Analysis

  • max time kernel
    1049s
  • max time network
    1055s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 21:24

General

  • Target

    nice.zip

  • Size

    26.4MB

  • MD5

    31ded76d2292470ed59be7f6b9dc4cd8

  • SHA1

    6059cc4bb7195576c7976f7bd4bfe1baacd18cc3

  • SHA256

    84d83fb688595407f1fe5f6a83211602dbade6a9e98cd4dd29aa56acb528a0f7

  • SHA512

    916eb4a3d79b318533a64008eb9df55eec8d836b3075b5beeae9cb0f817aec07404e94ddc2d56b4c6d7890939d00129b5dbfee3dc804b894dcc3a6b29d142e31

  • SSDEEP

    786432:BjMt4GyllymLOMRRofdNvI8u1CcUsoZYIe7Jzc:BjRlzKM4fQ8EGsoZYIe9zc

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Detected potential entity reuse from brand STEAM.
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\nice.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3564
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3656
    • C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe
      "C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4636
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8592446f8,0x7ff859244708,0x7ff859244718
        2⤵
          PID:4636
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
          2⤵
            PID:2844
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:644
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
            2⤵
              PID:2648
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
              2⤵
                PID:740
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                2⤵
                  PID:3404
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
                  2⤵
                    PID:4812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
                    2⤵
                      PID:1076
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                      2⤵
                        PID:4480
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4180
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
                        2⤵
                          PID:3404
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
                          2⤵
                            PID:4264
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                            2⤵
                              PID:3004
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
                              2⤵
                                PID:4208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                                2⤵
                                  PID:2696
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                                  2⤵
                                    PID:896
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                                    2⤵
                                      PID:4944
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
                                      2⤵
                                        PID:5104
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                        2⤵
                                          PID:1148
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
                                          2⤵
                                            PID:2160
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6324 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2284
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:32
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:536

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Program Files\Notepad++\contextMenu\NppShell.dll

                                              Filesize

                                              371KB

                                              MD5

                                              448207940bb3ccb92ab10bd015b763b0

                                              SHA1

                                              5eb3567139c60da222f32995dcad0738b3634d04

                                              SHA256

                                              47e03141468c701328af836a4bcb77e60a961270160fd9577a2dcdfffb135cd0

                                              SHA512

                                              52e114db431e56e5d39b86bd5856329721bbaec632af35de41a894920aefdd8878657bfa667f9d13c2ebd2159a14c50e07c34fd7993f670642c9e42e9c7471ed

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              c2d9eeb3fdd75834f0ac3f9767de8d6f

                                              SHA1

                                              4d16a7e82190f8490a00008bd53d85fb92e379b0

                                              SHA256

                                              1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

                                              SHA512

                                              d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              e55832d7cd7e868a2c087c4c73678018

                                              SHA1

                                              ed7a2f6d6437e907218ffba9128802eaf414a0eb

                                              SHA256

                                              a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

                                              SHA512

                                              897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43ac5f99-1913-4b94-b88a-ea957578d0ac.tmp

                                              Filesize

                                              1KB

                                              MD5

                                              7bb9a9b4824c0bb6efb83fdb50b72363

                                              SHA1

                                              7ef74e2c0451fb515d6ef3e828af966617711a6f

                                              SHA256

                                              a6a8c79e53fc9e297b0136d62fe0ea494e0a458765f77aa2f2a12013a1854047

                                              SHA512

                                              a82f47bf6fb6188f6f77585a3d1856c9a09e303cf092e3057c53910e98803f6c9c1cab90f21887344200c44e56767761b5a1432c58896424e4bbe97cc6eef113

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

                                              Filesize

                                              215KB

                                              MD5

                                              e579aca9a74ae76669750d8879e16bf3

                                              SHA1

                                              0b8f462b46ec2b2dbaa728bea79d611411bae752

                                              SHA256

                                              6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

                                              SHA512

                                              df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              2KB

                                              MD5

                                              d51b5dbf03366189df5e87161a5c0f95

                                              SHA1

                                              3d4a2cf516c1a78864c0a5189ffecde40d78e690

                                              SHA256

                                              2c56d5c031d66054d59dd0ce7424860ded7de33e20e4c8fbd3da6fc1cac20da8

                                              SHA512

                                              444c06751cef3f2dc4719a6a341bfe5134cae5fcd4c2c0b409b5c8a9a8755b6421b659b9ff9536eab5bca49dc640c6f39ce618d0aa10f9edabaaadccb1c2bf65

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              9b5783230433adb6cedabd912c69d2ef

                                              SHA1

                                              85c7a987950046493e5ef4f186dcc6e3b4c805f1

                                              SHA256

                                              4fd69c5f7d4524b4f5eb8faacc1e9a26c113789879ad65a9b706d904f499908a

                                              SHA512

                                              1a009d919a5e8fe292a10e62f9127e2ba744119997281ec9f92107aa38e118ccb7ec86ff1739b3c79e206a19aa465833f1a71e8d6c2fe24a10dfc4faf5072efd

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              2KB

                                              MD5

                                              aec69bf14ddeb49b9dc71fb96789a08c

                                              SHA1

                                              7a7d406c4261066e81e77d1da6b37186c2dec138

                                              SHA256

                                              a1432ee51cdc9bee1e6b586a40972d5a70817b853b1eff625a0624646d01920b

                                              SHA512

                                              829c72cee676f42df20952897ecbdb892e2abbb080b84c8effb1bc2972b3a693f7b86c9b590d70c4a10382ae591bf96409ef2b98657746a5a4c996ceb0f3b0a2

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              2KB

                                              MD5

                                              e45cdce70a7105925b5ac09fd312ad06

                                              SHA1

                                              a24acd910c0fee89f8206c7eb34dd8fb44dd4a43

                                              SHA256

                                              1015d318010fdf8b9dec2207b390640d67a5dba0bf872106516e2bc658976c8f

                                              SHA512

                                              07d7754f94a03ce5a775d2288a9cf5cc3da9807dca9c7b1850b8c032b13fb59b09cea1023bb59eeacb33ff871df8f24a1627c724c702232bdfc8edeabde6cad1

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              645B

                                              MD5

                                              428b33df07802bdfdc6dc328132050b7

                                              SHA1

                                              b002f21cfd56175d7cbf44f9c4b42f6c67cca38f

                                              SHA256

                                              a1d46349b049404dbaf2b1fafef020e1095bc0ee1bc3261105f21d50a4c4e3de

                                              SHA512

                                              c2212ce81f54fb3d57a805b324490db68b19ffcabe94be2d5166eb0c3384e210e7633f9871fe0728ea184e2c5f37488acfebb676e041b84b2854968f7086c300

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              5961410596e54f4ca48aba31503eac27

                                              SHA1

                                              f3ea7f28b2f74d1d1c0eab3bcf5e0782764b7892

                                              SHA256

                                              9dccdaed39338fe45ed2de3a9629286e941581f40d36b06feae1c58263e64087

                                              SHA512

                                              003e769f4972503f2085424633c86a8cea31e186cbac94dc1f5f0c490bd67f86642ee6e437402e38bf385c84223cee3962b3ff31d73febaffd9e1586703fe959

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              9a8af4f113e0220d05122463dec0e2a0

                                              SHA1

                                              1250f07aba0235d36d4016d434bacb8f5bc016df

                                              SHA256

                                              f01bc94072fd569f778e1790c55a2575d8ffdf05900b7004766277a46675b395

                                              SHA512

                                              3943e0e7d7e4328c870a503aa4ec9704e48c313c716125e9f9a2484049dd3f1315e01d10b832ff9d7683a2d88f3e08abdd8490790c603c281cd197257b7eea0d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              d888cdc6ac1376e0c4e48f992913d48b

                                              SHA1

                                              9d2c64bd7beda47b5e55ad8cea0d4c31985a992f

                                              SHA256

                                              f196cb457dde04181bbc2abee642725baca7f4bc50a67ba0fb79eecb0879ef0b

                                              SHA512

                                              adcc7f0e40a302d30a1d2bf5c15612f2a807a823249d2f757e5f13c15a93f7a6512f73ab2477fae68b3d138f20afa8ddcd3090ff1421f1aa4ed0ec212b69fcae

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              1e05028257c8fd4f100fad29db6f26af

                                              SHA1

                                              61c67944b9fa23074cf91db3476ff21aa59c81a1

                                              SHA256

                                              6553180caf04a72bee5f6e7f7a842ca558313ac19864f3d0712d40822810b737

                                              SHA512

                                              c3813e7c8906b03f5207d52af15a8c76a2ca3df45fa99195b55cf0c7a3bb3ca55aeb4d34947e343971c7c1259c869f9b2f5db1539341cd3ea34d67562c5f5264

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              db1269425cbf59a51e8205576f894e17

                                              SHA1

                                              ab1c35e702712d55a9794f6195e2afd435c1dc48

                                              SHA256

                                              1903e57da207b728a28e3b3274b8103c1ddca4d4f5413f434d0bdaee4104a1e8

                                              SHA512

                                              8061d2038d87347d66572fa1a4ca380e2d77c5242466b98ebfeafe2d99950ac227b2c77d69a4a47c1e747577e51448b55bf859524cab72e99d20a0010d63f851

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              e1521c17eb1ee38f5636701d6c3d9197

                                              SHA1

                                              fda630ef5b0edb144e14328b823947ef258ae1ab

                                              SHA256

                                              d805ef35f292f6a27cbeb1e3d717a6326f8c21fbcf244b16629e9d3a2990fe6b

                                              SHA512

                                              585f357fc2ae0141be0d81f0322ae0f1c3938bf7ad53851ff7f6e942e3aaaa00254e7f78eca5d17f5ebe73b9db0216fdb2c4dc04a5031801c67a4198a36b1931

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              92e7d40e777cf4433d4dc5fe3b88aa57

                                              SHA1

                                              43eb3e737cb75645ef093164f389230c6c2cf6e2

                                              SHA256

                                              f68641b1b9dc5dac8b9c7880537a6fe2fc9e3d6444eb7a91caaf15621cdcf36f

                                              SHA512

                                              7a5affa47f7799b9dbbf38848a60e00548f54fc51cefedce4160cf8efc944096ee3ae6a0470b7f7cf8d4670046884d96ea5b74819f319280acf6ef0adc96a3d5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              2e0b59fdcc6e1ec9ff3acdb21bac64cd

                                              SHA1

                                              689693ccb5236920eb875cf828dc38ddb7905bcd

                                              SHA256

                                              01882a318315eb651a698b0d1990b81fef8f4e92717edc40165735064bffba0b

                                              SHA512

                                              8460bb13bc4299d5f4ccd08efded1c74238d156c650710bb83ad4e847e200e6bc371ad3135a63642766315832110a9fa4584f2cb8be6c8ab216a7f37e3252585

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              87c4ed9fa8074928eefc9b231114ea97

                                              SHA1

                                              58e0a3e0b5c632d7a6e8fc2bec5b557972434837

                                              SHA256

                                              06ec11c88c8af2cfd7913c8ff68ebc454321195ea402d0c7f1375325d8a0e11c

                                              SHA512

                                              5d4116b63321df0bf1135e1c695f2b2c89479e86e88fab17e55001652874c14847b8f64d06511132d7f5b8097054849f4aa3f18d2337f6787ed57b822f9a80da

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              cb76c4815b181d7054ad39bdbc11c28d

                                              SHA1

                                              5d452ee8ad4bcd2d892f06c361de98d25480340c

                                              SHA256

                                              f4136bdf879d4082a41da9060cd63706deaf024e171f237477b6216b917d3f33

                                              SHA512

                                              45039e9b99928e3fc45e6f1e48fbf4c0031df76548a219bbdca5c1b45f921dcacf3275a9aaa22f54fca609e972b8a467af1de07c13a98d3c546b784b57dce31e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              7f0c12279b6b2c18b22cb162493f8b3b

                                              SHA1

                                              dd678368fdbe7b3702481bf739cba9f671f4490a

                                              SHA256

                                              c43702cca550fffd9f9d53b038712c0fb43d6aaeb72c2ebe565756a7aeffdb9e

                                              SHA512

                                              0f01508e278613b977b88c18ad6a3bbcddcc3f9d7157c0060e0789df5a1dbc537355d1b3d8080c54d5ded842ed38b2402dcb736fc772b846d1819ea270a28bc3

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              9d351a39e8494e2ebfc0b7a09e75527a

                                              SHA1

                                              50662dfcb749d995a1729cf513714f97f323b96d

                                              SHA256

                                              4a1a6c478d97f8a22cc7f60a808242e673a38db360a83bc459c032b10fa5f3a7

                                              SHA512

                                              e6d71727723b7522992355f6d1736e63bee4f3deea1302c87bff286c491b49b7f689616e895e00a529e0d64adf60891472cf81d0168d7deae420193a87ac0db0

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a39ce.TMP

                                              Filesize

                                              1KB

                                              MD5

                                              18561039075c999990f81269ee4209e7

                                              SHA1

                                              f3273e7340927661f494afe38243d109a5e37269

                                              SHA256

                                              5bc2c729a34482903e878add52a17ecb1e561468fa7e603dc3b9d88d5a0cf4eb

                                              SHA512

                                              b6c158a542e811f98803a90f29e559316587acf01180c304694f120805eea512a6ae5bef552973ac20b56beda03e39a878e1065223bb0b4d6883db451a825605

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              206702161f94c5cd39fadd03f4014d98

                                              SHA1

                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                              SHA256

                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                              SHA512

                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              1e36a8e64ef2934bdaafdf84810a6f28

                                              SHA1

                                              d5a13b2d0abec51fa6f2cc808a3ac41497872432

                                              SHA256

                                              68e5c5f6a058c4ad2ea405831812f9fca288b71db9b5b21072f154e0b48b895a

                                              SHA512

                                              c93011e4d1a8b1cc25748727a8d73a88d53dedb757589c3672cc8763eaa6f72b257012d0cf004ad29565a6ad54679bfa0d9a58545c2bb3f5e3bd22333c2e7402

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\InstallOptions.dll

                                              Filesize

                                              15KB

                                              MD5

                                              d095b082b7c5ba4665d40d9c5042af6d

                                              SHA1

                                              2220277304af105ca6c56219f56f04e894b28d27

                                              SHA256

                                              b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

                                              SHA512

                                              61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\LangDLL.dll

                                              Filesize

                                              5KB

                                              MD5

                                              50016010fb0d8db2bc4cd258ceb43be5

                                              SHA1

                                              44ba95ee12e69da72478cf358c93533a9c7a01dc

                                              SHA256

                                              32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

                                              SHA512

                                              ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\System.dll

                                              Filesize

                                              12KB

                                              MD5

                                              4add245d4ba34b04f213409bfe504c07

                                              SHA1

                                              ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

                                              SHA256

                                              9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

                                              SHA512

                                              1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\UserInfo.dll

                                              Filesize

                                              4KB

                                              MD5

                                              d458b8251443536e4a334147e0170e95

                                              SHA1

                                              ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3

                                              SHA256

                                              4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7

                                              SHA512

                                              6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\ioSpecial.ini

                                              Filesize

                                              1KB

                                              MD5

                                              e8d2bba4766c9f08c04f931ca1708ad8

                                              SHA1

                                              2864b195b3551fbdfe7f586d800e44bce41e6518

                                              SHA256

                                              26a7933e4369d947324a56fa236baea9467b5bdc1901b6b1aa6d4765a194dc8c

                                              SHA512

                                              41525c5897eb0434d86b42592bcd9334e95051f0e9765c0dd319b3b57741522f3b7016468774cb13bbd6ba8dbef985277c6a4dc8489faea2f90b3c0dd8891aa3

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\ioSpecial.ini

                                              Filesize

                                              1KB

                                              MD5

                                              ace97f271757b0a08bdc004cb195e119

                                              SHA1

                                              4692742b6353b2a87e59350fced9b0c39e9f5b8d

                                              SHA256

                                              46c84fd37f911b82e0ac4f379ab9f03daf9b7022b70dc1d34bbe65375ba7da4a

                                              SHA512

                                              805ae9ff89c9926ea2ad661f6546a87f2cfb4a7aec563345fb0aebd702af4e24a299ae78fbc492f6686ae5d221acfbd0c2eecb6e1da4397fb9df2fdd08fc333f

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\ioSpecial.ini

                                              Filesize

                                              1KB

                                              MD5

                                              9977d2712ebcbc4b4987f7036e99edc7

                                              SHA1

                                              5adb77967146055e45ad87b7c2b6a28f03dfd0d9

                                              SHA256

                                              cad71ad82c98ece2bc92dfbb746f8ec436782ce9311f004caa5d1b52fc958548

                                              SHA512

                                              958e974f8fcd674446a54f061056b28123aa4e0cb8474e12df4f582e36a8eddc577ce0f45216aee1f23ac730e481ca51d68f6e8805dbd0d5584adb58fcd9cb65

                                            • C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\nsDialogs.dll

                                              Filesize

                                              9KB

                                              MD5

                                              1d8f01a83ddd259bc339902c1d33c8f1

                                              SHA1

                                              9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

                                              SHA256

                                              4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

                                              SHA512

                                              28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                              Filesize

                                              2B

                                              MD5

                                              f3b25701fe362ec84616a93a45ce9998

                                              SHA1

                                              d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                              SHA256

                                              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                              SHA512

                                              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                            • C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe

                                              Filesize

                                              6.3MB

                                              MD5

                                              251d47503743b09d4ec3847356487ac9

                                              SHA1

                                              2365dec100d7ad2ca99079e2a6fdae7d801cdf43

                                              SHA256

                                              aa130d151859eccc8b4cc535ae756682069d626087e8c56a35b630df4b5f0024

                                              SHA512

                                              e3ff13f400e095b091e1fae184b9a83416c17c1033558b1512f765e19d866a776414db964d5e7a713eaa0ac0e07a98524540a0dba88294f137c0eaacdaa62e20