908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd

Resubmissions

05-12-2024 01:46

241205-b6z19axpfn 10

05-12-2024 00:25

241205-aq4ttsyncv 10

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-12-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd.exe
Size

29KB
MD5

a3bebd489a0b4c4dce0673ef8b6b6754
SHA1

1767b75bb4a4d5dd8f4b06589b4544b89b774aa9
SHA256

908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd
SHA512

9d977a226f9b9ec2037d5bf272857a662af637ceb9b319d1fb048a923b29a893d01c3799f20595e3fb2fdb1eec96a82b26a69467b74791fa614d013306bba51d
SSDEEP

384:Y7hkrLGN8fNl7L5H4yAyr9n95/K4ZoumqDYcqeYtGBsbh0w4wlAokw9OhgOL1vYB:Y67R4yAy944Aq1qe5BKh0p29SgRN5

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2812	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
5364	winlog.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Windows\CurrentVersion\Run\b3d7ad373951cd040fb05f6d6f5bf314 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winlog.exe\" .."	winlog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b3d7ad373951cd040fb05f6d6f5bf314 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winlog.exe\" .."	winlog.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlog.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "464905723"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31147733"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3\NodeSlot = "5"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 03000000020000000100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\724011-new-nature-wallpaper-hd-2560x1600-windows-xp.jpg:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
2504	msedge.exe
2504	msedge.exe
1364	msedge.exe
1364	msedge.exe
3528	identity_helper.exe
3528	identity_helper.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5392	msedge.exe
5392	msedge.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe
5364	winlog.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5364	winlog.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 5364	812	908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd.exe	77
PID 812 wrote to memory of 5364	812	908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd.exe	77
PID 812 wrote to memory of 5364	812	908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd.exe	77
PID 5364 wrote to memory of 2812	5364	winlog.exe	78
PID 5364 wrote to memory of 2812	5364	winlog.exe	78
PID 5364 wrote to memory of 2812	5364	winlog.exe	78
PID 2504 wrote to memory of 844	2504	msedge.exe	87
PID 2504 wrote to memory of 844	2504	msedge.exe	87
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 2272	2504	msedge.exe	88
PID 2504 wrote to memory of 1364	2504	msedge.exe	89
PID 2504 wrote to memory of 1364	2504	msedge.exe	89
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90
PID 2504 wrote to memory of 4644	2504	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd.exe
"C:\Users\Admin\AppData\Local\Temp\908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\winlog.exe
  "C:\Users\Admin\AppData\Local\Temp\winlog.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\winlog.exe" "winlog.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2812

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Pictures\ClearEdit.gif
1⤵
- Modifies Internet Explorer settings
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffc382a3cb8,0x7ffc382a3cc8,0x7ffc382a3cd8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,13075025912234700131,15194302265165834235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - NTFS ADS
  PID:5780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
879KB

MD5
ef99528fe6485e0fe578a568ed19c538

SHA1
2afac510f1af21a3cf80bc4a54929f04277a8bdd

SHA256
ad1c98fe0d457727088371ae4ec1fa41e292440ee97b9b446e0abc73cb2d843a

SHA512
6310ca4a2640f10bbbd6a5c7afba2367f11aad631a8532ccf5f24c9fba80c07488e3606c6dc82f4986e929759676cb0c70e4f796d227438108fb0291b6a9c958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f49d8ab761aa3583b536a0092391aeb4

SHA1
ef98db83ed1f3e1efdf6f45e9e62779386673c14

SHA256
37cf54fbba9afa1ff17b3a55d6c9c621c871e6e96355f5f7e81d70e18f4be2c3

SHA512
71b9c0c36cfece8cd362952af298a98ec03b2486fe56a6c8dc69a7481cbf68b69e8a3187858e78a7805894e2a1825c6f9e7458c5775285fc85bace42ce4dbe6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
93d040a76f327c9dcfca8994f84c2e9d

SHA1
a0ed1bec83046ee8df29cd1cf0794f54ffffb28d

SHA256
38b34292efad80b6a19f329c4d4fcbf424779a9fd6f6b9fb70592b4de786e5f7

SHA512
f910e69e3fc67d29134a1beb4e28ecfc407a774aaf6e7e1f63bf21aff3ec8114e2e43852e783b3ed3c8bc97ff7dd3793f02f85d82c4dac72109c7bafb913c38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
780B

MD5
4c1b7916f1d27a053885fece182bef7d

SHA1
ae5826e5bd9503d09bcb4e3371814791bb09fe5f

SHA256
215342575a2e993c044ff915e0939cf1618a88fbf8638f08cc6931d056b5dc44

SHA512
210a7f7fa2e3d4da3ac3f6af0a3a59740316cda9e2d9ceb50d0e03b42f9ad9e9fa0f575246078eb8624eb8bdc48990f020a7cd66980ed3e31fa6facbeda4c63a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64215f9c08bec27b990b936e985e5da6

SHA1
d51ac0c944d3a3fb154cf2ae9f026a062853a3a3

SHA256
c8c169e59e5dd50778bf243b3a3f4240ae9caa27991367243aff2e37a1a47887

SHA512
690fa458b4705deab04bbe4c1b754c727526df554fae69577d0fcf23f451c37ae7df8f8c0dcb25432eb3e6b45a7bd82b15ca38a8bafc65477c02fc4fd756a223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0c1db3d6926de34e90545be0c5fe343

SHA1
af7d4fd0b8f4a6d4aee7442c9e4cbdbcfd7a9ab4

SHA256
c3c8cd4a9fff69dbebdb25161fb0db16dfe3f8ebefcf89c04d1e04ff2bd31c5f

SHA512
61b56479456133ccd74f693e289a21b4abd61753399829e6242cb6351f77bd412b86cf3c2a2dcd5a409f2b0ded53b12dbef7e33a392742e19fc85b5c8358ed39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fd8f3635d19ec5c18724606ea874b65

SHA1
e1874f70e92d9ac2f97a4b978ec9ebab0dcbb4b0

SHA256
82bf78b8ce647355c3a8525376b352a04e03de86c890f60331b2b2a613f3423c

SHA512
7337bd2b14ff11d3b1a163484af1c81a25e0257c2d1c1c7b71e7479c838b9f9d669b2cbe56e74a1024a6abcd0627fe12fdb952662f920dabb331ecd72493d100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1381f47413cc8277e75e4e0e7bb70c28

SHA1
2d6bf12bedaba66fbfa750e120b987b10e8814af

SHA256
b2d2a48caf321604b6f9a6289b73fae370daeaad389b22f5b47823da367d0dc6

SHA512
0bc4460cb422c3880b95b25edc40da5d52b068a8edcfd92cd380cf6889b09def82f69bcb63ec8f5355678b16189e7a90a24236c999f7a4004cb2a217e8b718ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df6452171da876fc50898ebb01aa0cdb

SHA1
cedd317a3709508db2754b9f035f5cbe91ffd3c5

SHA256
a8b6dbf2120ebb9c612f1c885316ce84df9cd4f261d7b707d5a873b4f2b74c32

SHA512
9121a08a68d6bb18c24f8d316419c46703f9fcd2cdc19b515b341560ad6d2ada4f87e67ee5ce2aa367ff7b8741c1c9815b3f46098f0ea4926a8d0731042b398e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f3fd74a532d478297c7ce0ca2f70163

SHA1
87258eedecc07a0b313079a39ba77119fa0a83ad

SHA256
335a3ef3fc0f2655afe5ab2d0b82dbda094c1c2eb9b505faac2f2627ae19e51a

SHA512
980bfc4ade19e162db31471a6f1d0a1cbed72d2a324eead764e986bc2b25c20a5c4205cf7aee15db68dd9b12f8e41a9ab56c404a2bb780862c72638f2e5f77f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
601f4a978d445a260e6038da47e0f740

SHA1
41ce88a59a6caa26353ccd56b03996f9378dd7b3

SHA256
222539837a5fca53b2241b3295bdbbcd7491af2398972f659ca42111861f37d2

SHA512
0582e53fa017bdc7f40ee62fcc591282c5b87ebec198d44267b1ecd16528be42fcebf5de3a0ea400b1b586d9144d0ee990f32acfedf4d632c060fd79e3ff9c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e69b28330b735c886653c26e0ab55cd

SHA1
23c497c9a665353bb6b4fe6752ed4d94fb323159

SHA256
00bcb6e310cdffaa7904e549cabc9a9d8909b6abb38088e86c68dcce9722dc35

SHA512
944d26c1d834bfa3bacc9a933c4b54bc89da11c5f7b8bfce9ccdf631dee75063baeba068833348877cfcf958a735427a751c9ba7fc1c16de9cd7711100218774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4e9716834a76fe47153c1a42430f5e94

SHA1
e7d9fdf65c63434123a349fba19db6e209948f77

SHA256
43a5dfaf9d95c71061cfb9bee5e0386e2168f67b93236f7851419bcb8e71fe48

SHA512
5100f083832973a890d24ea95cdc3125905b8cb824872608d001f70bfb062786d879ce9e05b443e17093ba5fe7a2a35ebb9082fd81129d1d107e7328626f7777

Download Submit
C:\Users\Admin\AppData\Local\Temp\winlog.exe

Filesize
29KB

MD5
a3bebd489a0b4c4dce0673ef8b6b6754

SHA1
1767b75bb4a4d5dd8f4b06589b4544b89b774aa9

SHA256
908225291224a1234122a141319807eba04040d97a311c0c0eacbb5591ff53fd

SHA512
9d977a226f9b9ec2037d5bf272857a662af637ceb9b319d1fb048a923b29a893d01c3799f20595e3fb2fdb1eec96a82b26a69467b74791fa614d013306bba51d

Download Submit
C:\Users\Admin\Downloads\724011-new-nature-wallpaper-hd-2560x1600-windows-xp.jpg:Zone.Identifier

Filesize
172B

MD5
246aa6cfbb93c6f125429de53a1037a6

SHA1
7ff68936945f5302410504a651cd9510ce614a1e

SHA256
06ad8a2c5f81585bc2eae74fc1bc288819e4e698a653c4bf8854a3a9a2575818

SHA512
9875c69acee88c4982f91a99f5d4470009d698fd723fbe7235f745b847b1a2ac7200ac7df22407de5eea808f81c5256131dc417db68fc5a4004fc3ca0212961a

Download Submit
memory/812-0-0x0000000075441000-0x0000000075442000-memory.dmp

Filesize
4KB

Download
memory/812-12-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/812-2-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/812-1-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/5364-15-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/5364-14-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/5364-13-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download