redline | hxxps://bit[.]ly/3pt0Mav

Resubmissions

03-02-2025 02:11

250203-cmj2csykap 10

03-02-2025 02:08

250203-ck1lbsyjfk 3

Analysis

max time kernel
300s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-02-2025 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/3pt0Mav

Score

10^/10

redline defense_evasion discovery infostealer trojan

Malware Config

Extracted

Family

redline

185.223.92.157:44160

Attributes

auth_value
4e5c6e2ba7063e715c19d342d7f1bcc9

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nitrods.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nitrods.exe

Executes dropped EXE 8 IoCs

pid	Process
1088	nitrods.exe
1532	nitrods.exe
3384	nitrods.exe
1260	nitrods.exe
3004	nitrods.exe
3520	nitrods.exe
776	nitrods.exe
3568	nitrods.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nitrods.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nitrods.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\nitrohook.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
1536	msedge.exe
1536	msedge.exe
3652	msedge.exe
3652	msedge.exe
1032	identity_helper.exe
1032	identity_helper.exe
2068	msedge.exe
2068	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3372	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	4532	7zG.exe
Token: 35	4532	7zG.exe
Token: SeSecurityPrivilege	4532	7zG.exe
Token: SeSecurityPrivilege	4532	7zG.exe
Token: SeDebugPrivilege	3372	taskmgr.exe
Token: SeSystemProfilePrivilege	3372	taskmgr.exe
Token: SeCreateGlobalPrivilege	3372	taskmgr.exe
Token: SeDebugPrivilege	4680	perfmon.exe
Token: SeSystemProfilePrivilege	4680	perfmon.exe
Token: SeCreateGlobalPrivilege	4680	perfmon.exe
Token: 33	4680	perfmon.exe
Token: SeIncBasePriorityPrivilege	4680	perfmon.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
4532	7zG.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe
3372	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 540	1536	msedge.exe	77
PID 1536 wrote to memory of 540	1536	msedge.exe	77
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 2488	1536	msedge.exe	78
PID 1536 wrote to memory of 3496	1536	msedge.exe	79
PID 1536 wrote to memory of 3496	1536	msedge.exe	79
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80
PID 1536 wrote to memory of 5052	1536	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bit.ly/3pt0Mav
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdf7a63cb8,0x7ffdf7a63cc8,0x7ffdf7a63cd8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4588 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,5027213395943583379,9765978007234258259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3840

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\nitrohook\" -ad -an -ai#7zMap18623:80:7zEvent28362
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4532

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1088

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4044

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3888

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3384

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1260

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3372
- C:\Windows\system32\resmon.exe
  "C:\Windows\system32\resmon.exe"
  2⤵
  PID:3428
- - C:\Windows\System32\perfmon.exe
    "C:\Windows\System32\perfmon.exe" /res
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4680

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3004

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3520

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:776

C:\Users\Admin\Downloads\nitrohook\nitrods.exe
"C:\Users\Admin\Downloads\nitrohook\nitrods.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=nitrods.exe RHvMvO (32 bit)"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdf7a63cb8,0x7ffdf7a63cc8,0x7ffdf7a63cd8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4766225469087515005,16833325135835206124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\93570741-fa1c-4385-b9de-d6535590c3e3.tmp

Filesize
11KB

MD5
8c4597d4a1874b1504731cfbb2f2694f

SHA1
f4f8e914299f0ac53c945f565b72bee67e9e98d1

SHA256
60e7ab78345c761fe8e5130f95c3275fcaf6731a4d0b402e71c0dbea1896e014

SHA512
e8321e534b4a00593991a3e3cd072a7df7bd62f844f8526be4d3f24d1aa2517898b0071543a133d527f3c8d6ac9a9bdaeeb5bea3f587103bc0196cbc6f5c63f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
153968a22a612aaf559dc116efb0e23c

SHA1
2b267abd6bbe02f613aa2d274367e1a45b29a819

SHA256
5f45a2b9a694ab5a09e548e5f9551beaa511aaf442233b095058e873122d1e87

SHA512
002f9e7ba7d5dc6475bab2a988dae57bcf68b1783063b885fe15db1f8ac45a43b39dbaecac726b8b802ca314ba965c9854bcf03d6eda35bb70e249cfc55ac687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a601b552ccd89aa0664605b0f0dfcd3f

SHA1
65208b0c092e54cf60bb91434b2352fbefbe17d5

SHA256
129ad764ad7fdf54ff2952464330af6b1848485ccc2f5c8b046a5d7241aac864

SHA512
82af287434f2475ef1a764366291889ea255372b43954fd4e428f2deb3059ea007edcc5b479b35eca7769e1756f147053506776f07f452d11e4fea198bc0ecaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
59281062a1f0a90153c636eb1fba00df

SHA1
bde3b144392e28493cebe7194990ce543fca2ecf

SHA256
499b5fc06cb044b88caaa48aa6db9232c91691b75e5e9565b971957110f1bea9

SHA512
09e7981731d3e1b9496c2ed01d1ce0a2a3bc3b33882078909a246532a700ea0eb13fdc98ddb2e1d9adec22d4131e2a28c3ca3efe276a2cd20e69cf4b2dd8d982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
85f2b54e3ba5df1ca778c160747782ed

SHA1
8379256576b876b296af82c30656f4f0a89c5802

SHA256
8d9bd3edf646a1a2c6976da3cab1f0f1e2c9dde6ffbfb1a986c8e2bd970485b0

SHA512
16d61fd916fe4e264bdbd0674b142f4fd34333e01e5684a8b7482e53c81853bcf25eab40db84f955133d88c2450c6dbe1811961a6897c87c214bad01f2f42404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
36KB

MD5
483cce2dc3d30227c9fdd1be3383fd19

SHA1
5503c4d039f6f4a61a992aeb10a1deb49eb1ea8d

SHA256
b9575ddf517a1039115ad06f9b66e4328c843fbfcdf80e1edc1dc5f8614465db

SHA512
9be31166a76312b6e454f382ebf49cc41d17d5c7a799941c98ec4f6c1d3e8094e800c7a3df571a893db858194b266500a1c4cf55293b43a8737e73cc359ed8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
24KB

MD5
664fe4876c6c0927837562e0c9dc0685

SHA1
7d920e5d9152a72f4d827abf7e9cd6ce8f1f4119

SHA256
fa1a9910822c815d39f48b4cd7e2d2f80bf2831cfab7be7593138e6e540ba8e5

SHA512
1b4cea5e9e82b920efb1e131723e0290d3b14d8efa59f344253807df8ccd49805b2d5f549e08def5d06137160a0ed2d4e29d7d32c4e19563af623e4d0457ad8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
29398d516879b2c227cff497a078cb1b

SHA1
881888a49a68027dddeb1a66a4eb7703045ac910

SHA256
68f485201a4dd49de170ee7fe6d60b6c75e7fa11d98f1837dd5006973bad8393

SHA512
e020e18a331328be8602ace20d5969b32f57486fe8eb625496a46eb11261690523be7ecee043e9516bbe83fc881f80c746e702c04fd56b70fad669bd730d10f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
120KB

MD5
6d13a036639cf4e4fe5470493fa3b7b6

SHA1
247f36565093c5a67d4da3a19b550d9cad2ffe7e

SHA256
c1070fcded96c90d2e81cde45aeeabac69bf24d89904d832961a057805fa2905

SHA512
319511e372dff9f8c7f65a948169a1b2916699f8aca202e09b5e2c149a179935f9a82521855acd6aac0d5f02259e7bd388876c040c7963c071eab79cc2c811a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
11KB

MD5
9b703b03b504265d52b3a84a0b0a4902

SHA1
95f29a9ea1f1576950ec1a19773d6d81359f5a27

SHA256
40e8d631e3512dda929e4f6a2cda2f362304c35518af54f160c326bd9f1b4fed

SHA512
b718f906924e6008794e1d5dd97ae5ed8445c3c750751cdc39e57f21f0fde138d47a212eea86ff8818bcf28a724d7914e3c56ee3ef8e920b75d013ff4215478f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
930B

MD5
05fa70842cb499b2a5ee74e626ef7bc5

SHA1
7b1b94036d4a31fba5069b5e6e9016372248aeb9

SHA256
0cb645c425d1b005541975d391b009070f464df89170cc376b2cb7d1e7eb940f

SHA512
8d6e9916323e93a64ef098d95d9f2fc93db8e2b007061eee52633e5143611766df475865232de70c8d3a79c25e08b50e7dbb40207ea1d526b5ad5406f70115a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
28cd0c40d28f74b7454f0bd6bfc7b216

SHA1
5268ed76bf5ae2cbbc0f0510c8fd31d6d5ca2897

SHA256
927bdd2b928a52b93ae87ad8f51a2b5f72ca5b50042d49ddb02044d74c1c2ab5

SHA512
0b6866f523ab3a464e79e5c934a264f9a80c919f0a6d73b969c057fe082e98585953f790be4fc6d2aad17a61e97f7606b24b0129ef3c8bd95c5b0d6b46f56972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2f946dfd164003ba2a012d127c31d8f4

SHA1
24fa8af1534b300a8ead4ffddd59ed35c6d2af75

SHA256
990b56e9cfc6b32c712e33a61faf9e60fa53028b801b00d727c0c87bb922dc80

SHA512
3b616415084de799c7f8569ac1377b4a81be3596065453c3898ef9b73a4f0af7574588206ea0595d82ee5be7fbac3eaf4a528a2db14e2acb255e4697ea317330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
86e8b2a03866005a3c66b1fa84dedb6d

SHA1
85840403f83f7531f3e623b4ecf9c7613a53f99a

SHA256
e51621a7323ee1b0ac037472ccc76190a3125c51e32cfd86818f8707cf23eb08

SHA512
fcbbda0540b495ff54f6c4b31d64b5c6541e5b719f5c1de6d54563c4b67621648777fbe563cddfc521bca30c1ed8e41d21bd74ab1d1990e89475158949abe634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2238c2dfb74b92cb02ecda05b7def5fd

SHA1
83cf48d4805770bad3fa1dd5c138f676d0baebc8

SHA256
679189aa3031a15a635105e1f7f8d5e278ff9d62e90bf1cf2cefee969146f439

SHA512
3bbca9508ec749ea6339c438b7555c391d5ef7594e180e30d1a7a50605929c382719aa66627e6ea49849b5c0e145fed66c50660d37b300ee52b6f84e1805cc85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7e79528490c7d219a9420f5fe1b7e73

SHA1
2630e865e9818220486e87194f7dce3b551f7aff

SHA256
a36f237a7ca524c1fe77c4197c4ec62c98f96283e11c14418795ed8711f6f432

SHA512
a7671ecda6d774bae7c2bee3765ddb2133c9f13aa5f7632ca9e5855b75f48799e39d84c942b52cb49090f573d381626a6aa6c679699fbab4d90a3b779890f68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
42cce5eb41dcb0cbc9c05b3a1521b7fc

SHA1
38b43a549bec75059b4de2801caa5ea7511e3096

SHA256
69db729ae26b76c600765b1131bb4638fee6655e9419d9782ec52ba1febd3eb6

SHA512
cf36b1ddc400ccc13e34ac727a305f98d17b293cf17f934d71a11d5dfe426b01bb1fd43d2041418111b41d7a7c1d78e575480e4e7a3650b127ea01aea788895b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e525321609a4de43df95abc3271becbf

SHA1
607ff5eabb7c13af4cdf934f6261b9fab8390bd7

SHA256
827090bde65f5ad78cec288f00efc1a0572cce77da96e8ddde4fdc24d60b2f19

SHA512
11ca7e6757335131c8e11ef08ce14ecaa6aa6154c1ef2c5d35aa3278d6d2cb2a65eb284b259a3a14373c3b4385d86efe4cdb3a53b6eb10af18d43a51c3c602ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6e4265ad089231dd35af64464990bd99

SHA1
26c7d6ee4489587e6946e0b2a0659844fec3b97f

SHA256
957712d9ba5e154a37b66ed3ec7f5691fa1096f68f8e8a77c1193c3db123c6be

SHA512
1e931998813d7b7de212924c7b882e258aafb310a2ac4a30b00c0291f91fbe90c6666e41d80ce226ca7f0dda4caace6eb39eaf00d8aeb07a9d68534d5b53539f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ce71f102d1493975e50a420afeff9b7

SHA1
79084d29c9c6df4bcd7b09dc062a260cae17a63b

SHA256
6c5c76ff070349d2fd2bbb8a543e236f6757ecd9ed9a89e08e06e10d926bedf4

SHA512
e97c7706e71aa5a651f27fc13191121b0adfc519770b3d64997f2ea1228dab5d9684511c28498f3e8f2b74a00f15978ef1a5f77ca5ba7c3d1745538f28bf48a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a590b7b0dc15e35723ebfdf4806ba31

SHA1
65bdd26cf3522ae2485d5c24845004289031886d

SHA256
d5f3f3ee53497a2143558523de1de08b2b1a26eb4e1675262b1d2322762d6ed9

SHA512
4d3481e6044e946ad63ebdc2ae265afa5506d2236501ecbfe494915e74e75e19afabc4fe6f4aa1e61bffbcf1b3cf0b179ee23bfff3de05f4900785335daf9580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0f94c2fe3297a242d3024c915baa86a9

SHA1
e26e3d2827f6e5cb1c95792829a1c4dd3945f661

SHA256
f6cff177b3d0df8abc21367732968f04c0962f7af1ad711f967007968f711964

SHA512
e0864a283ebc7f8c2e57219d8300b6ae8b763f2b512bba8aa03f390275437aac639df286157273260e5b833851ba3e93dfcc7bf1e7b1b861bddf3f8b3aa2caa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13383022321328022

Filesize
9KB

MD5
987e0f047f7f3d9b96737cee8b7f7249

SHA1
8ad4b1c63715e4d3db0daa72f0e29a0a2d6dc2ba

SHA256
428148fba17b43d4455b0b9c542759772b9c28b25e7b8840ebea442d6fc4b088

SHA512
7d46f5c759a42f1c268967caac5d909b3abf7f417988004e87c844be301754253a833a8f54c7328a7f750d08a7d799421725c6ae5be9d7992da733c706cb837a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
60bbd098a40da5d996f2a3ed4986d42d

SHA1
68e78fa6ac03e471b3e09af002ac33135076e873

SHA256
e042add0915f62e2d2e174d66a80d7f50113dafc0cdd822ff991d12d5963d086

SHA512
4b2eca625551558b641453b339fd99268a99c8bc81332e79abd3c76424264317d387be1b4c989cf7320445dc6a0d8f17341076a14f9eee7846d5719d7c3dcf8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
2a3608ae32a4db9839ec3cfe697d7756

SHA1
a651104e4f029aaa98ad07394e365415223242d3

SHA256
d7d50211266e5720a37f554670204c588bcee1dadbf1e6875a6c90cb1823d553

SHA512
7b4967077a9e9f5e41c7d4c49ad7b25e841df6323828a8886c5965a38d4cb4b77516faef5dbff36ed941f45a0a536c210aacedb594494761e5cdd8158ea41b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
5e076db4145334d27d1355110898882d

SHA1
c6ad82053ab94fbc9128810c19aa7b2a8dc4661f

SHA256
afdd6bacdd7f066adc98a301ebc1f220b4868ba33cf66eb6552637bc6f8afdfd

SHA512
bbad73be90d56eb3f476ad262ad161c125240d106770e13cece901de018a0e199888c16834ad5a75a010520a64fea04e057910c45ec9ff3715106b67345f2fb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
781ef2291303015d66830ba1f1650b81

SHA1
986d9a98351ac1ea00ef578e1cd9750f14c2a160

SHA256
698f66c6affc517a897b6f84d3e5438534f4d3fa9873fb06efce705bb1c53e5a

SHA512
3077103d5b5d0df4be23f919626e935549ea9415be98c53ea3634ae90a86da4e786fa5c8dca67f23d2d3fda2099102b03f6c4bdd8df6e8710e5cc1e9a9ae1a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59aa40.TMP

Filesize
538B

MD5
d0910746c2017749e830735c08b4480a

SHA1
2a1b2c3d1c9ea8f6c7c63dbaefd43bf8ab52c630

SHA256
ad641684da631462e1dd8e01fa98bef3763ee68ff3478d36346bd6f7edf337bd

SHA512
0ca01855e0ea3586f0233b958eddcacffd8fba1d3ac0e7c114c6fa7a47f0a8ce285c083c1a4a968e2f8d08ac33024b2d51a5f2c4c5ca1fa92ced79a7a9c9beb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
110f05790476cc652e0e3d172fac7c01

SHA1
c9609e90e554a4bb80a7842600c9a98a503cc757

SHA256
ac3440312241e927a70e8eca66213c9a93f515246ae4779c39844477f45b396d

SHA512
60fc9a8e20f4d40e039e143fc0334927147f887e62c2971613141b0ba8f7a69d4cb2e80546411aeb046641eada09b45a987917ba9daab6936011c2b9c2fcd468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
64e9038b1a0937c0e757131761db62a4

SHA1
2dfe34d62155c38bff7b4c49ecb19da2c77ad976

SHA256
7a936ebba0cae4fb49cb8c94b9b72fff2cdf14c167ded0fa6d95b555371e4d10

SHA512
7b28f58dce611dd52d0b5e37236c259936f1cc47f12308c3c19fc2089b98f46081ecdff494e16d4b9716282997e9f7bcb64d8e99d412fcf917090a4b354e6bcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
1.7MB

MD5
4603f2c2f6e29b43eb26adc3ea809b3d

SHA1
0093045a5fd88297067f92ae07d5747f33423076

SHA256
a1434a831cabd7c9a11e1bf5b5cae520787917755abfc052a605a12c6bc32666

SHA512
8bc50560c26f09023e9bcdb2a917c935294ce2f96595245002a4de8ff9a97b5239a09b0c2d347a7ab36c90bbfbb2082a133704f6b576cf15e63da4d628865fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d8cfdf2c97bb47e39ebf0d12a4ddc5bc

SHA1
a24c31922c2577ce8d020ba165ef2b18d73df96e

SHA256
63c278066063f8c93586a29562775c0ef71f0bc8d9c66c3263ca3f5535f8d60a

SHA512
0040241fa0a4ee7fc0abd72f846088132586fe3b40f2fe4d57882f6fe19158526ad417c6a98bb650827d339b52b7bb66df173fb495405dfbb6f3e44721a2a660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6dd973dfc25adce9f7665552fd8897a1

SHA1
4a30fe3b085324783a754350d86f0a424767df2f

SHA256
29b0577ad0efdbdd21e78e35a4f86c12bc8a59f2743d746f578ecd59b06b92ef

SHA512
081407f0ee4931db7cf98320b0868b6ddda901d744bbe964ec646b872d78062642499b18d5a797219b3c2197d1f02a3a83bbe113a32535f8c38fccad6a268309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7482dbce486c2b0ba64aaa606e5acad7

SHA1
2e4d348d74407ebda5c7f9dbbeb9a7388715c428

SHA256
a1c3c81bc86e7f8a71be293863732ee2cc5978b8ac998ffffe609e78f7741dfa

SHA512
9c346df1f641737c897a3f55c68c681bdc5286750522ef917b823fbda0cb5e44cbb6d8b7e4b2e2eddbe74259c5809de81c828840aea8bf82688b111a9a222536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0c195e1fb668aa3d029c6f633d13eb8

SHA1
32767862b6f2c8fc8429b2a1beeb71bfd3a00b9e

SHA256
7f4737b05d0c616d4db6c71b012f830c6d3d1bcf592de0b09d441c2a07da3c06

SHA512
73d1a874405d923527c4f2f95e0090acff0c4153202985075becb1ea32667654ef1decabc45ce221389481c87c1487d5efeaec652e97498c6bece26b052b75fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c63b930d7b491033d0c7ca4fd68fef92

SHA1
d2d0d2ca25d4abeb6ab2facbe92c63512d413b78

SHA256
1c7c0d7dc776aa4862b68510a00a6a28da5066cec830e24f0a53c2e34d34fe2a

SHA512
24ca111780d2f86fcc821677a5e10130f6a5319f159a7ba52c8cfa2dd496758e1afe11840cc667b75404c45ae250defe8791fa2081d0d44bed0fd80b207d60c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1e4fec732c47dc2bce5835b5e89270fc

SHA1
c6db2547f8a09f408f83352d9a15ebe98e43d4ad

SHA256
2dd2c996bc1e8c3a260815ba8935167274a8be6687416f444bb9df5ca780f4a2

SHA512
5d71dcd5489ac1c1ad2c29fa653b0db37dbb4667392c26de42f0287f0d886ff2508df6bb359b48868fca1dd758fd3667bd63e237249df90dae5a78ea049f8fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ce5af153376db178b6b084c6e2157bcb

SHA1
938cf32c93304c05f54a177d20740dcb72e94766

SHA256
e069e4f7d4ddfaafa17ceef591402d781d508bc66c20bde8c992b742e7958997

SHA512
4f3a6afb4818f3b1ec6d2798e4f74ceb9c7f3b82b50e4559095019b9f0f4e3d0b13996ac5dde73d466eeb5e2c4fbe4e5a91bb461414c167766e5d1e2b636d788

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\63cba824-da7c-43bd-9353-86fc56c0e2bb.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\Downloads\nitrohook.zip

Filesize
1.5MB

MD5
cdbde675ae3dfeaef83542a11e1425ca

SHA1
808e350d4692795076b29f3ad71fabe9082e3144

SHA256
0439cf2384fbea87423bbc6b1b4352039559beee5e315221817662a5d9157f10

SHA512
7db2f5108519868c21ffac6846ff258a8fc6bd4d01780100f66fe5914f85d9133fd1731b63437152c802ffc44ff9871fd3beefccb08786eb5ca61046d4cc9872

Download Submit
C:\Users\Admin\Downloads\nitrohook.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\nitrohook\nitrods.exe

Filesize
1.5MB

MD5
c623690fa6da2e600c16a7cfce9a45f2

SHA1
79330d04da6de601d32727301990225eb967fbba

SHA256
cfea44c28f60758a405ce3fbb586e3eac12c478b95e6c36e6b26e9c0f32864b5

SHA512
18b93185e6f82eb90571ac1e2e12b740936355a6aa161d9bdddeca5fc092d2fc971f4d9258d7173d73be06193351bf9dac7485e35d9005d08cd9e6dace80bdeb

Download Submit
memory/776-704-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/776-702-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1088-194-0x00000000066D0000-0x000000000670C000-memory.dmp

Filesize
240KB

Download
memory/1088-195-0x0000000006750000-0x000000000679C000-memory.dmp

Filesize
304KB

Download
memory/1088-187-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1088-189-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1088-190-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1088-191-0x0000000005F00000-0x0000000006518000-memory.dmp

Filesize
6.1MB

Download
memory/1088-192-0x00000000065A0000-0x00000000065B2000-memory.dmp

Filesize
72KB

Download
memory/1088-193-0x00000000065C0000-0x00000000066CA000-memory.dmp

Filesize
1.0MB

Download
memory/1260-277-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1260-278-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1532-206-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1532-207-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/1532-208-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/3004-673-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/3372-498-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-508-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-509-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-506-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-510-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-500-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-499-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-504-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-507-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3372-505-0x0000023068EA0000-0x0000023068EA1000-memory.dmp

Filesize
4KB

Download
memory/3384-253-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/3384-254-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/3520-694-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/3568-715-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/3568-717-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download