hive | hxxps://pixeldrain[.]com/u/TcV2BREC

Analysis

max time kernel
306s
max time network
313s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2025, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pixeldrain.com/u/TcV2BREC

Score

10^/10

hive defense_evasion discovery persistence ransomware

Malware Config

Signatures

Detects Rust x86 variant of Hive Ransomware 5 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002b217-1348.dat	hive_rust_x86
behavioral1/memory/4904-1476-0x0000000000F70000-0x0000000000FDD000-memory.dmp	hive_rust_x86
behavioral1/memory/3596-1547-0x0000000000F70000-0x0000000000FDD000-memory.dmp	hive_rust_x86
behavioral1/memory/2528-1905-0x0000000000F70000-0x0000000000FDD000-memory.dmp	hive_rust_x86
behavioral1/memory/4780-1907-0x0000000000F70000-0x0000000000FDD000-memory.dmp	hive_rust_x86

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Hive family
hive

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
163	3508	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4904	hive.exe
3596	hive.exe
2528	hive.exe
4780	hive.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
158	raw.githubusercontent.com
159	raw.githubusercontent.com
160	raw.githubusercontent.com
161	raw.githubusercontent.com
162	raw.githubusercontent.com
163	raw.githubusercontent.com

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_948613464\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1755911365\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_626739525\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_948613464\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_909080003\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1075886438\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_626739525\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_948613464\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1755911365\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1755911365\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_948613464\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1755911365\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_626739525\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_559581288\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_559581288\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_909080003\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_909080003\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1075886438\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1755911365\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1075886438\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_626739525\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_948613464\sets.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\hive.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hive.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875550974021708"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe! = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe!	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2081498128-3109241912-2948996266-1000\{6A3164C0-51E6-427F-882B-D0078F6E1B04}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2081498128-3109241912-2948996266-1000\{46D42B14-2639-47E5-A0B5-D500AEB5541F}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2081498128-3109241912-2948996266-1000_Classes\Local Settings	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\hive.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
832	explorer.exe
832	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe
Token: SeShutdownPrivilege	832	explorer.exe
Token: SeCreatePagefilePrivilege	832	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe
832	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
832	explorer.exe
3880	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 3148	3124	msedge.exe	81
PID 3124 wrote to memory of 3148	3124	msedge.exe	81
PID 3124 wrote to memory of 3508	3124	msedge.exe	82
PID 3124 wrote to memory of 3508	3124	msedge.exe	82
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 4752	3124	msedge.exe	84
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85
PID 3124 wrote to memory of 2616	3124	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pixeldrain.com/u/TcV2BREC
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffe5683f208,0x7ffe5683f214,0x7ffe5683f220
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1976,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2500,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4084,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4116,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:9
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4164,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4184,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:9
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3640,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5392,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5308,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5228,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5992,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5992,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:14
  2⤵
  PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6232,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4092,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6640,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6684,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6864,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7000,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7164,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7236,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7160,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5032,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=7200,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=3484,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=6764,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6300,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6344,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6752,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6460,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=7424,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7420,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=4720,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=6848,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=7808,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7724,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7848,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:4872
- C:\Users\Admin\Downloads\hive.exe
  "C:\Users\Admin\Downloads\hive.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4500,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4072,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5608,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5224,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=764,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=6128,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5236,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=7452,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=8088,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8024,i,6452503659048918203,5131048651896381637,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1708

C:\Users\Admin\Downloads\hive.exe
"C:\Users\Admin\Downloads\hive.exe"
1⤵
- Executes dropped EXE
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:4848

C:\Users\Admin\Downloads\hive.exe
"C:\Users\Admin\Downloads\hive.exe"
1⤵
- Executes dropped EXE
PID:2528

C:\Users\Admin\Downloads\hive.exe
"C:\Users\Admin\Downloads\hive.exe"
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:708
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2456

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2576

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\703ffbcf-3d5f-4a64-a95c-ab54dc6265a5.tmp

Filesize
392B

MD5
1e7499362857d31e8479b30f24a2e40f

SHA1
8cd1d5da3f88300126fc863143da6fd28ed118d3

SHA256
d46ae44d59e2a12848c1ed0b835f267f6d5bdebe2869be75cdee6498087d19ad

SHA512
1602d6f1132e2f0d262de5ca4582cd2c5c8320df745b4ea83853aaa30495aa9f394e4acd18761a048c1281c3826dbe9ceff5aff4b6c578e1ca8d24929f39945a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9bd0ac5b007ad73dc64fc096c2ad7c12

SHA1
2e81931337b2e69341a3f31946cb8b463d60d5c8

SHA256
57275605c03afcbaa07c202b492035c33d8d464990545e3f145ca58d73d9ba01

SHA512
6eb273c5d4e831b16dd00979151e4fafa17f896668ab6dbdd54aa5930ab9ef92f57fc7cb0b4bda34f40969bd8e7e1816fe511c429d281e54e3c17b43b7e4af1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d3339f3c7c06719b57f1fb5cd95ef414

SHA1
ec9d4328ef42a3ff1e667a021640f4d8cc7b36e3

SHA256
f1bc9ab87cbb0c609e6d15aff5267bd69c17065060230a7696832c461dafecea

SHA512
79c4b4f6256e588b3af9fa4808f9a298ccb78432debc24b8ecbbd43176aba93b71454ec8c57cca32c34e907ff399dce667240588c1ddbd2a6c319f4c7b1a68f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

Filesize
70KB

MD5
638b28824ff7d2a8b5eca31267ffaf3d

SHA1
51c91fb5de5248d6dbbe194565231c4bbbc197fb

SHA256
a2477313b8f9735a83fff20ff6624d26a13c893601a3cf6148bc997022913011

SHA512
0eb506d4d9f7bf3aef60dc2d69135a1eb6c9748eca15f721cf5310a7bfe131e21c3504dd75ad986ddfcde907cedd8522caa64845de1794000c2fe7a477189af5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
366KB

MD5
e6940bda64389c1fa2ae8e1727abe131

SHA1
1568647e5acd7835321d847024df3ffdf629e547

SHA256
eef5dd06cf622fb43ea42872bc616d956de98a3335861af84d35dbaf2ab32699

SHA512
91c07e84e5188336464ae9939bfc974d26b0c55d19542527bdcd3e9cac56d8c07655dc921acaa487ed993977a22a0f128dc3c6111273273ff1f637b20bb56fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0

Filesize
25KB

MD5
21ace0d31858ac97b17b2e0959f3d7a3

SHA1
87702e17160c0fc6221e117e6e46a43acb254efc

SHA256
c294235f4ac229e5bcbdfe700726499131bbaf8d41a54290e9c49ecb5700c018

SHA512
e8374e9a80448653acfec041deb4b0102703afee22b811d7e111f3ba931701132fbdc5e36e3de4348be4f27600f9ee8bdab183d95b5279ce55f5392cc57f678c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
7KB

MD5
133f8b5d7e298983026885bbfcc88703

SHA1
7e8c2bcb584d8af1098e930b7be366e7cfadb9df

SHA256
764ae4f0b53fb8ad726c41cd65649bfdba1d5d43e8c68e916f481c1646fa6588

SHA512
f9cc7fab38c9eba7380ba957e3dafe8c830fe4a68ae604ee7ca15bbe5084ce6bb6f1b77f143201433539c31431c55cc8a1d0d29e000041e4230718b1d869ff0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
97204a8326b5ad581818126b5a5f55d2

SHA1
1a0f29fce2e3110a446d1d000ddb79b51ae463a5

SHA256
27284599f3ea294f9fd96a424d938491bb03675823eae62fa12296b62072ea18

SHA512
2ff7fe9b0f43184b4e0a46a3b033f98e14192aa2196ee0618bc7b3b5d2daaefe26ead28e1a47b93518e0a618d4f01c28a9b0830a08837354d6cb21f82fe8a201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
236351dcb2a6aad27d1e508e6b2b9bbc

SHA1
8351d1c99e4e049c2571fb278db364ed68a2309c

SHA256
858ce60b20c2ce76b2fd52cf9784a88cced771b1ac81a630e1db004739ec5770

SHA512
7464a88ec0bf0cbaa1c975f090c4c78eeb9da2e1c0c9e9aa41642138c93fa08afa12334939cbacff44b6d9e14228d9b495cfa0f9cc0abd93bf0b8ca1ae2d248a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585261.TMP

Filesize
3KB

MD5
f4d04b6cb21ab6fc316417a8d4c5792b

SHA1
364dd31d2819e9fe4410e956b78640e35c882090

SHA256
9d236ec0803bc9762a7df5d7337aa8f9620b2a40bb119619d7cd4c89268a7ff8

SHA512
64020700d15db746e2217390d92552a5669adb50b4ef5d44ebc43966ae1cde9306e05fc574025032bf8b1c3ee10fd054cdcbc5e40c370562011781a680b4e5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
d0b00f1ad1270422da9f378f68241d90

SHA1
ac235b7501f63affeefb9d89b19d83a930962217

SHA256
9eca41854ad6b58c158341f6c2be960ab91c834c29c0131859d9a4db3ea93dbc

SHA512
094b17dd88ac345bdd31dc68105e53af80211e245c532652f9a58c6e4065097b0fba01341ddc12b517fb7167aff90f618179bf1afe95782a3d83e6a6ff6aac99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
f248d6049a1b2ffe6c9d99ce3d234503

SHA1
7501bb1c2ab66a1b29d67790d3ebcc7e7f60592c

SHA256
0fae5fd2ac9e7f7e7079401d6e4ec8356c02dd26e08124a25c3252150a299103

SHA512
453e9ba423a62de9de6510f8a821d6cef2ef44358f951725609e16b7f8751c04e43308bc46bd29328eaf799a15512e324d44e1a149664d8d04e771be38a68069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
d32373bb79ef43c6fef1a4197b9b8c73

SHA1
fe79e66d23d0a574a09a5b7b6de77c88db23a56f

SHA256
6bad9905fa1e644d3e12856be22402ea9ba5fcc45e797ad68619269abcb3b606

SHA512
dfe6906be02c33fa086f903f475518ac5de6b53689b1d974f37711ea25d3122c6e636dd38c614b931d3c67405aea3566a442bb698ecf2ce7a3212bd224aac51c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
c4412f6f0b931ee092d952fce1439fae

SHA1
3e16d3e5f225e9a15c721a8996c6c5da4b99d199

SHA256
d08c21e63ddceba78c7a78f9a26e6e4b53e4bc837200bd889f59049ed02ad3c3

SHA512
7a060be1aa5073fd886ef502de7fd1479bc3dd37758cf78baa2ae4c6043613bcba7238a9a8fb7ad4940791ee795ff23ec5dc41e69ddb8b94fb812e74da9dcbef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
209B

MD5
c2175ed450e18ceebe978c0bf2a61e04

SHA1
d43d1296e888d709bf5544f2122947523aa6972f

SHA256
b7bcc9b43e45b2f02f7942a6e343a710fb4c4f4945535652a2c6f00a68ee80df

SHA512
5dafb5fb6dacfd3a1190b6b57340751c4b24bfac81e8f5c79937817ca7123a7f3ce70123205adf77c1d4d7ad25035133da50d5092e20ab6a27b3bd1c595eb5b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
210B

MD5
1b41c63279e3c53fb666a140a0ef4def

SHA1
220b3d20f056b37f677d8df21949b110f6f90ffa

SHA256
5ffaf86c2e84b776b808dddfcef7d8fd7b64dd8443e85c8c5dbd806016f7953d

SHA512
d51782994390eacd2667364e913e2678cde216150383453881da351123c37623c646d674fe26a21e5e3d5a360a3563f87e856dd8152730ab87ede923522ebe16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
210B

MD5
01c9d701790846e4a98ce1bab136508f

SHA1
8b1948326d85c3226788b060f54531aede6d59dc

SHA256
8e1f1253fbfb891c4999f0eed7401f8b22f9688a3ff4cbb4840429f03f8c50b9

SHA512
76d48a2559d96ed94d305abdb5f1b077322b415a3414d5a957fd20d37258d2ed5b6df890aed6d92548e30bcf2811042775a8b4444d0aaec264f4fc0edcf9ba19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe57dc56.TMP

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
120b219fadbb7473e62f5cc45974cf1b

SHA1
93664a52c11ead72f4ecbf33de1601d753402d22

SHA256
551d18925710c6950060b47932b1d15704ee1897332fa2d0ac072c43db09eeda

SHA512
456672d9e1ee976cd92b8d07860c81ff582e945f8aff8e562320f934f17db422074f17c933cb703d2fd9e7d8c4b9b84243075881a3d009c236255f6bce5f8639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a49fe4751ba1583ddafcc3f47c7d7126

SHA1
e2585af81d044722112b1c6d635476d887fff2cb

SHA256
25cb191a73c975a33a0e3a17570511f8ede6d51828265fb3a49e42ba1928151a

SHA512
aee9cfb5be70fdb94f713ea49fb093d691e18e1ee1ca34fe0ba30f04e28e7349f01697d8e49d95dd365c02e1fdf1233a2b5c9feb9fb2e0524dee33c085fd4ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1a4dee26bb605947f3f3a1c8cc073fe5

SHA1
3cb1da481e535216590122e7b7c5feceaf4047fd

SHA256
c662614888cab70f042051c04a582f00941aa58526c0952f29010a3a214773ae

SHA512
4db9e43035a81876123c2beca4dc976c249c8c8f3ed1f2b20d0469bac7b32791f67648905bcd7a35e152f8b7ddf9467ed43b8d8e016eaa7eb5d36a430b198ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
2346b36c8d1937c299f8c4a6e0541d66

SHA1
b9ac92de5c7c6378da0fc2e963a639669d21dd77

SHA256
f1e09f90b5497bf7dd1e21f346fffe79126ce243d797d53361232d77f6f21012

SHA512
bf9275440e7a6a544c515e3fe1b619cde6fda506e4e5bad64ac6f3166de5aa15c6bf85614ef8646edc88494cc6bcd1e436c3cc9a21f97585c2e689c7a5f58b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
ee90a8a2c03e4ccc628dd5556c88bc0e

SHA1
ef3bcb35244d5784b791ab46fef3fe9734c6ddb2

SHA256
477b42d46d13c16c365f172f709a6f3031c55dcd27f1b1ac6307d714bd8999f0

SHA512
ee99688267e6c15138a96946b077eaa1a0b2dd3d0771aa87bc5e2a093a9e4f9a3ee3d9e5d9c79e98c88454d43e7cb8b9c2a259437608e9864049157e1e80dcc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
d6e2b29df2f15d5c5d0b41646b673f54

SHA1
3309281a017edc0570d66345b8db9ccde259eb0b

SHA256
e5c4716816fe7aa7489b493baa2a23fcad90feb4976b3742987eca0be90cc37f

SHA512
283fcad1f734e926a8a230da27c539137483738cc975cb70afe494db190cd4d6b905ee56c92af2ce7bce4de5e76e71aa57a1b8e12eb40ae2a936d166000f37b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
1d22f3e5c1c1a3d7dfb66e90131b944b

SHA1
50cc44a9fa58da30960d242deb4ca74532a3a583

SHA256
d7994d53682a215e02edba5862cfeb50c9bf7fa957cd1faabc47f72d820a03f8

SHA512
d93886a23f36e0fc1b7b4e879c14c2913ed0e65bbcfc7b5ea8ab3505631d19a9a60bef995b6398bb68497c0c148c114b34e19bf411f1e955af00d11db2401ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
65b688c764947d499380854d6decd308

SHA1
e254c0e68942a2fc8bd1944cae7d28f1cb94bf04

SHA256
fe9584c68b56d3f85d94007420b54d78119fce09837768eb9540b4fbccd685f5

SHA512
0bbbb09faab9da8bdb68119134ccef399d255cdc1fe54ed7764f084c28679c043e36315ea340b0c55eac8a85221a3624a7b56571b3d770ecf3fab9496ab6b7d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
fa7275531187b6da38ab05a1ffb8b554

SHA1
97fa1669173d5323656d13186b0f4853dba725f1

SHA256
00fd8d5f05d6b8f5436b56ec4aa2bd2b481cef63c98365fcc74b0a770ad2f939

SHA512
8a3bd043def40bf5c6d0bd76ecf8c3090dce33478ec55b5a14e6819a30c1f9e034784f2d66aeaf2841d3172941fa973e64f7f0e3438a4f0cc17ef044c79a4b44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
e03299462e6e0edaaca60d8e6f772ab0

SHA1
458bdb81bfa2ac910e1ed5155e6c914a7f2c3021

SHA256
28a9331ecaf2d15e1a6f00afb9cd14b9df4d83f4bcb750d7076b02f844990abc

SHA512
6229bd33b99d30bc3830db11d5e5dde2233f47fa45de9a4392fa46393b9aa3566d0ef694988818440597776bfb37fc74a9a34cdfcabdf4db36cb0867915b5412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
d3a2ad5f355b24028c28fae703a8c7c7

SHA1
bdfd8db0ddcb24a8c011aa047c06750da28be8a4

SHA256
8b779ee7001c3f50a3e00d7653a20c83299e641d37ad8ed68a41e314bf9a43a7

SHA512
18ea8c1dcf5a434b13cea358cfdf9114b1b9abde6ad285311886bba6b2a92bc11b87ac409c149fa781c41bc0d246b4929a899f855bfa8d21f04a4add66a6bf7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
8a76cce2d624cf66cde61e019cc4a50e

SHA1
7522ab5a24dd2b11e0a9c80732f9c599d2db2490

SHA256
0cbf3a48b76ae8e1554927cf00c4689a01e27efe43fb7d15f9957eada199e47e

SHA512
24ccd4438379a974f1e1e7b809739c3bd1ff74804fff54750476bcc17d5bc644f08c15583f75b922ac784068a6e09b3cbb5a13d3c140f6e1a55e3e23da7e870a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb53726-e710-4e6c-9e52-7c204cbc09a7\index-dir\the-real-index

Filesize
1KB

MD5
47cb1040f307d6bcd3ea7d01d7723925

SHA1
634444f64e31bc448e39d4d48ef5be60be7d4684

SHA256
b1e159a4873d580f03f89128dbc4c7bd7bc650ff58e8a3d7cf01835e43cae053

SHA512
a531101bd80f5350e08b5d05aaec8b7d90a352a53695932dcea96b717b0c7bd592316419dd448e17fa87bc3308f06facd451147133ff06f1eef39c7426fb9773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb53726-e710-4e6c-9e52-7c204cbc09a7\index-dir\the-real-index~RFe5bf51a.TMP

Filesize
1KB

MD5
9082081883a71f7976022bd837ae1bf4

SHA1
c7382ecd1be6e81aebe19ea67cf5be42e53087a2

SHA256
0b52b40010c242e976d3439df6d7fdca1d5e690496110229bc5d5b6752133e7c

SHA512
7bd449042ded56b63b2d02a973278da3bbffd0eb6d2bc614274db13db2a1d6974065615776c5f9f315602a36ba09b3053b32d34c75cd3a180c1234e234b9437e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
5c393100eede5cf9b6ed7c2195856e80

SHA1
b42d780dbe95985c638cecc2bd1e5f790932c533

SHA256
1e0d5bd5692e951b63aab8c2579b2b22c582d815873ea6860c00398946751488

SHA512
f350ba03ff289b76ed1d1446253a1977f9e60e28c817a1cf0ade4828e98629c0422d671e7e9f5c86fae3aeaa0e88558b025d4badcb88cb3c899cdf26e5b59218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
130bf393cdd81444d23e62a529453cb1

SHA1
21959cb7a65b624484045f0b0a0af46c50b26132

SHA256
2237f7bcda3bba6f6e28cad0449ab654223526dc01fe4b2f4535a5cdbcc3ae20

SHA512
490ed216d7cb8bbb16a95aea8c8fe47baba08d6bf26e16fd5f8eb09b742ebfba1910855bd6503e52cca360b12a2c400512d7592b103fec2474454f88dbbf5f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
880B

MD5
8f0011f75d9f7334a4ed6a12c19d1fd9

SHA1
88eb586f7e556035e73b4a00bb9ceadbce1dffda

SHA256
fb992bd08234376511f36050bc0b3b3608fa8ccce8ecf8f5c700bed6d13d758f

SHA512
304d6ffe2cd9859a931b0ee4a33bf8b34dfa99a684d823b9c3f99a8ea283106135f90776075186dd36d200e632330ef97300f724c2107250d232eea0dd050cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe584774.TMP

Filesize
469B

MD5
1e39524dda3ede8401dbdbd1630b2f15

SHA1
24143d8d2c8db2be90e59ed7cb90d5af3823ce38

SHA256
abd2fef4fb4ecfd811c3070c9d8c0bd0f4cbb03b09f76b215fa1a10d71575599

SHA512
a17d30e3f91c053beab1a9b25a25199d06a8abe6046ef1999354b43c66bf53576406c7a1f24ec91ceb3ccc401cee60488271d915436c528d4af39b9e526ad544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
18KB

MD5
6d7ec28c13ed025eeb4c06d0e51f0c9b

SHA1
45c63645317c1aea88a57d8366d2077d9a18ff02

SHA256
5d0293b5e19d2a693b252e82f0544b18d0d150756410bcee568484790eb719a4

SHA512
fc0549603e6dac553f57ec4b7fe384b745b633e0e7c667bf9ec489a771d893c21ca2d9c1a1792deff4ebfb6783ec903ea4bbc0f2593e248de95412b3214a4f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
366ec52d8322efbd5e5a3cb78f1c3e62

SHA1
4cf17ab5ce1534c609c62b06ea07b9b84cc650f4

SHA256
5858842115942d88315b365a4990faf71f7a7af779a8ad0092cb61e1bdd2d98c

SHA512
63a16d0138b51c79fb532c9658e2591e90d57a51d947e49dabf75f71eb0dce5b7aa6dd2170431dba2b23279703c3c89dd0e38ac61268de50aad6442305f2f5c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e4d653323bb348b51febecc98e2eeb3e

SHA1
44617bf355d4d8727b3dc0eeb4c7b817299c848b

SHA256
5dfbfb46721f52052b9e1fcb40d2ea30cac7955c1e15efe8506c3d8d2647108f

SHA512
074181335ad3e019171b1cecd44576c8db762d59beefb68211e693bfe65e9950cedd40ba05f06cb4821f06f771fb2aed058c94635b64ea5d5d6af8ea74cb6295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
756231a94491412df7911caaf5d57767

SHA1
4717647bad6463ead0c1596763994b2e976e77de

SHA256
586ecf1d1334f1d9141c414bf2c2898fd2d96b6eeb939c3fd6f015877e58c109

SHA512
c610e675c408adb45c3ad4d288e215035c4dcd4cb7b692d4ec3b55df66264972acb99431a3a5900c73a4dd9fefe68b067e814666b697a6597348e740e2733bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
8680a1aa2f0d207f0396161b382c2b49

SHA1
213e703924918078e99f2e5a19e9fe434f640dbc

SHA256
ad37a4d0ba7bbd0350e37f3d6dde43aaaa279ef812b1bec1e1ad44aefe11e61f

SHA512
c3c21b27b93310e4848d80c9368b411086f1603bf1c6b92f1cfb82b6e357db40811551e3a3ef9f07d411a1341f1f427b608f84b98d69d1c63caa6a4653353d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
a47c54373195171db6a6897cba16a69e

SHA1
2b5150082fcafc2f8463e7777c86e2edcfc7eb9c

SHA256
d7f9b8603e5c54a76024fb1bb1cf9913f7fdc1f1d10334a9c73ec1c84d47840d

SHA512
b002f4d389e773a988427ffc5f020060f6f97979b6144ac8a9a68ea2921bdc79200f0cf3216229086394e6d210e5b6bb9c671743375da2ea32f3f2511ec68411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
61af8c5e7e1e97751eb84a42895255f1

SHA1
a3500b94abab2e75d84909c095e52df50fca363e

SHA256
e74f8f6bea6c20ed60663c15e5b9a52042649dc7218f71e0056e61ec39e7d5df

SHA512
87b2023009fdef820d736ba65dc9b6c11d6e6fa2c187aba513478e0591d0a9d43ad209325b99bff64a6a463d2d903c61ed25537eb0e48d1de727254c4081aaaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
98eda8cae97a98de1810914d85bac2e7

SHA1
19fa7d13708e13adbe83c63e31807f26a3520a03

SHA256
ede41ab292b50bd6ad4a12931462a8ee37187966fac81f9c59eed6eeaec90fed

SHA512
fc91eecf5092e0d51eb1bf406863dc055c5d1ff729fd40b69f97840190b8ee0419c93c2328ef709a333f11dce0a980877bbf066bb83873e57216cd1cd859f3f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
bd4841981280199d56d4c376878be3a0

SHA1
8b35aebcd45a9dbf6f21b03bd00615a95b0dd5a0

SHA256
d476b12e9f152bce31592076bdfad79b5ebb88b3946d7cacc366f22e124c2b54

SHA512
e6e9c47eb11cf258191025266f28cb633c5e3804f5de5d026b7ee83ec637c5fb738a4dfcf2b126394c4daceba2f08328b813a23bbb15f1e00ae3cd7cb32a7118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
b07d64d5c781dc041e771a1a1628de3e

SHA1
1ba62d8f6ff0d81f8374d00daaf6387b8239148a

SHA256
5ce021f987ef526b9d1f1fa89d9a426a064e3269e9892887405261bba2bc4ebc

SHA512
ea45333aea0c61e25ff6d1b39881183c529d7e4ead28c8f104c6b87204acb89acaea73fb7066342e36a0e1e22db093ab19e9d25780aed60863f042ba8161deda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
11f9d699a6b90087a185f780823add92

SHA1
ee5cb10ab2feef7326cab57b3e4e2ec7da2335e7

SHA256
256254360d5f9661b5bcf1a7cf0c72ca998af64b43059940a9df51874647af9a

SHA512
c321bce1559029aae5f2253548f1a76f6bfdb91a656996b85193b653fe8c4d785eabcaf9b5617e1ff68091e1aa01890d02a609b312f5626ba06269219567371d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe587318.TMP

Filesize
392B

MD5
21039dcbb3a0bd9aad949c433e642f05

SHA1
d3f5aee38f19855ebeddde26df82d05c8d2d4fd4

SHA256
590da75aeebf51073e7ed8a837a381e4363c3a3ffe570db0fbbac6759d56c230

SHA512
c3aa5c70b24e25d47c570c5694121f92efbe493da73a21a81f7082e10ce2fc164adb097da76cf98795c656d24c9bac9f08f4af1c9012921dcc165288e0a02ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml

Filesize
326B

MD5
dc2ae5fa0bf0c7200e0cc116f2c2082f

SHA1
1a1c061c1709f19829d8fb02513005799875036f

SHA256
c921fe0a747fe1a1480c588985b04b5b478da265ab5625a18f30b47f5c94d88d

SHA512
fd96b43e94ecb20833d81b433fd31d0a1776ac29fbd095fb47e673274c3375dde3227c0801c0917dec16a58a2a36d902a13f3a5b25a4082556b1c96c6fec3c83

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4KB3B3WG\www.bing[1].xml

Filesize
15KB

MD5
0c16be0c4789c93a1bbf4a61b174a809

SHA1
b8742172c146a924ba5a2e0c8acb531337e2c648

SHA256
528ed6a096c0275150faf948e1abca21e0810f61ccbd6fca12f5943bd34b1ad5

SHA512
82035e7786cb35d244922803868de8ebd6052212c443e7c889c4bdd3f0cfdc1d75eb1fe5467869c05fc1c535a74cd1bebca9b20d9c1a30bcac57ec8a8e39d504

Download Submit
C:\Users\Admin\AppData\Local\Temp\3546abbe-8bc4-4d06-b1e6-dc78a76a19a0.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\3728daed-7f07-426d-87d5-b536cb5e3f33.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3124_1698359039\410c63dc-c15b-401e-86e5-c87e7df0db58.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\hive.exe.crdownload

Filesize
410KB

MD5
a3c7125821458e4cebf7cad226de2325

SHA1
0a2e14918761e8c013e7c46ee1cbacd156157baa

SHA256
4b62c93fbf0b964c4de93a0ce456bccdaee2908b3c0135b3f62912068a728d3e

SHA512
e71714c802350a72fbbf87a3900f3171918d57db78631b28d082b3eea1cffe41d76abf6c914a808284df06e3a912cd938d855449b647dd9118d2afdc4477f066

Download Submit
C:\Users\Admin\Downloads\hive.exe:Zone.Identifier

Filesize
183B

MD5
9aa3ebee3761d19ecac5f679a31d6ed9

SHA1
f198ff5213cdbe786d802903a046bc63d75f4b4c

SHA256
c5b53aed746b8ee923ea148855d01608dfe899a46f84b4d0a7dd0fe9a4215710

SHA512
45f81219b109b300019665c79cac45f22eef576908f7e3ff925318f1e4604da0d8c8306f57cee7f1961e0074334f9177600c0079b518c6cb779bdaa9f9feb1dc

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1755911365\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_1755911365\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_559581288\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_626739525\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_909080003\manifest.json

Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3124_948613464\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/2528-1905-0x0000000000F70000-0x0000000000FDD000-memory.dmp

Filesize
436KB

Download
memory/3596-1547-0x0000000000F70000-0x0000000000FDD000-memory.dmp

Filesize
436KB

Download
memory/3880-1949-0x000002174FBC0000-0x000002174FCC0000-memory.dmp

Filesize
1024KB

Download
memory/3880-2024-0x0000021F728D0000-0x0000021F728F0000-memory.dmp

Filesize
128KB

Download
memory/3880-2025-0x0000021F73E80000-0x0000021F73F80000-memory.dmp

Filesize
1024KB

Download
memory/3880-2026-0x0000021F72DB0000-0x0000021F72DD0000-memory.dmp

Filesize
128KB

Download
memory/3880-2124-0x0000021F782B0000-0x0000021F783B0000-memory.dmp

Filesize
1024KB

Download
memory/4780-1907-0x0000000000F70000-0x0000000000FDD000-memory.dmp

Filesize
436KB

Download
memory/4904-1476-0x0000000000F70000-0x0000000000FDD000-memory.dmp

Filesize
436KB

Download