-1096-0x0000000005790000-0x00000000057AE000-memory.dmp

Filesize
120KB

Download
memory/3244-1086-0x0000000000270000-0x0000000000E0E000-memory.dmp

Filesize
11.6MB

Download
memory/3244-1154-0x0000000008610000-0x000000000861E000-memory.dmp

Filesize
56KB

Download
memory/3244-1153-0x0000000008650000-0x0000000008688000-memory.dmp

Filesize
224KB

Download
memory/3244-1120-0x0000000006C80000-0x0000000006C88000-memory.dmp

Filesize
32KB

Download
memory/3244-1119-0x0000000006C60000-0x0000000006C74000-memory.dmp

Filesize
80KB

Download
memory/3244-1152-0x0000000007D40000-0x0000000007D48000-memory.dmp

Filesize
32KB

Download
memory/3244-1151-0x0000000007D30000-0x0000000007D3C000-memory.dmp

Filesize
48KB

Download
memory/3244-1122-0x0000000006D10000-0x0000000006D4C000-memory.dmp

Filesize
240KB

Download
memory/3244-1150-0x0000000007C00000-0x0000000007C1E000-memory.dmp

Filesize
120KB

Download
memory/3244-1144-0x0000000007C40000-0x0000000007C9A000-memory.dmp

Filesize
360KB

Download
memory/3244-1140-0x0000000007BD0000-0x0000000007BDA000-memory.dmp

Filesize
40KB

Download
memory/3244-1124-0x0000000006CD0000-0x0000000006CDA000-memory.dmp

Filesize
40KB

Download
memory/3244-1123-0x0000000006E00000-0x0000000006EB0000-memory.dmp

Filesize
704KB

Download
memory/3244-1135-0x0000000007810000-0x0000000007B67000-memory.dmp

Filesize
3.3MB

Download
memory/3244-1134-0x00000000077E0000-0x0000000007802000-memory.dmp

Filesize
136KB

Download
memory/3244-1133-0x0000000007D60000-0x0000000008306000-memory.dmp

Filesize
5.6MB

Download
memory/3244-1132-0x0000000007710000-0x00000000077A2000-memory.dmp

Filesize
584KB

Download
memory/3244-1130-0x0000000006FB0000-0x0000000007016000-memory.dmp

Filesize
408KB

Download
memory/3244-1116-0x0000000006B10000-0x0000000006B18000-memory.dmp

Filesize
32KB

Download
memory/4020-863-0x0000000002960000-0x000000000298E000-memory.dmp

Filesize
184KB

Download
memory/4020-865-0x0000000002950000-0x0000000002958000-memory.dmp

Filesize
32KB

Download
memory/5540-900-0x0000000002550000-0x0000000002558000-memory.dmp

Filesize
32KB

Download
memory/5540-907-0x0000000004B80000-0x0000000004D42000-memory.dmp

Filesize
1.8MB

Download
memory/5540-908-0x0000000005280000-0x00000000057AC000-memory.dmp

Filesize
5.2MB

Download