discordrat | hxxps://www[.]mediafire[.]com/file/vd096ertuoudvph/SETUP[.]zip/file

Analysis

max time kernel
295s
max time network
295s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/vd096ertuoudvph/SETUP.zip/file

Score

10^/10

discordrat defense_evasion discovery persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM1NTE3NjE3MDYxMzYzNzI3Mg.GfLOZG.Mix4fwAYEff7M5-ZFTjYnQ0AN56JgFEJUbug7M
server_id
1355176088489169088

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 6080 created 636	6080	insatller.exe	5

Executes dropped EXE 1 IoCs

pid	Process
6080	insatller.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
100	raw.githubusercontent.com
483	discord.com
536	raw.githubusercontent.com
538	discord.com
385	discord.com
477	discord.com
482	raw.githubusercontent.com
504	discord.com
520	discord.com
532	discord.com
480	discord.com
531	raw.githubusercontent.com
533	discord.com
537	discord.com
473	discord.com
479	discord.com
540	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\$77insatller.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6080 set thread context of 5176	6080	insatller.exe	129

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_284442894\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\extraction.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_402220070\fb6dd03b-99d7-4cc8-a878-91c8e655c2d3	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1303193646\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_552173291\BIT725A.tmp	svchost.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_1096570127\BIT8543.tmp	svchost.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_1096570127\2a0d597c-a09c-4400-be86-87596dd2e696	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_22478440\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_839358442\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_22478440\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_22478440\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_839358442\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_2080484881\cd4e6fbf-c0e9-4dc2-9e3d-7f538bc7435a	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_284442894\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_2006694228\2e8a592b-0ad4-414c-b996-21bd8749e2fd	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_372956536\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_552173291\4643befd-79b8-4e0c-a2fb-c0e3ee78dcd5	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1697298036\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1697298036\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_1063484841\BITF3CF.tmp	svchost.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_1063484841\4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1303193646\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_372956536\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_839358442\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_839358442\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_2006694228\BITDD62.tmp	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_1506516930\bf8090eb-6e5c-4c51-9250-5bf9b46cf160	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1697298036\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_2080484881\BIT2BC5.tmp	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\travel-facilitated-booking-kayak.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_402220070\BIT6FEB.tmp	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_372956536\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_22478440\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_284442894\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_284442894\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp\edge_BITS_2404_1506516930\BITD2.tmp	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_839358442\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_284442894\keys.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1743171238"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 28 Mar 2025 14:13:59 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={CADD3177-A7A9-4055-BD65-835DEC780593}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876447459305580"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-994669834-3080981395-1291080877-1000\{2AA16F22-5D76-4368-B15C-EE0B72D05029}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SETUP.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3784	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6080	insatller.exe
6080	insatller.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
6080	insatller.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
6080	insatller.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
6080	insatller.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
6080	insatller.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
6080	insatller.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe
5176	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5640	setup.exe
3304	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	6080	insatller.exe
Token: SeDebugPrivilege	6080	insatller.exe
Token: SeDebugPrivilege	5176	dllhost.exe
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeAuditPrivilege	2224	svchost.exe
Token: SeDebugPrivilege	6080	insatller.exe
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	560	dwm.exe
Token: SeCreatePagefilePrivilege	560	dwm.exe
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3304	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3392	2404	msedge.exe	78
PID 2404 wrote to memory of 3392	2404	msedge.exe	78
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 1560	2404	msedge.exe	80
PID 2404 wrote to memory of 1560	2404	msedge.exe	80
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 3108	2404	msedge.exe	79
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81
PID 2404 wrote to memory of 1240	2404	msedge.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{fa2ba517-09aa-49da-b705-37a5c02837bb}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5176

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1444
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2080

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2436

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2612

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/vd096ertuoudvph/SETUP.zip/file
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x26c,0x7ff964ddf208,0x7ff964ddf214,0x7ff964ddf220
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1864,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2268,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4056,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4088,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:9
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4232,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4228,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4132,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3668,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5228,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6328,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5200,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6508,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6232,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4532,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7096,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7152,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7752,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:14
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7856,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=8224,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=8240 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=8380,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:1
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7876,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:14
    3⤵
    - NTFS ADS
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8736,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7428,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:14
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7896,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:14
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7292,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:14
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7376,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=9112 /prefetch:14
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7032,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6580,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8420,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7380,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=7336,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=8976 /prefetch:1
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6480,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4372,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6464,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8000,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:14
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7984,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:14
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2756,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:14
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=764,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:10
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5268,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6284,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6296,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:14
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3552,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,13595869322156401531,3077643146565331067,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:712
- C:\Users\Admin\AppData\Local\Temp\Temp1_SETUP.zip\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_SETUP.zip\setup.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5640
- C:\Users\Admin\Desktop\insatller.exe
  "C:\Users\Admin\Desktop\insatller.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77insatller.exe" /tr "'C:\Users\Admin\Desktop\insatller.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3784
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3476

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2460

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3580

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1708

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:5664

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Drops file in Windows directory
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
02cf1313b32a8ab2f031cee39bee8fc3

SHA1
861cc0ab9ff881460dd6433e37075b822aac9355

SHA256
7e7fd13903a8d57f314d9e7dab6fa28975050b63f045eb315e96cccaa17d1e61

SHA512
f5464c94391bfb590f6755c2ae6896dd459a2a93d778601caebf272438c2ff127ec5de81dcf8efeec65a56609558477afc7be1c4993977a18fde7b915f7a8700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
80446c379e3f0ef4e36cc5085a7297c1

SHA1
97daa0dc77be12d07410e9c4068a551ca9116cb8

SHA256
0922a3da574ad88e82fcc3e838b9ded7099ffebffc129d1f71fa424267c39289

SHA512
96ce87427271f01f7192061cd0c3401a5dd2d693aa1d0ef45420b51e24b4ab599a0031342965780f7d18ba53f017c84d00b4c04135d14e799cdaedd8ebe9e65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8165d331a65e980c7f75dba657342854

SHA1
44967c0388744de38b07e07e3a9cb174854eb7bf

SHA256
08d7b1fa1c3cdacb73cb9b34bb51a0516bfeac2f10ec54f2f27469d1c97820a9

SHA512
ee23180ed03c5042d6e6343ac2181a6d9ffbbb775e1031222e46b4a61eca4f1caf2dab50269271a07b284e270195595c91ce8c43d4cef77c8873845216546e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
145fcaacff5f85170f68934762fe7ecc

SHA1
39075c38d0dc01c02e813036f3bab1edbcf35e13

SHA256
ce41f2141dded335d24a118a2f63542b20bf040d626b7c047a2a87ada3df1219

SHA512
7031dce84133f3328f948970e1cd24a570b5d5ee471afd227291d99ab0794cc8f09550175ce038c090a74093f32494e1835e7de9860fedf1f19dbd595e6e108a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
d6b97e9d66a3b4a7a0f681c04a96d2f2

SHA1
a5624e2bd4a4ab4b603be5c9b21ebd5dec343b9e

SHA256
e7cf23f45459cc12bc49da0995a5ef9c13624a3ec4776a103c905de4296a86b3

SHA512
dea244245fb4c7074fcb7c55d0781345a4b875d0c5bf6f0f62abfab730251675d1bfc93146fe1d54f2e6d9685a5af0a6dd0c1ea254b6484d2865ed3fe4f4adee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
5cc188067a11923847d391429097fbce

SHA1
c2f1ec541202bd3c7619fe0089cd39131c32bd5e

SHA256
dd5f8dd9fce0cfc7863d88246bf97f4bc2d9bc796f564cb36ff1387415d3eab0

SHA512
e4a82b4f81f5b285a50c61e72ee544cf62f7178f0d22101fdc46a9c3580cc2bfd6075a798bbdcbd5ac3ee592cf0c6c44bed442a2c0ba7a4223fcac030528defb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fc90.TMP

Filesize
3KB

MD5
ff6a86d943df87d49ae134159a168275

SHA1
e93f24e9f7b19b4c206de2857df9485fd13d1273

SHA256
6145183040a1ff90f7e4477fc5f0d758394117fbbe849b54c32691dc8a3c3f5b

SHA512
5abdcc2191cd128dab5ff48d96113c8fe1efd4e0959f93a649aa28cef85ac0244dab85eb3754ad18ca51056aa3aec3ad5cd2333340f51fb870be2e1a1f59626f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2404_661319723\CRX_INSTALL\_metadata\verified_contents.json

Filesize
1KB

MD5
738e757b92939b24cdbbd0efc2601315

SHA1
77058cbafa625aafbea867052136c11ad3332143

SHA256
d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947

SHA512
dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2404_661319723\CRX_INSTALL\manifest.json

Filesize
962B

MD5
e805e9e69fd6ecdca65136957b1fb3be

SHA1
2356f60884130c86a45d4b232a26062c7830e622

SHA256
5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a

SHA512
049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
81892f4f7e2e9d73224c7fd045960461

SHA1
f0cef0e44688a7587b7390251699c4acd439895d

SHA256
1215e0a29ba43d58bfc290097958390eede339e2dc7d90f347bcff59df215ca8

SHA512
4ec72665965fd3bacbb5fb9c5b6c0df81716384551e8c07773edee443c7d72bbb7ec16af9162ba0a4dba6f0cbdbd2da82c4a07d6b8de62b6c50d21abf377c69f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
20KB

MD5
fba1095d2a363b9f8c661b8885d49fe8

SHA1
3a2aa5a890ec9d2dd8c212fecab9944dd181f16e

SHA256
b29d4bc2d60d4eb541acf284ec68763fabe6646e4204092e3051881afd294a55

SHA512
93bf8ec238e53a12427c8169da2234f2a7d72f6b7c4f07f0745b69a92f8fe93513be93c2f3d012a748fd22249400a95ae35c13f9cf75fc0973204401b890cb03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
ef06c6751922cb410c0fe0059ece4679

SHA1
79fd77efa5993b99359a912d668d5384f45aa2ee

SHA256
9c474247ff2bf77f2a3d2f6aa7ee3c60c5b44c8ea983aa5e8040ab7f4882f9a9

SHA512
ac3be1b1ab23820d5fd156206465ff28dd2528232c7b412ba8bb244d1ed06b4b3c2bea9284468be0fc776a97330e6784f9a4700678efe4c66775e0995b385d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
e2de5b22793cf0f4851a9b746d9bf713

SHA1
ce2307c1635e917c113bb25398b532400d7be0ac

SHA256
c7979cdacb49853443d28faa0d7882b4f6e90172d157969b6f36f62f29ce7d3a

SHA512
ff584cc8afb083781706821be1d35a726240f9df349cf49fc6790362669acf4a3563bf1529a073cf532b5e300737b9ca447afbe1bf0f402dec8c3d593c447fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
ae34ef34d58bc3170f4c894c982750b4

SHA1
f7606c1e9ec61a5fcee45bc1b43b6b7466d0faa5

SHA256
3ae119c0ebe8766a3e5f9fcdb8165eecee5582a9e5acc50cb178cedc69122954

SHA512
f3fa179cbd94bf65c902fd4141628bf942eb22b4a88b8bc2e20410d5354c4bfdcf68e7dd4f23b98785bfb4ccaa373a1557eb3d466ff68fc0f5133481c32f2ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
d0af9c6448b42706e9fefdf776f4a49c

SHA1
29dce7c74fcdda614821e7db5b7f81e19ba68e60

SHA256
4a66828339fd4d99bca0a7a01783ad2f77d91381cdda1994ee68150f0065a9b8

SHA512
0f3eceede3bcf2caeb88718973e95b0efff8b30128a163d976baca992f0da20e797451d2a1f058d51e3a083d58bcfe9b7ae69ab22d84405ffd54622ee02f2741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
67b7cb730e9124849ba0ac91756bcd5b

SHA1
e8d8be42cb07980e470682966b82d4f4d4801053

SHA256
33611086b8c9019e4b18551bac8bc7d89a2c82c0dd7175c98fcb290bf835d5fd

SHA512
aebf2feb54bc16ea778255323eaae4b69011bc112acd26449322818846155ceb1df42c06b46278ba54c1d63eec5b9173671186531e400fe609b1b4963448ea7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
3842973fd428eb0549f36b5082ea6bbe

SHA1
37d4a5e7a0edfcd8038c395482ab1696cfe77e67

SHA256
02af0e01c21b0a1dc27ac2e94bff53ac1de97130772af81fffa3e389c23c9342

SHA512
e94e26f2183e1d2231398f688c9e7416715584570c1c4916f7bfae0c172eff83427181fe226598db48b2b22cd2702b5a6a6003c6c0c8cf12e20cf376d09e03fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
880B

MD5
a0dbf6eb4ddaa3375fc519c2565e44ce

SHA1
b453e3029a00cd3bf84ac3b67ca387b98110cde8

SHA256
b56138b165ca001a119d284b26c7cc6af4385709c935e2b9d971d2d588534696

SHA512
72db6511b9f650f248c1625b4e08625881ad2b51f93128310fa91bf8debc1f77dfa82e9ee9fc60989baefb1576c7237d3cd07d6ae975131c59fd5151b47fdae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe585d0f.TMP

Filesize
469B

MD5
da60c10b89e5e43c8f9f8735ad104ceb

SHA1
fbc3971a357c6e2af0d1b5ef0479738a292aab78

SHA256
ea0073c3fc716a9cc9e4fe8e8109691f2329dbbb5b996c6d180e4ca6a4bf6581

SHA512
22a00d361e32ff3934bcf24bb0b05c7ff6937c17b35c80256560b7db6db05500e3a11c1cb26d8739d141fc313bfd30a0d77a24775dfdb4be49e5188dd343e8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
56a63f182b2938fbe3e59fbf9681dc08

SHA1
b76578ca24fb20b8bd5dafad4296e5a46735a5e1

SHA256
36edc2510fb072092e4c6b95efe4521857d9dcb7f0b45afdf5e8ef02e5d19593

SHA512
b17246b7c61e26fce1f211311b578d6b3d22c03a042137bb2bb5b23018ce5290a8fbf7a34b2f66fa30b2027296b8a570478f66a144385c320d63c1cef64434f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe585e09.TMP

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
80e2b52375c52aec9b6f5ee1e8e106be

SHA1
ea90dc7355346f730b88dab883f9c3b34ae2ca47

SHA256
14e73f52bdc9f7f2d890cdfd70245c3e00426f6e813c7a0a7333461fdfb6ab9b

SHA512
0ec48741d6afbc1be1ae66c6d6a4a6718a1de8c7fb460ab3c393f38e5ad0d8d9e3688a286bde2c06488c4febbdf15b2a728fd34a032c4b92ba474dd7ce6eb0d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
80c1672c037477d0765276f06e0fde7d

SHA1
d372d25d4e37f8073993eda8b28cc777cb0840ff

SHA256
ff6c9a7aafff341e7165e36f9cb38c95671ad966aaefbd3fd7a571c57a342b97

SHA512
9b9c32da62816c1839e2c02291aabbca80cc95eabffb2ebe1a5e23aae6765d2d1f6d7ddcb481b11be4ea7022f63c00ef6d00efd56d709e3441dffe30d2053b2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
e8e468533a8ea88f9bed1afbd75cd793

SHA1
08a4fa9cbfcb7a4d600bc87b9d04aabbf16c018f

SHA256
bee45f3d3a4d72324febe41a49144f51a7e72aabe81f691151c4192afdd14671

SHA512
081fdb3daeaefeaaa907092b5fa0f7c31436f15c088ff712d85b692f28c1bafd6c8a90c24be4e7d8b1952e79a668ac3af1f41d9e7eb991983de1136846109af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
7397bde29ff0e8f3c4fbf723f16f573c

SHA1
8d9102ff6e73987b56376ddab29af4bea6d4b01b

SHA256
769cd67a2ffa3130900ed551cf21b8259509927d4ff99e8802607c70b15ec1b3

SHA512
024586826ade544a3f34a5b1b54d962ad05d0f60e4701d320de96277f34d84153dde962c36de955e36d995787d14bc2b8cbb130bff4eab5b24e4a0e59a40b3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
ad52185a6449c8c8b9f08b448a125104

SHA1
74438f0d773373eea9a409ef39756a9e05a000e2

SHA256
ea9010d2ede79773dc33e1a750b5be2c1a6f2a4d6c0e3d406432f22d8672a558

SHA512
a1547ddfb8ef8cd1f4285300cb1ce2cf9d10c2c0201db7dcbae08589e0a5052f48f793d65e047ca45d055465056dab20dbe5d9fa463702c7159efd64ce80bc03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f4c87a0-1cf1-4e0f-83fa-c6b445b4f4bd.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\c460db4d-8613-42ca-93fa-c3707c3910ca.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2404_1464751555\CRX_INSTALL\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2404_2133563552\2386acee-ec90-4db3-bfbc-64dc675bb79b.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Desktop\insatller.exe

Filesize
78KB

MD5
0a168387794c114bb7df52e3fe7cb356

SHA1
51abc37a778ef2a17a6f319735cb6d030ba06659

SHA256
506c2077992b25ea91cc711f6147dbb17db6f7d039f9b7ee821a69c24bf38db1

SHA512
f81072a7d86bc05da77a7442df375e6decb5b6a6224dd7149d045297c52862d1ae4257274b1bea770085ab64f39fcca54c055f60cfb10a3b4272cfce00e73f29

Download Submit
C:\Users\Admin\Downloads\SETUP.zip

Filesize
131KB

MD5
bfccfec9609d65d0883efd9805485971

SHA1
45dac52add12021d016687e27e0e651dad5ea994

SHA256
1cc06c9db2a296297bb019a455caaa30b2ab5bafe211716df8a0b22d0f9c7f1f

SHA512
a39b345e980ebc3f8abf34000d67cac6023a256352abbc5e1fce67aad7377d965c6e28e95e5fa65a2c9b8b46a9c7fe2360383ed304c8b8026955c1f2102368ec

Download Submit
C:\Users\Admin\Downloads\SETUP.zip:Zone.Identifier

Filesize
312B

MD5
41e1d99669eb330e28e39971daf3aac4

SHA1
9c81d4126aaecf2cd5bbd233d085861371acbfa3

SHA256
7c19671d6a87b3a9d48554b0bf68ed12d51bc75a6dcf49988124c73cb1ba3f24

SHA512
89b5801105ca4b4177cb36571a350753fae9acc75b5baf86783db48a9fa9a0a63bad5a5446bd638644b41e14fa750df2874a9ee1217d8d4c40ac8de4c9eb7bf6

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1303193646\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1697298036\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_22478440\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_284442894\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_284442894\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_372956536\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_710263521\manifest.json

Filesize
135B

MD5
4055ba4ebd5546fb6306d6a3151a236a

SHA1
609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

SHA256
cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

SHA512
58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_839358442\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\edge_BITS_2404_1063484841\4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9

Filesize
2KB

MD5
9d86366b5c19a2b12e1f824933c40073

SHA1
8b456aa335ec40d4bc05c6d630d78d635450d4bd

SHA256
4a84f2bdd63dabe6abde22b9047a6942eeb7bdf93d8435cc4b188dbe72d9e30d

SHA512
7e463246c679b38f802b249427d1cadb6255fc05fbd1e01cf36a7a8a1d313522f43632501c773eb5f435fb1eab850960cb00dbb2552f70f90401c98ce47d5518

Download Submit
C:\Windows\SystemTemp\edge_BITS_2404_1096570127\2a0d597c-a09c-4400-be86-87596dd2e696

Filesize
6KB

MD5
635be48f979966a8f10efbdaefa09637

SHA1
dc0595977e0348c24a1e5d82db5eee90440cd0cc

SHA256
a3a37c49f6defb87760822d31c3f90d9d77d2e9c84d372a45e4e88878cc046da

SHA512
938f32cbaa0c00e72242795cbf5947385bc2c5225b67a6833844d9134a8bf0fc72b6ac8c7bf3734fa4f675702f3282c602b842d78d9a131976e611926ba4c2c1

Download Submit
C:\Windows\SystemTemp\edge_BITS_2404_1506516930\bf8090eb-6e5c-4c51-9250-5bf9b46cf160

Filesize
1KB

MD5
1e347bce035a3b1d37598a2384055e53

SHA1
b600b703c20ca9e93191494b97d87cf77182265d

SHA256
a99d66cfce8ca170740ce0403956f4dfaf4683829a89f4b7ad9c95303871e284

SHA512
d2d4dd7b434e0187c9ce46f5b3a43910a63b96bdb19b569d6ad570e5e67382a983d304df0827cd21b888c1522d9ecd1fc2cacf1acf45266f1c058bea031e7a80

Download Submit
C:\Windows\SystemTemp\edge_BITS_2404_2006694228\2e8a592b-0ad4-414c-b996-21bd8749e2fd

Filesize
7KB

MD5
f924d186e0ab6bff22bfcdce152ad371

SHA1
603c7dda4af9bb7a7c5bd224814dc325fe140999

SHA256
dd91c7c496e4d9e8df5beaa3d33d45f9ef196b4f888d0fac50eaf08cad6b29d7

SHA512
f4d34d14027edd9c106d30ba07c842fdd85d00ba1b546065334b8d46563dd9dbbe73275edc10ff7ac8bbe2ea4b91c58270a71f92742d9e676f08b016e175e43f

Download Submit
C:\Windows\SystemTemp\edge_BITS_2404_2080484881\cd4e6fbf-c0e9-4dc2-9e3d-7f538bc7435a

Filesize
7KB

MD5
c6b8f4941e6d3c264fd755630ad06584

SHA1
f622bbc4fcc0bfcabdf3965b9b80a89f927169f5

SHA256
da1220f5f273289fe6f557ea15fcf05b6b7eb90ee53a8124a608fa4b1308463e

SHA512
bf1ac0bdbfb4e6707c3d9d2148f1b329588e95a2f11164a92e4f71443d56b6b46f6b11f1fed7880c10ba03ecfba433ebbdc4bbf301407a95fe626f0d71ad14ce

Download Submit
C:\Windows\SystemTemp\edge_BITS_2404_402220070\fb6dd03b-99d7-4cc8-a878-91c8e655c2d3

Filesize
1KB

MD5
89fb6ce8c3a916d3d5a46bb06d99b190

SHA1
38a1828a642f128fcc644190dff9ba10a869db8f

SHA256
95fd9d48e4fc245a3f3a99a3a16ecd1355050ba3f4afc555f19a97c7f9b49677

SHA512
e5f2c9a4f07d5d683687da44711af5b102b478cb76d547b74672656a5283b9c8b4564ca8472255a803e22bf3bb00ff2b66b4bb0f2e8da1909d4082cb7ceeca9d

Download Submit
C:\Windows\SystemTemp\edge_BITS_2404_552173291\4643befd-79b8-4e0c-a2fb-c0e3ee78dcd5

Filesize
2KB

MD5
e0698dbe3caf467562d26f00893901e7

SHA1
7b9e6bf2af3edad3011162b6031afd47d4c2c151

SHA256
a00289af85d31d698a0f6753b6ce67dbab4bdff639bde5fc588a5d5d8a3885d5

SHA512
16da0e128b2f8245d9baeb5aca8cc7e8001784cca332241829c455f31710a874402d96b09ceb7b56a1ad56c5caae432d89f6de9c46c7fe02af648e67df871dce

Download Submit
memory/436-899-0x00000230B99D0000-0x00000230B99FA000-memory.dmp

Filesize
168KB

Download
memory/436-900-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/560-892-0x0000020144F90000-0x0000020144FBA000-memory.dmp

Filesize
168KB

Download
memory/560-893-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/636-882-0x000001A99F080000-0x000001A99F0A3000-memory.dmp

Filesize
140KB

Download
memory/636-884-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/636-883-0x000001A99F0B0000-0x000001A99F0DA000-memory.dmp

Filesize
168KB

Download
memory/688-889-0x000001EEBBFC0000-0x000001EEBBFEA000-memory.dmp

Filesize
168KB

Download
memory/688-890-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1008-896-0x0000024677BD0000-0x0000024677BFA000-memory.dmp

Filesize
168KB

Download
memory/1008-897-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1056-906-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1056-905-0x000001E4599D0000-0x000001E4599FA000-memory.dmp

Filesize
168KB

Download
memory/1096-909-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1096-908-0x000002400AF70000-0x000002400AF9A000-memory.dmp

Filesize
168KB

Download
memory/1104-912-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1104-911-0x000001EA09300000-0x000001EA0932A000-memory.dmp

Filesize
168KB

Download
memory/1116-920-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1116-919-0x00000231D9140000-0x00000231D916A000-memory.dmp

Filesize
168KB

Download
memory/1192-922-0x00000120D2170000-0x00000120D219A000-memory.dmp

Filesize
168KB

Download
memory/1192-923-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1216-926-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1216-925-0x0000023243CC0000-0x0000023243CEA000-memory.dmp

Filesize
168KB

Download
memory/1300-929-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1300-928-0x000002284EE90000-0x000002284EEBA000-memory.dmp

Filesize
168KB

Download
memory/1444-932-0x00007FF945230000-0x00007FF945240000-memory.dmp

Filesize
64KB

Download
memory/1444-931-0x000001A295A00000-0x000001A295A2A000-memory.dmp

Filesize
168KB

Download
memory/5176-880-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5176-878-0x00007FF9851A0000-0x00007FF9853A9000-memory.dmp

Filesize
2.0MB

Download
memory/5176-877-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5176-876-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5176-879-0x00007FF9839E0000-0x00007FF983A9D000-memory.dmp

Filesize
756KB

Download
memory/6080-875-0x00007FF9839E0000-0x00007FF983A9D000-memory.dmp

Filesize
756KB

Download
memory/6080-874-0x00007FF9851A0000-0x00007FF9853A9000-memory.dmp

Filesize
2.0MB

Download
memory/6080-873-0x000001B80EC70000-0x000001B80ECAE000-memory.dmp

Filesize
248KB

Download
memory/6080-844-0x000001B827FC0000-0x000001B8284E8000-memory.dmp

Filesize
5.2MB

Download
memory/6080-843-0x000001B8277C0000-0x000001B827982000-memory.dmp

Filesize
1.8MB

Download
memory/6080-842-0x000001B80CF90000-0x000001B80CFA8000-memory.dmp

Filesize
96KB

Download
memory/6080-1306-0x000001B80EC60000-0x000001B80EC6E000-memory.dmp

Filesize
56KB

Download
memory/6080-1299-0x000001B8284F0000-0x000001B8287BA000-memory.dmp

Filesize
2.8MB

Download