Overview

overview

10

Static

static

1

spoof test.7z

windows11-21h2-x64

10

Analysis

  • max time kernel
    450s
  • max time network
    448s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-12-2024 04:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    spoof test.7z

  • Size

    50KB

  • MD5

    2b80931dfec2265ac0357414e27497f4

  • SHA1

    d7bfec86f61e214a8b43fcdcaaf82bda5e88557a

  • SHA256

    9f83ee8c3f2263e2400f1dc667c58520a846d81b12e8d15f62e4dfeba4389b3b

  • SHA512

    cb9443487acf4de4a33deb781ef206533cf5b4095671f08dd2b5607f388a82be8478b4db86b5ceaebb6f1dcd6958cd2d09399a0acea04ecb6d9368fb94cda203

  • SSDEEP

    768:AH1u19IsbaKCa8fll6kehelKR8e1vmrnwJU2O3QLp5OYgtf8aGZqfTn:AVuXIsqaSlRehZRBF+/pip/glOcTn

Score
10/10
stormkittyxwormdiscoveryevasionexecutionpersistenceprivilege_escalationransomwareratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

database-recommendations.gl.at.ply.gg:17666

Attributes
  • Install_directory

    %AppData%

  • install_file

    System User.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\spoof test.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Users\Admin\AppData\Local\Temp\7zO020D4708\mapper.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO020D4708\mapper.exe"
      2⤵
      • UAC bypass
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Sets desktop wallpaper using registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7zO020D4708\mapper.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2376
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mapper.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3060
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System User.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3148
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4988
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\AppData\Roaming\System User.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2420
      • C:\Windows\System32\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3696
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" config wuauserv start=auto
        3⤵
        • Launches sc.exe
        PID:4276
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" start wuauserv
        3⤵
        • Launches sc.exe
        PID:3084
      • C:\Windows\System32\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /im ngrok.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3048
      • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
        C:\Users\Admin\AppData\Local\Temp\ngrok.exe config add-authtoken RunBotKiller
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1364
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff1cc23cb8,0x7fff1cc23cc8,0x7fff1cc23cd8
          4⤵
            PID:4380
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
            4⤵
              PID:4388
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
              4⤵
                PID:2148
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
                4⤵
                  PID:2404
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                  4⤵
                    PID:2088
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
                    4⤵
                      PID:1060
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
                      4⤵
                        PID:3420
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
                        4⤵
                          PID:3988
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
                          4⤵
                            PID:3332
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
                            4⤵
                              PID:3612
                            • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
                              4⤵
                                PID:4208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
                                4⤵
                                  PID:3124
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,11024933314480865046,18409960754864154823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
                                  4⤵
                                    PID:2484
                                • C:\Windows\SYSTEM32\shutdown.exe
                                  shutdown.exe -L
                                  3⤵
                                    PID:492
                              • C:\Users\Admin\AppData\Roaming\System User.exe
                                "C:\Users\Admin\AppData\Roaming\System User.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2780
                              • C:\Windows\system32\BackgroundTransferHost.exe
                                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                1⤵
                                • Modifies registry class
                                PID:1768
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                1⤵
                                  PID:1160
                                • C:\Users\Admin\AppData\Roaming\System User.exe
                                  "C:\Users\Admin\AppData\Roaming\System User.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2908
                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1452
                                • C:\Users\Admin\AppData\Roaming\System User.exe
                                  "C:\Users\Admin\AppData\Roaming\System User.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:576
                                • C:\Users\Admin\AppData\Roaming\System User.exe
                                  "C:\Users\Admin\AppData\Roaming\System User.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3580
                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                  1⤵
                                  • Drops file in System32 directory
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1228
                                • C:\Users\Admin\AppData\Roaming\System User.exe
                                  "C:\Users\Admin\AppData\Roaming\System User.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3544
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4884
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4552
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
                                      1⤵
                                      • Enumerates system info in registry
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:3064
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7fff1cc23cb8,0x7fff1cc23cc8,0x7fff1cc23cd8
                                        2⤵
                                          PID:4776
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,15939439344338974094,4782707385761583619,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
                                          2⤵
                                            PID:4184
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,15939439344338974094,4782707385761583619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                                            2⤵
                                              PID:224
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,15939439344338974094,4782707385761583619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
                                              2⤵
                                                PID:4320
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,15939439344338974094,4782707385761583619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
                                                2⤵
                                                  PID:800
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,15939439344338974094,4782707385761583619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                                  2⤵
                                                    PID:2336
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:3432
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:4756
                                                    • C:\Windows\system32\OpenWith.exe
                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                      1⤵
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1216
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                      1⤵
                                                        PID:4196
                                                      • C:\Users\Admin\AppData\Roaming\System User.exe
                                                        "C:\Users\Admin\AppData\Roaming\System User.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2836
                                                      • C:\Users\Admin\AppData\Roaming\System User.exe
                                                        "C:\Users\Admin\AppData\Roaming\System User.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4280
                                                      • C:\Windows\system32\LogonUI.exe
                                                        "LogonUI.exe" /flags:0x4 /state0:0xa39d0055 /state1:0x41c64e6d
                                                        1⤵
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2864

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      1
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Privilege Escalation

                                                      Abuse Elevation Control Mechanism

                                                      1
                                                      T1548

                                                      Bypass User Account Control

                                                      1
                                                      T1548.002

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Defense Evasion

                                                      Abuse Elevation Control Mechanism

                                                      1
                                                      T1548

                                                      Bypass User Account Control

                                                      1
                                                      T1548.002

                                                      Impair Defenses

                                                      2
                                                      T1562

                                                      Disable or Modify System Firewall

                                                      1
                                                      T1562.004

                                                      Disable or Modify Tools

                                                      1
                                                      T1562.001

                                                      Modify Registry

                                                      4
                                                      T1112

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      1
                                                      T1552

                                                      Credentials In Files

                                                      1
                                                      T1552.001

                                                      Discovery

                                                      Browser Information Discovery

                                                      1
                                                      T1217

                                                      Query Registry

                                                      3
                                                      T1012

                                                      System Information Discovery

                                                      3
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Lateral Movement

                                                      Collection

                                                      Data from Local System

                                                      1
                                                      T1005

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Defacement

                                                      1
                                                      T1491

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                        Filesize

                                                        471B

                                                        MD5

                                                        c455cee3065c4278ee6fe3941c405ace

                                                        SHA1

                                                        d14db5b2a8628c9fcfa734387abe21533e146691

                                                        SHA256

                                                        c9380a77445992dff4840d7030023011e03507e5596253ccda37616ef8b4c04f

                                                        SHA512

                                                        082a9de12c3fd153f7fbd5b0f87725e93a47d5e563f8545eefe5483e8d0f61f5ffb8cf605a3c7ba9d4f8793d0aebc105ee8010950c802250cbc807da3b90965c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                        Filesize

                                                        420B

                                                        MD5

                                                        463c43cb506c6f214d80f8c8bd98e79a

                                                        SHA1

                                                        04a9fb88ab804acf683d544464e5722f5781ed2f

                                                        SHA256

                                                        0b98d6d72aae946c3b499d4f9e9c136cbf2f939196389e14fd2cf3eafb75d9b8

                                                        SHA512

                                                        1efcfb9d45cbcb640aac972b8058795ca4626a99928c06e2642693f8b5441857d99542c0d6111caea681051193fe399a292348389651b83642a907b397ef848a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System User.exe.log
                                                        Filesize

                                                        654B

                                                        MD5

                                                        2cbbb74b7da1f720b48ed31085cbd5b8

                                                        SHA1

                                                        79caa9a3ea8abe1b9c4326c3633da64a5f724964

                                                        SHA256

                                                        e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

                                                        SHA512

                                                        ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        627073ee3ca9676911bee35548eff2b8

                                                        SHA1

                                                        4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                        SHA256

                                                        85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                        SHA512

                                                        3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        7bed1eca5620a49f52232fd55246d09a

                                                        SHA1

                                                        e429d9d401099a1917a6fb31ab2cf65fcee22030

                                                        SHA256

                                                        49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

                                                        SHA512

                                                        afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        5431d6602455a6db6e087223dd47f600

                                                        SHA1

                                                        27255756dfecd4e0afe4f1185e7708a3d07dea6e

                                                        SHA256

                                                        7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

                                                        SHA512

                                                        868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        5090ebba3f531406008bba9ed25403e0

                                                        SHA1

                                                        de9cef6938e7b6bdd949006b569b1fa53e80a024

                                                        SHA256

                                                        6f46cb2707374adbc20d51d3de852a4e92f2a2787a9167b74b08a6dbd8c8b71c

                                                        SHA512

                                                        25bac3a3f91d071a969243a8fa411013bea535a486d9413c736f3d3f2730f568d17b61e655a35377b5ea168eaba94036cc7c8beba59e1bd5ef6f767eb279f7e8

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        3d492ab0b17d00123f2ae1a3751636b2

                                                        SHA1

                                                        3afbf67b2d0314d8646d8b0d3d78cf70beaa9f91

                                                        SHA256

                                                        bc9fea00ddd77f0a99fc3998385521e2de0c1aa73bbd0fdb50daa35bc04337c6

                                                        SHA512

                                                        7bd89e4b1ec53d232ac64e50d157976494d167ff8d929a9010e92828d1414bbb25c9285b33211f61f478fc011e67c181b4177411fe56fa3f14780a5dcf9afde7

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
                                                        Filesize

                                                        322B

                                                        MD5

                                                        203aba310471d572264e924d78549808

                                                        SHA1

                                                        775267b3d6a22ffa7920b394bd6c807a7f35d2e7

                                                        SHA256

                                                        d14aed995cd34e307043e4a77e495fbfb800d51aaad3c00a773de529b319724a

                                                        SHA512

                                                        1402a658094a42ebb8ea878a8ba6ed6be357bae4b27b5da8da9aa2c1d19fe41e12fa68bbf923bd02f376cfa7b719ffb41c48134525e61fd82bf1578d7c1f0b24

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                                        Filesize

                                                        116KB

                                                        MD5

                                                        525a8f6ac2cf975aa33bb39f42a195a8

                                                        SHA1

                                                        bd9f6d15cd79def7ec4f78564b0494ca777db97d

                                                        SHA256

                                                        88852cdaeab781c5fe28b9bbf948f94841b26fc6d7e06dde7344b99cfac91a38

                                                        SHA512

                                                        1b8ba6706d2677141556915b6096461ca8ea3da441cf6720c36039df2272e2de33511a3d2131a270b05ebc556a4a2891b5944bf74e3eab234c61df6ccd70a1fb

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
                                                        Filesize

                                                        626B

                                                        MD5

                                                        194a12f61a106e34b9b5c8d2aa81c922

                                                        SHA1

                                                        0f2d88ba72bf5aa09dfe9e930dc4f907ef695d88

                                                        SHA256

                                                        aee3545cd1de751650d49b2e95a2ba5999f887902f50ba128a10a16ab0ba3d4a

                                                        SHA512

                                                        f943508cdf769556850ff24e762daf8dbd0ec7ac1817fb8802182b3fa4c430b5d6d6f26a206e0eb715287efbc7d1c03c716bce8c50cdb3792fe22a76c8378fac

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
                                                        Filesize

                                                        20KB

                                                        MD5

                                                        11b6ca28d5f97e521077ddfc05c2e717

                                                        SHA1

                                                        84973f3b89b8d275b5879013e0dd1b6da3528c47

                                                        SHA256

                                                        6eb593322f8064bda1351f8f6b4c68c19c4b527529ba4337aaa2aa141f9afc49

                                                        SHA512

                                                        7524332a7695e08a650678c9297eac324b86f0f4bed06633dde07e30badee78eb2fb314e975eae165f1eaf7e2b771fc883d9c37bafc8b54fc72405ac69ae04fc

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                        Filesize

                                                        334B

                                                        MD5

                                                        9ac5006265d1448fb60529f27afee35d

                                                        SHA1

                                                        abe1f5637a50409af5731b47e422378af5b1c43b

                                                        SHA256

                                                        94250e41c3ed4bb450392ccea5493501e9c9a6cbddabb8a02baa2bf61cb72d64

                                                        SHA512

                                                        aa3882d78b761b6001953410c7526a3469daf12a74075d60134c1113d2d54e64b67d87281e7611bff2c4c89097f0f7bdb1ee5991beef82eb7c13feefa2dbe5a3

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        0192f05670c014eaeefd0e94782cbfcb

                                                        SHA1

                                                        93bdf6f40fb37dbfb086c391e9a6b5e2956b39ca

                                                        SHA256

                                                        f3a5bace9f406971d45bc4145e90a15456f441ba58d44e3918bda5323ee582db

                                                        SHA512

                                                        b61d40bb19d8b942135329d92cf627b808b84fb6eca6ad97e743598782e459d2652b66dc52cf17781005e0c5e4d1ff59e2d691ecb9810f0fb5f3e40894e8723e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        925475d678d06f1e18868e4c0c25e5c5

                                                        SHA1

                                                        9e95c54cb7428d6a4d12b03c05dbd90632864fd6

                                                        SHA256

                                                        d35383ea040b583d60729f153c6be19c86676cfd7b01810264bca1e70170e2b3

                                                        SHA512

                                                        eb5fcb000c49f8089535b2cf943128927253190f9987cee311357216fbae94199570465aee4826fdf7100d77eda6f6ca1ffc4e3194ba47b2dddcfc6b2d81f1b1

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        9bc4e35e5c3a18599279c1500f2790bf

                                                        SHA1

                                                        c7847f2d1ada44c050089fc9a3732418ba0e8397

                                                        SHA256

                                                        4e1d44b10c5775af831d0805cf2ca6832a811b839e59124525e320a44af4a09e

                                                        SHA512

                                                        d5fa7d7d1e2007fcc7d4c12d3d95af8b1de02807be5727d56654059a41f2181f45f7757e3837e6cf9335714930a57289d9ecdb036a726671cfa5190dfceffd78

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        4f20f7996fcf82e67a92612447d85599

                                                        SHA1

                                                        3b3a6939250f87329d62f0966c653a808a73e73a

                                                        SHA256

                                                        9f21c8c8060e15ea20678671f553ff096b0a6041662a75998a7fe5c201e5fbb9

                                                        SHA512

                                                        facc0a98d5fc6c03d4b8726544e1244a2f8d240a7801ed03d14d27e9f883a6aebb5b80f4f1a060b0200f1579ecefa76efc685447e1a0005a80957ce47bea2a30

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        decc0ff6f00396e81e9ed93c5c91eac4

                                                        SHA1

                                                        b999c167fc7cbd1eb5259416cfe8c3aeb53af947

                                                        SHA256

                                                        0d322ca521a75c12aaa4aade1bf0cf1f3560b7095ad88afe5aeddc6a0bfdbabe

                                                        SHA512

                                                        639afd4c066b1c0e6d82f0efef9fdfef7bedb0ad6d4373e55d2d1629fb04e3b3b7191e373409710ba37b0de55b4a3e548fedb7b14f35768f45634d9a57b3f2e4

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
                                                        Filesize

                                                        175B

                                                        MD5

                                                        6153ae3a389cfba4b2fe34025943ec59

                                                        SHA1

                                                        c5762dbae34261a19ec867ffea81551757373785

                                                        SHA256

                                                        93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

                                                        SHA512

                                                        f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
                                                        Filesize

                                                        322B

                                                        MD5

                                                        72457dbad30802553b7ea99a4e3d6dd9

                                                        SHA1

                                                        121151b122e09e9ab25571af614c7f6b8cac3bb5

                                                        SHA256

                                                        9a4ba684cf772a877900ba450a9ce33e3dd358ad344d8f8a691f97ab7f85e5fb

                                                        SHA512

                                                        da15ab8fcce9e3e80fb3398944b25af087d19d43b267a1c576f3540a3412c1215165a67479c3cabf0ec1da8e14a7ee8178f3837835e9d3e54d0100ac25e4f129

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377845905706980
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        ec4daafc6d86e80aae4e1b2a191a57a8

                                                        SHA1

                                                        c58b565bbeda81bd280363c40b767bdc1981b466

                                                        SHA256

                                                        10ffe40b98cb5d95c28981a94bf60e39b40c5cf5a61fc2ee30f69e2b5a22c3a2

                                                        SHA512

                                                        084e3427dae56701eb437bd9b8cb33f7f8aad842f8bd7aa729ed0747d0c569321daa81f8aa401ce4d5beb7c04e698cf18379f298b96e9349b7792ea353b9838c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13377845906159980
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        8ad01fc5a2f569c91beb38e37cc6b486

                                                        SHA1

                                                        936219f2afd73b4a27bed1137bf771946abc589a

                                                        SHA256

                                                        aa9e31c90bd0f5b191c4c74de95a8ee980227694aa17b080ab63073639582070

                                                        SHA512

                                                        a4d90651a7fad3127087f506df03e989824c4af734b80e39424b3a6223d28d414d5c3922dcdb46f585d2810a915efc94d3f32490760302d849ff5bd5803a488e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                        Filesize

                                                        347B

                                                        MD5

                                                        1e694584849d9f5ae3e675d1b9247a48

                                                        SHA1

                                                        2d8800abb2679b3ccdcff8f2b36e09e650925879

                                                        SHA256

                                                        f34dc32c4c3b9ad0619ab2c430e6a8915e09e6b3dd1b4047f0be8400c0947dfa

                                                        SHA512

                                                        94deafd62f3f8b493890003463c6515d550d694aae058ab18eb1cf20db4d86307823070d77d13291242073599b6a2a290ab9efd2b01f8b7cbc147c925d4bbefb

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                        Filesize

                                                        323B

                                                        MD5

                                                        2923b5c39bc51f04352dae23cec83b08

                                                        SHA1

                                                        93ab38e69059defeb7904ad4089459f6e4de9323

                                                        SHA256

                                                        5f39692b2191d9c4194a7d380fc3696a598ad13015d440392ce21deb5f241edd

                                                        SHA512

                                                        98e0acd2c6cf51420ac0c7da35a4d6d8bb079e87e79a6f5af2b61aa2eaa1322c584ed103f5ee331e8791688d3f0d42d4521714d0412b5ab3e79b7724f4c20671

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
                                                        Filesize

                                                        128KB

                                                        MD5

                                                        8546aef1e87894639930457e54647b2c

                                                        SHA1

                                                        9e1d11e123308065b9379d3730ff8ffd5baf13b0

                                                        SHA256

                                                        5d39a11d55b6fb469995efbf8050716a6fce3b861b1b6cf810bc246403fef908

                                                        SHA512

                                                        a0e148de6f177ff63a3ff1277584044cdadb5a9869192987daee4b4e936e6f1eaf6cd7ba8dfa91733045d1d3e8ec44b9df4220981e86427ccb830a75bad639b9

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                        Filesize

                                                        16B

                                                        MD5

                                                        46295cac801e5d4857d09837238a6394

                                                        SHA1

                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                        SHA256

                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                        SHA512

                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                        Filesize

                                                        16B

                                                        MD5

                                                        206702161f94c5cd39fadd03f4014d98

                                                        SHA1

                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                        SHA256

                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                        SHA512

                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
                                                        Filesize

                                                        44KB

                                                        MD5

                                                        d9f19cfec35282be8e324395d9442b48

                                                        SHA1

                                                        ccb3661122986b16d533041654c608dd0b3d5d70

                                                        SHA256

                                                        c1dbea78f85946f870b5a185668f44ae3d27267f7536a3bf4ca8277bbef40e79

                                                        SHA512

                                                        586ecd0880e716129f0c89a38d1135198abdeaeea67a1155286dd3d104f640d52fc5f43511f2f38bf0a9f7b906951b5fe2af4297a2d02c4b263c8db1e60a5303

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
                                                        Filesize

                                                        19B

                                                        MD5

                                                        0407b455f23e3655661ba46a574cfca4

                                                        SHA1

                                                        855cb7cc8eac30458b4207614d046cb09ee3a591

                                                        SHA256

                                                        ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7

                                                        SHA512

                                                        3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
                                                        Filesize

                                                        319B

                                                        MD5

                                                        49194249efd25e90b2072b7be5807cf1

                                                        SHA1

                                                        b7ef6bc2fb5b1558a73d81ddf5941e7117814015

                                                        SHA256

                                                        4bacb78885bcdaec2f8e4c13ce90a3c88851086797ff0aa20deb9ebd9fe0b39e

                                                        SHA512

                                                        af7c3fe02523e904cb661a2f941b6d3ee7396b6950973770a0de0dfb73e6a5ff7fe72e03e0b9de2939ee18c572fc56a66540d754d091630c282b05a9d1786758

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
                                                        Filesize

                                                        318B

                                                        MD5

                                                        53809c5b10bc3702ddfcdb479402c551

                                                        SHA1

                                                        0a8435aa6b64218b3e57feb7a70ae2cd523af8fd

                                                        SHA256

                                                        95b37fc311a59780baf9846248e8ca70cc706fbc2c794be945f3895f1aabf2b8

                                                        SHA512

                                                        302a1fdff3371a2e2d77a0e9b524f2fd42356e83d6559c63ae40e9510eb693a6ac345639876e372943af28f04f2d644f84c64145611df360cfec6588f5d7942f

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
                                                        Filesize

                                                        337B

                                                        MD5

                                                        2477325b5cdb3831345fbc848b0479c7

                                                        SHA1

                                                        a4251425f17e10172773447bdd9563c3643005c5

                                                        SHA256

                                                        6bfb0b7901bb8757d8ebb84ebff2457a562826117edad8090306c4333fa99c5c

                                                        SHA512

                                                        c61d2c190122ed88f73a6d30f719e1d728352bca39619eddae5de307a876e38985feff0da11c66765f1457f81462172a4460f3a045934b811f11743280183340

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
                                                        Filesize

                                                        44KB

                                                        MD5

                                                        d9afc5a7b843cdd22285389e4d78c475

                                                        SHA1

                                                        18b5fdee7babc6a56e04fdb10328c9e5f653052d

                                                        SHA256

                                                        3f8905001e5f7adf33ae12896e9c3bb58be689fed548a051970785160d98a1af

                                                        SHA512

                                                        3d4ec2ca363f13beda2c4d06bfa39105bebc582638d71ee8e4b4a280c4d37eb5aa831971cc0e6b28bd437c7ed45a18fe1e1ac31b17404e011fef8d803c39b81a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
                                                        Filesize

                                                        264KB

                                                        MD5

                                                        60daabf02bfac3e12be9ed78394ad025

                                                        SHA1

                                                        740bbeb45239f1ea8e5b7cdaecf3ac03ba311bef

                                                        SHA256

                                                        28c3e42777196e235fd565a001c8586e1a98f1bdf7aa0d0f1c724160c199e3ff

                                                        SHA512

                                                        1178e5a86a01997687eb19b2df12f709749d29973bb2526474d3bbafd2daa2d1cec1c6f3dd2a50f406f8b1c89377107a5441a5c0c0cf08ea4952860c109940ee

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
                                                        Filesize

                                                        4.0MB

                                                        MD5

                                                        cba157d17692f95e7f5c3e5a7ea2dcd3

                                                        SHA1

                                                        b1c5742e5cbe66caf8c0b5cc43ea07f477ac751a

                                                        SHA256

                                                        15c8ae8f82824b04cdceb2d0a5a5abb5402a2508d5ff01c68da4f53437bb3837

                                                        SHA512

                                                        74f9fd1c3047b3a5890a00542d8c7bdeda8224f558fc3bead8a9da2b60c173e0b1640ab0a7c1dc36b11ebb16f5e2d291e8763c90a7f6e0dc985dd3f3cc309aa5

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                        Filesize

                                                        11B

                                                        MD5

                                                        b29bcf9cd0e55f93000b4bb265a9810b

                                                        SHA1

                                                        e662b8c98bd5eced29495dbe2a8f1930e3f714b8

                                                        SHA256

                                                        f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

                                                        SHA512

                                                        e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        27063f16bb37d06d93b2b336d773727a

                                                        SHA1

                                                        34fa486d23d9c1d4dc9ba37ebee367264b85fec9

                                                        SHA256

                                                        62bbcfe0070953f171b6aed2c1f1637964e2abe4d8707834484e5b962fb2ea20

                                                        SHA512

                                                        6f112546cb8bcb86dd123778e3b4c0959c6d4d3e8be49ca1498c2b0d048ec675376575eec44d198be7dd88e82150f008154b404773e7e3cba3bb01da828d89d4

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        29c223be8a3b5643d8f64987a62eb67e

                                                        SHA1

                                                        0c2da2b04b23e35f3f27ddf7713ce35bcbe53810

                                                        SHA256

                                                        3e782a7b5599f6d7f0ddbbcd52e282f438a01d966bb70aef865f9c5a5b7f9545

                                                        SHA512

                                                        a383bed5bcf8fa7f0b68446a353e3d9707b741f79283d0af1f5459cc88e7d46ce04d3363336a87d0c9752e80e3c0ec9dba90f32c148118d83def4b40322c71ba

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        11KB

                                                        MD5

                                                        3713eb18e7415933f91089dd5995740a

                                                        SHA1

                                                        7d406a1dbe20279536a793f1d714f52f63ab0ef4

                                                        SHA256

                                                        bd7640c797b57602ea266cda85f48003d41efa9d8940d0b972c5ce24a3ca14fa

                                                        SHA512

                                                        e0eab1bb71382b03252bde51300d71601715e1ae092d402e00a0a81d5ec8f7b133d1a3b8273ed72a78f4021fff73e3b37508c1c890ed2bdf96305356b1b6a787

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                        Filesize

                                                        264KB

                                                        MD5

                                                        f50f89a0a91564d0b8a211f8921aa7de

                                                        SHA1

                                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                        SHA256

                                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                        SHA512

                                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
                                                        Filesize

                                                        4B

                                                        MD5

                                                        a7b38619284dbe244134cfe4f99e4224

                                                        SHA1

                                                        bdf465b05ad7308a7aa651e3d7625cf4bd131372

                                                        SHA256

                                                        c7f5b71feb108c94242d4e46317d196653354ddc1fc3b79f6e575d987e4d5661

                                                        SHA512

                                                        7ac7371ae86698fd94b4c7df001dd50674ae3c0184195d8a9e4d35141aac6e76e00e06d5a43b23f104dc3308d7a7bf8648ab7f283f961287dced0bd0ea0a01ef

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        944B

                                                        MD5

                                                        d0a4a3b9a52b8fe3b019f6cd0ef3dad6

                                                        SHA1

                                                        fed70ce7834c3b97edbd078eccda1e5effa527cd

                                                        SHA256

                                                        21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

                                                        SHA512

                                                        1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        944B

                                                        MD5

                                                        6f0e62045515b66d0a0105abc22dbf19

                                                        SHA1

                                                        894d685122f3f3c9a3457df2f0b12b0e851b394c

                                                        SHA256

                                                        529811e4d3496c559f3bd92cd877b93b719c3ac4834202aa76ab9e16e25f9319

                                                        SHA512

                                                        f78426df6032ee77f8c463446ab1c6bb4669ef7a2463dead831ec4ff83a07d7dc702d79372d8bcaf4594bf0fb6e11e9f027f3e0325de9b19be5f51b7b80ed54a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        944B

                                                        MD5

                                                        8cb7f4b4ab204cacd1af6b29c2a2042c

                                                        SHA1

                                                        244540c38e33eac05826d54282a0bfa60340d6a1

                                                        SHA256

                                                        4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

                                                        SHA512

                                                        7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\42e16c94-dece-49d5-9aad-a7772bc5ed4a.down_data
                                                        Filesize

                                                        555KB

                                                        MD5

                                                        5683c0028832cae4ef93ca39c8ac5029

                                                        SHA1

                                                        248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                                        SHA256

                                                        855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                                        SHA512

                                                        aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        1301a13a0b62ba61652cdbf2d61f80fa

                                                        SHA1

                                                        1911d1f0d097e8f5275a29e17b0bcef305df1d9e

                                                        SHA256

                                                        7e75ad955706d05f5934810aebbd3b5a7742d5e5766efd9c4fc17ee492b2f716

                                                        SHA512

                                                        66aa4261628bb31ee416af70f4159c02e5bbfbe2f7645e87d70bb35b1f20fa915d62b25d99cd72c59580d1f64e6c6b5ad36ace6600d3bcdb67f45036d768ed8b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        964219fcbf4c1e0008bc5e05686367a9

                                                        SHA1

                                                        685a0b860afbfd43305bc67763e41b296a22ba8b

                                                        SHA256

                                                        4f4388ce8c3055db4827ad4b6d7d6ffc7bead99955a3fbe44ab3a5454651ae25

                                                        SHA512

                                                        2745f64b2bd54740a5c1f754785c39eeda9b6b5112707cc8630ba188638442de7c636446f750aeb340905d9da26f96ee4e7f7c96e2b690058ce29d7b6efe8c16

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\7zO020D4708\mapper.exe
                                                        Filesize

                                                        78KB

                                                        MD5

                                                        919023267a38b0b6641b26319901fddf

                                                        SHA1

                                                        dbd25f981353ce0f824fb441a2a0dc2441bdc8da

                                                        SHA256

                                                        c68421f86ca419eac8bb89fcd66b860db60ed4201c16bfa4159436bbbae9401e

                                                        SHA512

                                                        ece9275342a3986ef2ab60e0128ca055ea7e1352c13c05367b62e1296dbf4105d757ce0181a79888f1144f14379dc15518aac87bac81da093036ba1a243bbfbf

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34elgbzm.toj.ps1
                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                        Filesize

                                                        16.4MB

                                                        MD5

                                                        ee2397b5f70e81dd97a4076ba1cb1d3a

                                                        SHA1

                                                        8350f648ebd269b4bca720b4143dd3edcdfafa8f

                                                        SHA256

                                                        b5b1454e2e3a66edf3bde92b29a4f4b324fa3c3d88dc28e378c22cb42237cc67

                                                        SHA512

                                                        57fc76393881c504ac4c37a8ea812a7e21f2bed4ffa4de42a2e6e4558a78bba679ec0f8fcdc39798306c3a97e424fb875680b7f78ac07be3f7f58df093575562

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\places.raw
                                                        Filesize

                                                        5.0MB

                                                        MD5

                                                        202bc5983df360b1354679e2a1b49b78

                                                        SHA1

                                                        1291fb2b6868939fdbe101d5c49c95086803aa23

                                                        SHA256

                                                        5b43e46d743f9456d445e0747f274612755e875d6f2a21bd27f217caa7e6ddbd

                                                        SHA512

                                                        7a3f434c4f6e5939762eb8791d089c7a76422a48969ec125c52a41216769fc626c69b53af43340fbb332f6972e40d91c62a81e39c74b5c72d41cc06bceef9aac

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\tmp7029.tmp.dat
                                                        Filesize

                                                        114KB

                                                        MD5

                                                        e1bdc949ed4c93a97fa61c08b886f2cd

                                                        SHA1

                                                        05db7b0192094768b6f436a0c6e725a3377dded3

                                                        SHA256

                                                        463bff1de5e1a9ec2afe031a34ddf242df7f8b9a5803a285a842f4ad6320e1b9

                                                        SHA512

                                                        899b7b08b799405b82b16d542217039fa43203a08de91a9f1594c1c61f87135fb9cd11de08a15a9b69d7b5410853ddcf1797da004de736363085210660fac14d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\tmp709D.tmp.dat
                                                        Filesize

                                                        112KB

                                                        MD5

                                                        87210e9e528a4ddb09c6b671937c79c6

                                                        SHA1

                                                        3c75314714619f5b55e25769e0985d497f0062f2

                                                        SHA256

                                                        eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

                                                        SHA512

                                                        f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\How To Decrypt My Files.html
                                                        Filesize

                                                        639B

                                                        MD5

                                                        d2dbbc3383add4cbd9ba8e1e35872552

                                                        SHA1

                                                        020abbc821b2fe22c4b2a89d413d382e48770b6f

                                                        SHA256

                                                        5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

                                                        SHA512

                                                        bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

                                                        Download Submit

                                                      • C:\Users\Admin\NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC
                                                        Filesize

                                                        16B

                                                        MD5

                                                        1940d9335431ffd1fa3ebdcbe8550cc8

                                                        SHA1

                                                        6ce436f326712689149a0387e442c9b147d19852

                                                        SHA256

                                                        5d634afbf777f6a2aabdcdbc85d68aed8fc93085ab708f722e4b2bfc1f4cb94c

                                                        SHA512

                                                        632bba97286cca3443f0ea032e0597ce90738dc31808b22bef34159e7e60fefcf1108d6f5f85a387d6cb69e2a231f98728a10c8f85143102b380938adfb74b13

                                                        Download Submit

                                                      • memory/1736-13-0x0000000000AF0000-0x0000000000B0A000-memory.dmp

                                                        Filesize

                                                        104KB

                                                        Download

                                                      • memory/1736-635-0x000000001C5C0000-0x000000001C5F6000-memory.dmp

                                                        Filesize

                                                        216KB

                                                        Download

                                                      • memory/1736-183-0x0000000001250000-0x000000000125A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/1736-169-0x000000001E430000-0x000000001EB3C000-memory.dmp

                                                        Filesize

                                                        7.0MB

                                                        Download

                                                      • memory/1736-676-0x00007FFF23C20000-0x00007FFF246E2000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/1736-60-0x00007FFF23C20000-0x00007FFF246E2000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/1736-182-0x0000000001210000-0x000000000121C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/1736-12-0x00007FFF23C23000-0x00007FFF23C25000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1736-185-0x00000000011E0000-0x00000000011EC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/1736-62-0x00007FFF23C20000-0x00007FFF246E2000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/1736-61-0x00007FFF23C23000-0x00007FFF23C25000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1736-63-0x0000000002C90000-0x0000000002C9C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/1736-66-0x000000001C7C0000-0x000000001C7CE000-memory.dmp

                                                        Filesize

                                                        56KB

                                                        Download

                                                      • memory/1736-129-0x000000001D4D0000-0x000000001D5EE000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/2376-14-0x0000020C62D80000-0x0000020C62DA2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download