1af963890a94b022cb3b0fd2276387cf9df618ff4e07f971fa11035325afffc2

Resubmissions

20/11/2024, 04:02

241120-el8dnszqbt 7

20/11/2024, 03:59

241120-ekb9vavpdp 8

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1305607172931190804.html
Size

5KB
MD5

5d094669027e56e50927895fc8d7af02
SHA1

d46e4ea3964fb70cdc1dc144877de3f650efcc4b
SHA256

1af963890a94b022cb3b0fd2276387cf9df618ff4e07f971fa11035325afffc2
SHA512

e69088b84ddca4bc9196c8fb973b2a3a65ee10142ebf2a317d8e907cb043e248d7193ac9baa25d177b9e4b459a3d7f0a16ba6a1121e381586a637d0641c53288
SSDEEP

96:yUpHE+OfRrcLHLTMRe5mvtgCsXe5oEce0zxzhAnx/IJ:ycHEfRrcb3foVNb0zx1Anx/0

Score

8^/10

discovery execution motw phishing

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
455	2900	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3600	Let's Compress.exe
7144	Let's Compress.exe

Loads dropped DLL 13 IoCs

pid	Process
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe
6656	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	Let's Compress.exe
File opened (read-only)	\??\R:	Let's Compress.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	Let's Compress.exe
File opened (read-only)	\??\W:	Let's Compress.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	Let's Compress.exe
File opened (read-only)	\??\V:	Let's Compress.exe
File opened (read-only)	\??\Z:	Let's Compress.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	Let's Compress.exe
File opened (read-only)	\??\O:	Let's Compress.exe
File opened (read-only)	\??\S:	Let's Compress.exe
File opened (read-only)	\??\Y:	Let's Compress.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	Let's Compress.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	Let's Compress.exe
File opened (read-only)	\??\E:	Let's Compress.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	Let's Compress.exe
File opened (read-only)	\??\X:	Let's Compress.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	Let's Compress.exe
File opened (read-only)	\??\H:	Let's Compress.exe
File opened (read-only)	\??\J:	Let's Compress.exe
File opened (read-only)	\??\K:	Let's Compress.exe
File opened (read-only)	\??\N:	Let's Compress.exe
File opened (read-only)	\??\U:	Let's Compress.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	Let's Compress.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
328	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7016	powershell.exe
2900	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Let's Compress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Let's Compress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	Let's Compress.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	Let's Compress.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	Let's Compress.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 106692.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4840	msedge.exe
4840	msedge.exe
1672	identity_helper.exe
1672	identity_helper.exe
5180	msedge.exe
5180	msedge.exe
3600	Let's Compress.exe
3600	Let's Compress.exe
7016	powershell.exe
7016	powershell.exe
7016	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	6400	msiexec.exe
Token: SeCreateTokenPrivilege	3600	Let's Compress.exe
Token: SeAssignPrimaryTokenPrivilege	3600	Let's Compress.exe
Token: SeLockMemoryPrivilege	3600	Let's Compress.exe
Token: SeIncreaseQuotaPrivilege	3600	Let's Compress.exe
Token: SeMachineAccountPrivilege	3600	Let's Compress.exe
Token: SeTcbPrivilege	3600	Let's Compress.exe
Token: SeSecurityPrivilege	3600	Let's Compress.exe
Token: SeTakeOwnershipPrivilege	3600	Let's Compress.exe
Token: SeLoadDriverPrivilege	3600	Let's Compress.exe
Token: SeSystemProfilePrivilege	3600	Let's Compress.exe
Token: SeSystemtimePrivilege	3600	Let's Compress.exe
Token: SeProfSingleProcessPrivilege	3600	Let's Compress.exe
Token: SeIncBasePriorityPrivilege	3600	Let's Compress.exe
Token: SeCreatePagefilePrivilege	3600	Let's Compress.exe
Token: SeCreatePermanentPrivilege	3600	Let's Compress.exe
Token: SeBackupPrivilege	3600	Let's Compress.exe
Token: SeRestorePrivilege	3600	Let's Compress.exe
Token: SeShutdownPrivilege	3600	Let's Compress.exe
Token: SeDebugPrivilege	3600	Let's Compress.exe
Token: SeAuditPrivilege	3600	Let's Compress.exe
Token: SeSystemEnvironmentPrivilege	3600	Let's Compress.exe
Token: SeChangeNotifyPrivilege	3600	Let's Compress.exe
Token: SeRemoteShutdownPrivilege	3600	Let's Compress.exe
Token: SeUndockPrivilege	3600	Let's Compress.exe
Token: SeSyncAgentPrivilege	3600	Let's Compress.exe
Token: SeEnableDelegationPrivilege	3600	Let's Compress.exe
Token: SeManageVolumePrivilege	3600	Let's Compress.exe
Token: SeImpersonatePrivilege	3600	Let's Compress.exe
Token: SeCreateGlobalPrivilege	3600	Let's Compress.exe
Token: SeCreateTokenPrivilege	3600	Let's Compress.exe
Token: SeAssignPrimaryTokenPrivilege	3600	Let's Compress.exe
Token: SeLockMemoryPrivilege	3600	Let's Compress.exe
Token: SeIncreaseQuotaPrivilege	3600	Let's Compress.exe
Token: SeMachineAccountPrivilege	3600	Let's Compress.exe
Token: SeTcbPrivilege	3600	Let's Compress.exe
Token: SeSecurityPrivilege	3600	Let's Compress.exe
Token: SeTakeOwnershipPrivilege	3600	Let's Compress.exe
Token: SeLoadDriverPrivilege	3600	Let's Compress.exe
Token: SeSystemProfilePrivilege	3600	Let's Compress.exe
Token: SeSystemtimePrivilege	3600	Let's Compress.exe
Token: SeProfSingleProcessPrivilege	3600	Let's Compress.exe
Token: SeIncBasePriorityPrivilege	3600	Let's Compress.exe
Token: SeCreatePagefilePrivilege	3600	Let's Compress.exe
Token: SeCreatePermanentPrivilege	3600	Let's Compress.exe
Token: SeBackupPrivilege	3600	Let's Compress.exe
Token: SeRestorePrivilege	3600	Let's Compress.exe
Token: SeShutdownPrivilege	3600	Let's Compress.exe
Token: SeDebugPrivilege	3600	Let's Compress.exe
Token: SeAuditPrivilege	3600	Let's Compress.exe
Token: SeSystemEnvironmentPrivilege	3600	Let's Compress.exe
Token: SeChangeNotifyPrivilege	3600	Let's Compress.exe
Token: SeRemoteShutdownPrivilege	3600	Let's Compress.exe
Token: SeUndockPrivilege	3600	Let's Compress.exe
Token: SeSyncAgentPrivilege	3600	Let's Compress.exe
Token: SeEnableDelegationPrivilege	3600	Let's Compress.exe
Token: SeManageVolumePrivilege	3600	Let's Compress.exe
Token: SeImpersonatePrivilege	3600	Let's Compress.exe
Token: SeCreateGlobalPrivilege	3600	Let's Compress.exe
Token: SeCreateTokenPrivilege	3600	Let's Compress.exe
Token: SeAssignPrimaryTokenPrivilege	3600	Let's Compress.exe
Token: SeLockMemoryPrivilege	3600	Let's Compress.exe
Token: SeIncreaseQuotaPrivilege	3600	Let's Compress.exe
Token: SeMachineAccountPrivilege	3600	Let's Compress.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
3600	Let's Compress.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 936	4840	msedge.exe	83
PID 4840 wrote to memory of 936	4840	msedge.exe	83
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 5060	4840	msedge.exe	84
PID 4840 wrote to memory of 4572	4840	msedge.exe	85
PID 4840 wrote to memory of 4572	4840	msedge.exe	85
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86
PID 4840 wrote to memory of 3648	4840	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\1305607172931190804.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90bc646f8,0x7ff90bc64708,0x7ff90bc64718
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8676 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8684 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9072 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8200 /prefetch:1
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9372 /prefetch:1
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:6680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:7032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:7040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10608 /prefetch:8
  2⤵
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5180
- C:\Users\Admin\Downloads\Let's Compress.exe
  "C:\Users\Admin\Downloads\Let's Compress.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7144
- C:\Users\Admin\Downloads\Let's Compress.exe
  "C:\Users\Admin\Downloads\Let's Compress.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8853238916552347023,17380951896274857463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x41c
1⤵
PID:2740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:6400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 980B34042973FDCC5F3BCFE718CB3F2D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss9C3F.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi9C3B.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr9C3C.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr9C3D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:7016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBC7F.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiBC6B.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrBC6C.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrBC6D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D343022F8C5E519322B5D9E07C403E21

Filesize
1KB

MD5
836b067cafeb4a0d143d5dd5c6e6130d

SHA1
6e5baa0b51ea1994c5a18fb10e2a6022fb8ec869

SHA256
fda30e2ab949fcff87e59b2686b016661c0b159f99479cea12d7f142925762f6

SHA512
6a340348efa6ca62a9f923306db2f9cc9e9c41d27686345338c82a91ae76382796026c6a1282aa93700f2f474c15598e0a68fc01d8c59f0ea02485e8c03469d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
66426be7ab0e51c2b661eca02e89b449

SHA1
37099500d4120feb0375697f34b058249e664cc8

SHA256
9a4929ba5a8efc4caf9b2c8adc9ba95a7b4dd000ac4174b3b2a2a61182e066c2

SHA512
65f5119eee110c23b735b53c4043793bc21ef386cfa2c6a0495806bb6ec075dd56e651b084edb27a91446a1b8b456b31b1207b4d46abdb02b7748c11d7d05a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D343022F8C5E519322B5D9E07C403E21

Filesize
536B

MD5
6c25bb8dd715ecbb671301f7b24aced7

SHA1
d7f8bc56f1d2ea6a9dde4826b8438e736dd76f27

SHA256
2791267b7915c0c17226ef8344a1393bd4e0916d3583e0baa7b965b6e612a20e

SHA512
2f67ecf227de0d0813b88afe4dea890597cec0eb76d31e23dc30badc9523b3ce43fb7c94e4c8c1d6da374d962df048ce2f4fb652a47f7504ffc7da1a6b680498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
54f8513a7a0fa72f7c85c90d97cf6c0d

SHA1
19520d732c4ef5bac4e91e72ef8b5b29c1fae2a3

SHA256
db98834180b6c1170b2337313a4b61e095097c80682f6ae8a85ac14a539efa5f

SHA512
cca99b94e7409c0b074077e303de24823052b86cf0dcc43d4e3faadd1547344fd51447ec1a9c46cc7a004df20b49302c9feb98bade8ad95f363751d26c1b23b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
180185e4008298c96d2839d01d2fff5d

SHA1
98902bb63b0187e34ee3da316c42608592413cbf

SHA256
19beb9a5d3d265276d9ac6b7d04a707d1b4ed85bc1ff40ef26eaa31b8a2f3cf6

SHA512
9f5fef76229f652627d23f9128603e0e4054872e265190ade7522c000e6f9f46d677eb33af7ac5e9521ca37a61a13b20709b77cef7bbe83c7f4cf2b6f38eec35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
79a107358cc8a854889c457e653975cd

SHA1
e87c830dcdfcfd5b6e4dd2a8a91871842d6dcae4

SHA256
8a56ec05f92382fff889598153c50fc832e4cfdab06101b025163193a424fa3a

SHA512
680177749944395dcfec6078a2624a1d829ce4f98a5456fa7d17e58dff2b9c53f322cc79dc4e143ca8023f85e873b10a1ddd04366b95831f9976d7486737f563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
b304dce50d6b7db261d9c261ba1c1a05

SHA1
24d902cd1dbffea8f14a81d587047a69ab924c55

SHA256
a5f83bbf302d3403d8403864fe5c7e667a233b64f0e81cfdedb425f11e155a58

SHA512
ee50b6cbad8c3bf8152b44dec662c5da3ba53d2080b31b34b357f874e20a84f95c9a998dde61d532ef2e542c143c41b1eb45c14225f8f7cb4d6e9b6c186587ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
c028ff3d8e8e4d248c12be5da97684d5

SHA1
32dffa37a3158e91775c8dbdcdcbfab6d739f255

SHA256
3639c1587e994d1ba0de8542ecf7537969ef4449ed5c3d9f6be11c26571ed9af

SHA512
6d95a38053feb59b0aafc06dd3c90d481ae6bcd5317c4044f2b0039376929de45af9d0a9eea05e77a4de2527d6c67d7dd65aa2c1219bde0d0e3090c7b6cff439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6193497911be133524590f4f34de186

SHA1
cf9382f2c283ba6f97b3bbb79546df923bf4d08b

SHA256
02ddc758d9705ac60ee9aa0e80c5487349eb569e7131a9e1f4a173eeb614ad13

SHA512
1da1fdc0d7bbccd4617d20cdf51adbf216206af3146a819f3b7c090db285cce27d3094d56801154475d516009445c4dca0e0178c11d085947e7b9b7f8be88878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eddf1f99b89ac14d4009794a25f7425b

SHA1
76baff918a416400c7353ced0d0ed2357d9f9a17

SHA256
44aab3c1d703f77ba6d6cd4ba65add0f4aff36dedb93d184bdac1c14e9ba24f9

SHA512
9e320bf402c4f5ebc6c971fac095145b782cb0a0dfa4778e704b1826d5ba5d0c5a3829c67a49235526a48c4f5c3af430545d5cef38b2da80eb293f5792afc16c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
3215e0da80eb28fb64268993ebafb56e

SHA1
e52bcdec57ba9056329e5c3004d7ccf2f550ac63

SHA256
23cbb14af708cc2afd09f767e8a15efe10aa40682eb9f6a8ae3d70f516943c5a

SHA512
91b135df64d1b00467b1af0ed0e2e8cd7520d50ca5a4740e48287c9153744e0df3637b329fb96edad7ba5f8ae2c5d77aeebda614f0bf4a22754e058a44ed31e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
16a1eccbb26042f2adfc36a8e424b407

SHA1
0ecdfde2837f35d09ef631f88c0d0f4b81c23519

SHA256
01dd8af0e8da009698f25f94473dad6f8bf83148bd28a18271d4ff884c6fb1f1

SHA512
cacc26411ab734225302a3c208ac2b7acdc70ae00b34a07a5b6cfc28de22ad64e7fe203c2fb911c4e8af2816efe2b344a2fc8783f0a11154e9cea036b2abf277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee312f1ce78cb5e6dececcb6aa77b942

SHA1
1ee1794da5d6bc728237fa4b4a536fea71dde190

SHA256
2b3ccb1a554537faba2eb0c751a1871784e9c77476e5899b56abf191d0abfd66

SHA512
207a77ad289052472884c38ac20d3fe68e04fd937b65424a9d231045f1556664803afb6f56071fcc9b1207794d15327c6cac0b0f60039d13cae0066647a3ac09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42840849dd376e26662b63e845a579a8

SHA1
8e33ec89df6c96c92aa2dcc491f7c0e50c54263c

SHA256
c2dd53bace74566a0819d8a74814fadb1908c3186ed60e33ab8451aaf59bebcf

SHA512
24aa7fabbaf29facac87eba7d60e88a05631a65c6141d7cdda9a54ddcf87ce5f55650abcae23c215f7fef2ccecd0363aa5e43dcd57ae75a50716fba6e9766b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
72B

MD5
48ae7547405bf379adbdfb3ba5b7f568

SHA1
63adb8e8ca3d93abee10719cc571601c70e54004

SHA256
a5a9773bc2b9578f4ef8d7b2d999bc390edcc0cdb36260d3d2b20d0de17a0429

SHA512
607ef7f1f46ffa588b469b9fe1849171f12b8324ec1e50bccbe89049c75d13773da4f6d3af0880f34e7f0eeb4b1cde0f3643e46ffb010d682e250dcb065c90e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5873a4.TMP

Filesize
48B

MD5
fb0b8f3077ceee48dd01d6dda27ed055

SHA1
638497dc67739842fc5368616b020c1f775b42fa

SHA256
a964c8179441132d42361e9ddd550d69ac73087849cf8a01a2c8e4760e03b3cf

SHA512
7a03366b256e9421862f3e18ee8cf81a2a923c15551d247e02ce250de94b258b6a49399de4a236ede4359a97afc17ff32fb6e1addfbbad6a6a2708d82d5b8a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3a93365880c80ec9c72788c7039be9c3

SHA1
1c08654e7b80d9257c8baf96bce245d38ac6129e

SHA256
09dbb0cea207ef1b965b5d7e1228a6da2b21a8cbaa1df81ca720b3b021a868f1

SHA512
bf68d32925b44a10d832d19e830bc66ee734e3e99e23529de072a8ac84ce180b782fad647384d28d0f6102546612fad26101ad336952023c40dee93f166b6001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9e85e67f4f1b723cdaf14cf430984b3c

SHA1
1b5f838dc691f95ee43eb6d19ed534fd9a6effec

SHA256
5f117707c29572a7dfc6bae8b26ef1fd3bbfc5208aa51d6d5f8c8cfb3a47db8c

SHA512
6ac899ba23e31988d4cb3f950b992ce8a80ac534b19ac3dd829f4f5a64e0e93147f1b45936c0cddb7ed38ed480f85d45bbf18078f187c9067455aa358161af17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
90e15603b7249f426eb9e3ea1c8c9ff1

SHA1
0bfeddc5a0ab2b4cb5bb08d8750c86bcf10ed43f

SHA256
382d632cb960432e42c465093cffead107b0c933d4e81f69836c221ffbcab0bb

SHA512
377d946d6ee85aa2452e7f0d56ebf782cf1d1b6874dbb84d50cc01dea37294d37d2ec8e7a0f6a30007ce7928670fdca2575489e00d82b556cde74ef3fd398319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b837c4699acfd46505153f73402c56b0

SHA1
31c0383c2541ce75b924e3c69fedf2607f264fd6

SHA256
2abd66fdc6c821b857cdf87a2e3793303ac3e493d3793dd9276dd5266be50cfe

SHA512
76fa4e5a303ddfe36f6c801619a5af25c910c6ff88b4c175f4da3b56f6ca4a212a42204fa844ea481390daf43bc485c046cfb7696334c08ee90898d451ee9e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5825c3.TMP

Filesize
536B

MD5
10aded235f6dfeeee4376c8a00e4065d

SHA1
a7c798b6089ad70cc62c5e249611186790e882f0

SHA256
4c90cae54c37ff29b2c1bdcab3e96da3c099cdd0d8ba0d49ffbcdf8aa0de43f6

SHA512
c8166cceffe9b478b85b3a34365f24afecfc51d6dad5f22c7582494bf73aabd0e5fb94434543887d7041d4088875e346e6b5760adb50e696bb3a011d0902a74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
993652a00de191c529e9d2f3d17d5079

SHA1
342caaba512d8970837b8a578a3d6b7693354d60

SHA256
4b45f5cfb8f2dbfcd15c3c66a0bc52ad517ee1968d62aeff0082e89a3f4394fc

SHA512
823aea3f266ba59ec9b5d4ad5f03324fb783530fe435020614ddf26eea308a5da2daad144c89315178f4a4c11a99c035f724d07e5d1a64184939a08febbfa056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0d38af626d597f8a603f2098a0e7941c

SHA1
4ecbcd8122f264de12add2496b94ea0bda090f5e

SHA256
c3bcb672966287326b0d2fa520a445aae300f306cad0fbc5b5ad30c113d77463

SHA512
83527bd213fa8c5655f42677a988d33b47ddfe1b9c68a4e2a19a107b74ef8ed977e47399a024e300eb56fa574da71d3e7a0bbe6931b159090dc9d5c0db5fdce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3600\banner.jpg

Filesize
2KB

MD5
de1459af81f7d448e39553c663dc2426

SHA1
29b786b17b8ae102eb613970f305ecefd9ce61d6

SHA256
4f23824737a445244cb3ddc615eb26db9463142b170bf8ed9df1605bf23c26ec

SHA512
a3b26f33be15eab0ddff9790e179e3138580345335f05cd3094ab2889d381bebf1f170d38865822c91c9254880556af1bfd40018654dab52a0cd1f6021c8cee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3600\dialog.jpg

Filesize
18KB

MD5
40e9c790fc05030071eb615d195c28ca

SHA1
3a90c8770c15e7ed07b95d49f33299e1142c054d

SHA256
1d7d8d52adce21c1317bd7ed5717292e7bf3cf50332495de73ff6b8c0c9cd31d

SHA512
ba94e19388fe82f06e1f89f37cffbba608aeb3bf5229fb99110d740ad510dd2a47aa16c1ca4d3b501e6112005cc4caf4661437ace2dab71bd223b5f9ea21e5bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9566.tmp

Filesize
588KB

MD5
b7a6a99cbe6e762c0a61a8621ad41706

SHA1
92f45dd3ed3aaeaac8b488a84e160292ff86281e

SHA256
39fd8d36f8e5d915ad571ea429db3c3de6e9c160dbea7c3e137c9ba4b7fd301d

SHA512
a17e4512d906599b7f004ebb2f19ee2566ee93c2c18114ac05b0a0115a8c481592788f6b97da008795d5c31fb8d819ac82a5097b1792248319139c3face45642

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybgbhlnt.54h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Let's Compress\Let's Compress 1.4.0.0\install\22AED8D\Let's Compress.msi

Filesize
3.6MB

MD5
77bea04d70f6f5231500001585e187ff

SHA1
5e17e94dffda7f555f8b4ba5d73a84db8f8f873e

SHA256
f7cdeb5e813b377d7d3086d5c4da0646b9cd98e170886cbe831d38099cbe5b3e

SHA512
548d1e7955a710964e484cdf1b0e639f80f2e9461cdc62e8999292e3dd07b9d9b6b88be6eae454c0c9456322d1a09110b7a998631b52d810ccec779a8839f34a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 106692.crdownload

Filesize
14.6MB

MD5
58d6e317453f342f2385f5cdcee5747b

SHA1
31367bd1073d5d2e609313d99b883d0f1591ac3d

SHA256
307af128d05cf469817201a031d935db0e9890e9cb56257d8b2adba51e2ff4f6

SHA512
8beb92f76bacf157a58e856f8f217aa7e07b5b95461cd12f309f252d1cb2905691f5c81b000d6f5468c04dfcad623d656374ca33631ce488151316c2c0278ce2

Download Submit
memory/2900-888-0x0000000008400000-0x00000000085C2000-memory.dmp

Filesize
1.8MB

Download
memory/2900-883-0x00000000056E0000-0x0000000005A34000-memory.dmp

Filesize
3.3MB

Download
memory/2900-887-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/7016-794-0x0000000002A30000-0x0000000002A66000-memory.dmp

Filesize
216KB

Download
memory/7016-841-0x00000000072D0000-0x0000000007366000-memory.dmp

Filesize
600KB

Download
memory/7016-842-0x00000000065E0000-0x0000000006602000-memory.dmp

Filesize
136KB

Download
memory/7016-843-0x0000000007FD0000-0x0000000008574000-memory.dmp

Filesize
5.6MB

Download
memory/7016-844-0x00000000073E0000-0x0000000007412000-memory.dmp

Filesize
200KB

Download
memory/7016-845-0x000000006E440000-0x000000006E48C000-memory.dmp

Filesize
304KB

Download
memory/7016-855-0x0000000007420000-0x000000000743E000-memory.dmp

Filesize
120KB

Download
memory/7016-856-0x0000000007450000-0x00000000074F3000-memory.dmp

Filesize
652KB

Download
memory/7016-857-0x0000000007550000-0x000000000755A000-memory.dmp

Filesize
40KB

Download
memory/7016-858-0x00000000076D0000-0x00000000076FA000-memory.dmp

Filesize
168KB

Download
memory/7016-859-0x0000000007700000-0x0000000007724000-memory.dmp

Filesize
144KB

Download
memory/7016-860-0x000000006E770000-0x000000006EAC4000-memory.dmp

Filesize
3.3MB

Download
memory/7016-840-0x0000000006550000-0x000000000656A000-memory.dmp

Filesize
104KB

Download
memory/7016-839-0x0000000007950000-0x0000000007FCA000-memory.dmp

Filesize
6.5MB

Download
memory/7016-815-0x0000000006010000-0x000000000605C000-memory.dmp

Filesize
304KB

Download
memory/7016-814-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

Filesize
120KB

Download
memory/7016-808-0x00000000059F0000-0x0000000005D44000-memory.dmp

Filesize
3.3MB

Download
memory/7016-798-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/7016-797-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/7016-796-0x0000000005060000-0x0000000005082000-memory.dmp

Filesize
136KB

Download
memory/7016-795-0x00000000050B0000-0x00000000056D8000-memory.dmp

Filesize
6.2MB

Download