Analysis
-
max time kernel
412s -
max time network
414s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 20:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://getswift.gg/download
Resource
win11-20250313-en
General
-
Target
https://getswift.gg/download
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Swift.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Swift.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
pid Process 5948 powershell.exe 3492 powershell.exe 496 powershell.exe 4620 powershell.exe 5500 powershell.exe 5652 powershell.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 120 3544 Swift.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Swift.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Swift.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Swift.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Swift.exe -
Executes dropped EXE 2 IoCs
pid Process 1936 Swift.exe 3544 Swift.exe -
resource yara_rule behavioral1/files/0x001b00000002affe-587.dat themida behavioral1/memory/1936-597-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-598-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-599-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-618-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-619-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-632-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-832-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-885-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-951-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-973-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-1004-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/1936-1026-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1198-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1199-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1201-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1200-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1231-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1357-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1387-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1431-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1460-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1510-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1566-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1864-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-1893-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-2011-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-2077-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-2118-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-2184-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-2241-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-2436-0x0000000140000000-0x00000001437AD000-memory.dmp themida behavioral1/memory/3544-2819-0x0000000140000000-0x00000001437AD000-memory.dmp themida -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Swift.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Swift.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1936 Swift.exe 3544 Swift.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_595576979\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1779532449\Microsoft.CognitiveServices.Speech.core.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1822388264\automation.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1444119020\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_763014261\ct_config.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1213849776\Filtering Rules-AA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1213849776\Part-IT msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1642754153\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_595576979\_metadata\verified_contents.json msedgewebview2.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2014423724\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1750896361\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1411137087\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1213849776\Part-RU msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1642754153\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1822388264\classification.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_62905414\crl-set msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_595576979\_platform_specific\win_x64\widevinecdm.dll.sig msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2028121958\deny_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-te.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1642754153\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1822388264\travel-facilitated-booking-kayak.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_595576979\_platform_specific\win_x64\widevinecdm.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2014423724\protocols.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-sq.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_735899303\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1622606736\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-nb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_895875491\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2028121958\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2028121958\deny_etld1_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2028121958\deny_full_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1213849776\Part-ES msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_735899303\manifest.fingerprint msedge.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1213849776\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2134529957\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_2074434925\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1213849776\Part-ZH msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_735899303\crl-set msedge.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\Swift.exe:Zone.Identifier msedge.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x001f00000002b2be-2053.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe -
Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe -
Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876679698618670" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe -
Modifies registry class 52 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "12843" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400500010001000ffffffff2110ffffffffffffffff424d360000000000000036000000280000001000000040000000010020000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e9070300420061007200510065007600690072000a00410062006700200066007600740061007200710020007600610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000040034a543e94db0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e9070300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "132" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "165" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "14934" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "165" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "13967" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8609" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7642" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "12843" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe!A = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe!A explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1099" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "13967" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7642" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133863607807514434" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\PersistedTitleBarData explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "132" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1132" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1136229799-3442283115-138161576-1000\{76A8BD3A-2780-4EB1-89DD-BE499901965F} msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1136229799-3442283115-138161576-1000\{DEDC2A41-8F32-417E-83BB-460E052EF638} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData explorer.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "13810" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Swift.exe:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 496 powershell.exe 496 powershell.exe 496 powershell.exe 4620 powershell.exe 4620 powershell.exe 4620 powershell.exe 5500 powershell.exe 5500 powershell.exe 5500 powershell.exe 5652 powershell.exe 5652 powershell.exe 5652 powershell.exe 5948 powershell.exe 5948 powershell.exe 5948 powershell.exe 928 msedge.exe 928 msedge.exe 3548 msedgewebview2.exe 3548 msedgewebview2.exe 404 explorer.exe 404 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3484 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2692 msedgewebview2.exe 6128 msedgewebview2.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3492 powershell.exe Token: SeDebugPrivilege 496 powershell.exe Token: SeDebugPrivilege 4620 powershell.exe Token: SeDebugPrivilege 5500 powershell.exe Token: SeDebugPrivilege 5652 powershell.exe Token: SeDebugPrivilege 5948 powershell.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 3484 OpenWith.exe 1936 Swift.exe 3544 Swift.exe 404 explorer.exe 2508 SearchHost.exe 1548 StartMenuExperienceHost.exe 404 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 4320 2028 msedge.exe 81 PID 2028 wrote to memory of 4320 2028 msedge.exe 81 PID 2028 wrote to memory of 432 2028 msedge.exe 82 PID 2028 wrote to memory of 432 2028 msedge.exe 82 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4428 2028 msedge.exe 83 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 PID 2028 wrote to memory of 4604 2028 msedge.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://getswift.gg/download1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b0,0x7ffae94af208,0x7ffae94af214,0x7ffae94af2202⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1804,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:112⤵PID:432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2184,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2220,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:132⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:1464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3988,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:12⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4164,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:92⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4304,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:12⤵PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4444,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:92⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3432,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:142⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3624,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:142⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3588,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:142⤵PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4184,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:142⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5980,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:142⤵PID:1944
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.execookie_exporter.exe --cookie-json=11443⤵PID:2060
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:142⤵PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:142⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6332,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:142⤵PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6484,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:142⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:142⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:142⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6820,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:142⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6808,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:142⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6408,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:142⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6992,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:142⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6980,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:142⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7340,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:12⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:142⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4340,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:142⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3648,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:142⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=5552,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:12⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7344,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:676
-
-
C:\Users\Admin\Downloads\Swift.exe"C:\Users\Admin\Downloads\Swift.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Scripts.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Scripts'; $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Workspace.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Workspace'; $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\AutoExec.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\AutoExec'; $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=1936.900.45452956387282730643⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2692 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\swift\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ffae6d7b078,0x7ffae6d7b084,0x7ffae6d7b0904⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:24⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1900,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:114⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2320,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:134⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3592,i,17880283709146197240,644740682258050921,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵PID:3392
-
-
-
C:\Users\Admin\Downloads\Swift.exe"C:\Users\Admin\Downloads\Swift.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3544 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Scripts.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Scripts'; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\Workspace.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\Workspace'; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Downloads\AutoExec.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Roaming\Swift\AutoExec'; $Shortcut.Save()"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5948
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=3544.6124.58008664155044630734⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6128 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\swift\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x180,0x184,0x188,0x15c,0x1bc,0x7ffae6d7b078,0x7ffae6d7b084,0x7ffae6d7b0905⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1856,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:25⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1716,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:115⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2324,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:135⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3408,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:15⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4656,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:145⤵PID:5412
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4772,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:145⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4544,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:145⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4776,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:145⤵PID:5560
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=792,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:145⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4824,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:145⤵PID:2768
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4928,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:145⤵PID:580
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4792,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
PID:3548
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4788,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:145⤵PID:5472
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name=Swift.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4104,i,4020774345011183124,2057179045179876123,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:145⤵PID:3160
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c start "" "msedge" "https://key.getswift.gg/ks/checkpoint/1/cnCQrFFEWuowmayClSCTrHjlwCuWOyRvHtLUBVeNoooVuRSWAR"4⤵PID:6080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://key.getswift.gg/ks/checkpoint/1/cnCQrFFEWuowmayClSCTrHjlwCuWOyRvHtLUBVeNoooVuRSWAR"5⤵PID:2856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch https://key.getswift.gg/ks/checkpoint/1/cnCQrFFEWuowmayClSCTrHjlwCuWOyRvHtLUBVeNoooVuRSWAR6⤵PID:5184
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6940,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:142⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1484,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:142⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:142⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5464,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:142⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2732,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5692,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:142⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3492,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:142⤵PID:5532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5452,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:142⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4276,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:142⤵PID:5296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1648,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:142⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:142⤵PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=5524,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=3168,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3560,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:142⤵PID:5516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:142⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4268,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:142⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=7676,i,6420254787326703993,12090189645989357802,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:12⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:4924
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1416
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3484
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3556
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:404
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2508
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1548
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55f4c933102a824f41e258078e34165a7
SHA1d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA256d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
SHA512a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
-
Filesize
34KB
MD5552786fcf0e50a8ecd88e43b394f78b0
SHA1848f2669a2d7b8da81aa9797262b33177593de47
SHA256fc6a20feae62c3ee06254d88c2483306eef0cbeb3607c07a88e8b5e7715edfa5
SHA512ed1dbbee3101728cf5b6c24e92a26be9510aee250a0e29266a3d740ccb47293cb9634b9ae923a29da7ce23f03eceb119824ae3bbc165578148c767cf8c1e38e0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
Filesize3KB
MD5f9fd82b572ef4ce41a3d1075acc52d22
SHA1fdded5eef95391be440cc15f84ded0480c0141e3
SHA2565f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
SHA51217084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339
-
Filesize
280B
MD5046b1cdbd636e82e7711ea1fde31d7e3
SHA1f5fa4183cb259a99b4148ee957a5f76e80a77ada
SHA25640328502d95af4c1db45d98abe8c4e9214d80a8df7f0b8f19f81edd5e121f90a
SHA512460ba5792f0df64289ff4057d04615973a7844b2fd2c14df554600c141d720fcf13d9e9c8449ac57e50fa074a81887437918970881b4d48f7a7ee3521bac8eb4
-
Filesize
280B
MD5cbc9fc2d9ad2df85283109b48c8e6db0
SHA1721ea0dfafd882d6354f8b0a35560425a60a8819
SHA2567c21b286b304b2b42ab3502158aef04892b60c63007b8ed7172dad86a4bcebbe
SHA51209594b5f33704cf367960376e5abc8cbfa7baead59c3f199ffd365a9a9c2159b45f6596d597ebdd033db5436c000faac3c5b2fb39e97fc17b102d03831265609
-
Filesize
352B
MD5f48ecde00d89d25a56b82f0939c6fc5b
SHA15a9c0c70423655abc2f67edef2dd48b3db4d1702
SHA2560423ca512c9e7fa67ca75ce9a6f49dcd8c8fba5bdc3cc1393b07f491bca1a5a0
SHA5127458aaa7de0b3bc1204c98f7cba6b1b0393e759e7fc4f3f317d36d3361f84b516deef81d847ec8d0d65d5767c37b0fe647a15857fa9f1f637e12acc315d8f6de
-
Filesize
158B
MD5399aa491efc7e4408cbf4164f632f3b5
SHA1bc23e843678770edb45e28c08e72c89822046a98
SHA25658390f8ec021ce531eeb159dc05f9a071eb4f2db501bf3283a0807ef23b46c53
SHA5121db2b6b2f8fcd0385bef58375231de7ec96aa7378574587f587f307b6557eefbade0692b1537391d08099d69472fd59604af87d0bddcb9920812636b5896cc7e
-
Filesize
3KB
MD5f0a7984f5b75d791c54020643cfb4967
SHA1923f4ed9b4b35dfb149111e527bb41bf0fbef8de
SHA256c7b551b589419da6b4ceab1f8e932a3ddd82564ced25e451f727f307cebc5589
SHA5128b0deb113d56aaa9f740d3f8a59fb04b3b11cb4acf208f4824934349698e1ab4d12c76c07fa6d4602f4d2cc9066bef1a6764fd1622de7da1319b34ef3c96a87d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5efbaec0590812485cc52b6174da45d96
SHA1328b84c97805f51437ed30fcc2be7369ad0a8180
SHA256dfdfeb1d7b40d7c8f75088e0e26564bdd82a9ccc89e2e9396372e65d25e25f87
SHA512affbe7d1ad9cc091e53441f755d2826d008654cdd56f9ff7833bc30707ec6045f1e526eac5fc35fc6ef7ce9bc240bfc7bd3a25396e64051f134e78b911725e7d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe579cbd.TMP
Filesize3KB
MD58916312674d8e3f33dd4482a05da9a9b
SHA1d0c66cf0b1edd4ebe5f951151d0ea10287e513d1
SHA256962c491d8de5f4d517e53ec16f54057ea083c4a75ff82f1462dcced42155aa71
SHA5124a14669781f0e734155824fd5889b9f0fabf15702b407fd936e0a96dec203bb7c1afc7b4c6050de373e6b6d5772b22b916f31640bd63cdf3769e11ad30b53503
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
69KB
MD5164a788f50529fc93a6077e50675c617
SHA1c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA256b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
SHA512ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Filesize9KB
MD53d20584f7f6c8eac79e17cca4207fb79
SHA13c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA2560d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
SHA512315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
-
Filesize
107KB
MD540e2018187b61af5be8caf035fb72882
SHA172a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
-
Filesize
2KB
MD5a1e766fac705b300d42251d432c24594
SHA186d2dbba3fd7b6aaa7a36414c91b72b56092138e
SHA256c1c38f82c4978dfb928a6218f49ee3be29dfb39cc3fc785e2de85375495ce180
SHA512629306eec7c60754610b8247c6eb9cb3c01ea295d425474be0a1156daf9000170a429b27bcb8ce54541b2a515111bc4d703bc073ac49ef615e765761a657a9f6
-
Filesize
3KB
MD52250b99cfe7c1125900f9e95da3891bf
SHA1dd5882d9bd982e7fd324cb0567c80d94a5499cf2
SHA256fbf879c3ab8ba08b38b3532c95afcb7f5aece2503a929f04d16644b75ab43256
SHA5124c98e6c4c921ea7ce3afcaedb2d4697a6da002509b563c95be5d5f45d199dec0405176695ccc0c428e3ec298a2b5a9117be25cf5cc0a3612ad7a9dbb27013f50
-
Filesize
4KB
MD51f0f5c51a2c7e301b07c1d2d7328a422
SHA13a180d403a53e27d4abb320f97096bd86487b6bb
SHA256e5b012b3e8c80b0c36d4efb5b7b627267ce182bfbba114d7a47485765a4e7b38
SHA5123e24185a61a6d65da794f0e9f611bb50fe2d249cfcc6e85c389e72773bbc5ab0fc1def725a45bef07090e9d26747a9a294957d927b8b472489ec8fd352982a16
-
Filesize
2KB
MD554b203d9a2784d5746e11f667598ad90
SHA1e7aba11772b37da11fe7003d36a97b97345e40e3
SHA2563614aa2ee3264ec7203163e1c0cb164d4ecabee5ab8c7c7d96d901803ac3bb8a
SHA5126f1a22bb706264ab6e46a083baa917078c1756e47e923efe494850367d58dac7faf501db6fe69187e02ecb461d2e44d1ef230f665347ae4e7150dc23d725eae3
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
2KB
MD503964bd670d42482df1e75113e19bf04
SHA16c368f584e7074f540c5f063f8a53edf67a749b1
SHA2561fe738d7d6058876ad67ff68fb92b6d310bc62384905730b4cf626692113abac
SHA51241c2ab33cf42af0f1592eaf7a1c5976e034800ff5afe49cb78deb4c35b367cce3527747cec16d0433077610cb2c17488a52812dec1a6d191e67ccafb3181eb1f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
13KB
MD5dc546e32aa5bc4a1b099653875d08791
SHA1b1e019cdb45cf640f5fd29af6c991f00f2513bf6
SHA25682901bb1e763810af48d914f9519fb6baa88481ca33370bd8b0bc465e109b646
SHA512fad35c598c8e42e7e8df84aab2b93744cbf9a05f51e2a31102ca2401db5d607c18e8e99a854416985dcf3379bb549ae9740b242f74fba3017a7bc2bb273de511
-
Filesize
15KB
MD58111f2987f98c096156a7e80a4d4d9b3
SHA14fe9b6c5561c3e7dfdc2986c7aafb0c7ff5fb89e
SHA256b5f71d0d2d69f77158ec31562ab768381fb07c64d8c3338a36237681587b7fd5
SHA512f976ec395ad155615920cddf45ed1220373119c791e7f82267fa6cc57becab3cf136ff2bec4317baa353f408d0de45f569f147ac3ef7da9562e7d417bf03a8f9
-
Filesize
15KB
MD531924cf9f0ac05f57f676636439bcb2c
SHA1dae9b634dd280a93d3eb90d051e604081cc69fea
SHA25686d9a18eed0da04093c9d957d5adf7c530ffd2f749852a60b0e90f56d9e2f10e
SHA512677f30287206f6627ff4dae060c4f94c97f7170c6dc3514062a7c55b19376480127efce436778f62a198bf2b55439294b8dfcbed4759fd0020e7d0bcf9e3bbf8
-
Filesize
14KB
MD5b6e782fee2fee7d21c049fa1eec886ff
SHA168b652e960493789b941d5e2bfdd397ecb23d905
SHA2564c119e2543100851375b4a11fcdbcbfea2b3ea15047c5265a843f461cfd46c6b
SHA512ff9ec9605e67bfe464e1932be8aa8382dcb4fa50b5fd32001fdbb5266f4acd80e71b1bd6e13c0e699a2e0249b289daa6279dcce249cbf687129ac4eb388153cd
-
Filesize
37KB
MD5866116bf6c729ce5cf4f613c97517875
SHA11f7c8bd3d259434c21a2f50d5a74bca0f73a96d1
SHA2563a336ca9002202873a30c7b9ba9f2fc7caab81421950f67cb6022b66820cc072
SHA512610a38c5cc6f93de41cb251f10c95797b202f1048459298b5e6777b680b1f6381968c349ab757b3715eaab41eff863b02818055fd94be4acb9551c0697bfce19
-
Filesize
4KB
MD5600d8dd2887c8d858a8ff41b9e3666d0
SHA1ae1f04942c606931f89c52649a44f5473f9669af
SHA2562f9e8d989815d0b782dcd9673e426ef8af287fab097c1c99aa07e2a7b08f5f1b
SHA512ef91ef2779996136d08fdcd2f3ebfae44b5ccfc6c8320a2373fb894bce02d10a60d64939dbe8b199ab718d031f4743c2523d7895ab348854f58ec8a99041e4b9
-
Filesize
23KB
MD5d85bf4c5fef64a0a240c293ad84e6cfc
SHA1c5f7a8a399e6d9a6be8c70a8f472b5caba651296
SHA256f8a649a797dda9337c3f2535ac2d3cc27cc329ddf03775c19639c0e53794a9fe
SHA512c76f42ea671e74a06f747ac09fe6e3fc7efb62fc401d8ea12fa686812836753b1348487d34abf113d6ac0e49c6f3260a9760b36cf1818cbfb4c4a78bafd8ddc9
-
Filesize
880B
MD5c79445510481c0f62d3dfa9a56a23b7c
SHA19e2143a809120f338da8872058f70dc122a0c00f
SHA25634b9aa3a9a6001bc8419887a719d69b452c0f87c5c32e0cf15b87b82c32cc7d7
SHA512821d93e4e231efd42a281644132f3d5c8e0fdcd237276184bd966a4c673c3eb007dea411e240e28583d60694346eff9d36a24cae1661867356d8efe1caf576fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe583da0.TMP
Filesize469B
MD525e92af3404b527b61eeed3baca1b483
SHA167e88ea416a1c68c7cb6c00bd6022acb58e39aa9
SHA2567d432b7124c1403a21b84e0c874352d15bee1adf0b21605fadeb1f80acc0aa4d
SHA51217f0de1ad16cb52bd08e81d48df8fd9727d9c8461a97f3f192622613c424f685b7ebb4b390391bc13361df39c5511448adaa1c8a96067a0e4d9f77ad960df11c
-
Filesize
22KB
MD556a63f182b2938fbe3e59fbf9681dc08
SHA1b76578ca24fb20b8bd5dafad4296e5a46735a5e1
SHA25636edc2510fb072092e4c6b95efe4521857d9dcb7f0b45afdf5e8ef02e5d19593
SHA512b17246b7c61e26fce1f211311b578d6b3d22c03a042137bb2bb5b23018ce5290a8fbf7a34b2f66fa30b2027296b8a570478f66a144385c320d63c1cef64434f8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe583b3f.TMP
Filesize3KB
MD5c7569efb2fa9fe93c0ea2f0896f54036
SHA1e231c700b778b624f6065b035e5803fdd8b4db4b
SHA2562422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f
SHA512c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Filesize3KB
MD594406cdd51b55c0f006cfea05745effb
SHA1a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA2568480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
SHA512d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
-
Filesize
30KB
MD5d76ff88a49262ce84df21a8b9641e9e2
SHA1bc8be466082cd4321b14e8e087316ae6a60d6cc5
SHA256c7d5d640a754a454209ff7a3adcc34ce4b5fefff5cabf558067c9979365d5879
SHA5121ecedabd4ab74258b51968dcec951500ad25404f26d1d915e3d62079daf93219a9382beee3aa7e6b8ed425e5010063a81c9eeaf1dcbe70262dfd0fe97453a8ad
-
Filesize
30KB
MD54c4a91216078cd7bed62e5c76363b156
SHA1a97a725d47fd015fca77f4396e839eb9af98c5c1
SHA256210e49c0cf3d5195cb60ba01ec662e601c6f968432493a7557ff070b79ca180f
SHA512e1325d19ca52c53a55e96dd6b54e97285823f31b44acbd7f8f12d6436ea696da69eb3e6f622bfe6a6ece19a10e60cb9686d318cb37609fd229e1d64f1a777fe2
-
Filesize
30KB
MD5ea9565cd2ad8bea104bfeb7c57cd47f3
SHA1dabcc240cad23ae82f47e398acea101fd5c1b4e2
SHA2564e5c63c8e00b6de329ac1fed41a51cc51a8d7d5281080e2d391af3865c32d2af
SHA512204b0f64a3dab339b7433a8c96de645ff2b103880e3db9f4ee5a10a8a44e98dc52835a69111a1fdb310354b4c663c4d149816b6279b03654b6ece00f8b9b23f2
-
Filesize
6KB
MD570cdb125a7bb8bf79b60a2f906fbe917
SHA1f3b751c037f948f016e08d0c40a35cd25f3fd05f
SHA256294ed72c202784edfa1289d38185bc426d73678a95e33831c842db8a94a9bb42
SHA512fd8cfad3055fe1d2b35d530241643f28d3e0a4e0e33013c00e631b24787c8486a22c0861fdc8b70c3213d64806c2f3fc42e3b96d50d0c4c2c19f6edf51ee307d
-
Filesize
30KB
MD567448b3f03922843450fd35e12c5dda5
SHA129001fce22623afb1fd6b4b9211096e7d6f32303
SHA2567a16e5075044e27c572ba25790cf38873a9c45f35453c2f2ae2b98d111e5c72c
SHA51267602d3693a524a4acc3e67f341b5fc98b9ac2dd895165885b25d7b04e2e25412f3fc5b18a8d1f7531f19de0837665bd666b537955840d980f6f5d8be739e278
-
Filesize
34KB
MD55f6a75533395b4a3daab87c7c96203c4
SHA1503747775a771a3e4da43862fc8e84dbb7eb50d8
SHA25628a9757e3dc94609caa4c8127d45a839dde5b0fe8e58b8cf65b36b3a6492b283
SHA512f678799d0e248b65587952ad259127ade9a1486d526d6b59b37cbc660a5e167bce0e660a0af22bb1726de3deff5ddf1dc1782493a6f7fa733cb2d78c0f28457a
-
Filesize
7KB
MD599a6e52551191cfcbf427ba712ac496d
SHA1243907169b61bedf053544ad12790cc34e8333d3
SHA2566615ebcb1b48ded90e329c26bbf8e346f237f4909aba6ad4e287f997b1d1a8f4
SHA5127ecdc6da246e8a2f217f1e8ebbc376408d161edf3a2cdf0cf978dfafdeb04bf8a20a769288e9ffd86a157b1c064c9555c20b73009f504196625e9641c219b3c6
-
Filesize
35KB
MD5aeb23a0250597f1043e217aaa39e9f34
SHA1f71122f5d53d88948fa5dd8575a5fdbf8b4e7a62
SHA2563590d870032d1fc77901095d0710d08128e28eae4680c5dbacf52b1a2b66c797
SHA5125cf3bc88a920592c189576d7d4d3f6a3bdb4f9734372a85978c12120bed36fcaf6dd989c164049cfe69b957f6cd1fe0b1164f135c6304cb8b1a472fa98981130
-
Filesize
34KB
MD5cab124840a95e6311fa0b16f4adf7572
SHA14fa2e91e04970f76cf86642a5687192c9a6110cf
SHA2565383d63dff99483454eabb9a35ff6de08074e6f42366d3ba0495783a7366553f
SHA512fa7285c78c84a1d54b03ae88b78faedc23407b3ef12738c446136301f8488ea45abd353da6d5401d4417ccf0a5dee2a82e3b342976a870c59edb03c023e5688f
-
Filesize
35KB
MD56ffde66731d8ab0d8cbaa812d974f93a
SHA1ec1698a3f9e688ab464b4ddefb24ee3e392eb7f9
SHA256866ef9ea8c380b2b4e2f4dfc7dcfb7c8d15b952c10d5ed01d3976a99b7bafcdd
SHA512e58a8782bca25bf177e38d76dbe9cf3b9863d0f04a9bcc0e825d6994ce90d3fac8bf70fb770c7e946ee3dae67b4cfd95eceaa0e77f4674dcdf0a88802d1d3f1a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
Filesize6KB
MD5bef4f9f856321c6dccb47a61f605e823
SHA18e60af5b17ed70db0505d7e1647a8bc9f7612939
SHA256fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5
SHA512bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Filesize2KB
MD5499d9e568b96e759959dc69635470211
SHA12462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA25698252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
SHA5123a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
-
Filesize
1KB
MD554842f1e1b484852f346a00fb96d5c8d
SHA17f9174bcee466076511721bae11e86b844b72c11
SHA256935000dfc0938cf3784c98e770bca986acb47eeb4afcd0b6b9533d0bfcd84c7c
SHA512bb215158f307245213a9e99b575b73cf17725a28f6b069bf2b65e15bf0e3092319b29e9d2daf9ca6021670338221c0d8fdfdabc475125514aa8d17355fd28bc0
-
Filesize
1KB
MD5371ac0b948586f6551359d1e5cc7ce6a
SHA1e2e3b8930edaec9752d2a87f9ce512a3dd320eeb
SHA256a187893f567559aa34c3a11386eb2553d56ede8e3ebec1394cdb44550bc3c7ae
SHA5124c4c8c8dccef9569ea5c0decacbff5540487001edf779fe35ece83801e0f26f07e6f36faa8d576f0efa75fdd28593b632a39091a0d128503187320fe661bec6a
-
Filesize
1KB
MD5b94a5f9c019b614942fc29d049e77006
SHA17d22a700e14c52c6ded2a26cc063057b779d5c2e
SHA256ac01c39f1027c82f8d739b7a15c8fc17875bf33f3069f9acf0eb4a0d3b8803d7
SHA512301825dd58920d02a28650c9bd9a43d36d5d896fa72b79b49792a868f2df4d419dd6fdfe245f544f8becaff9585e63050fe2e6979dbc35a592017423a392633e
-
Filesize
1KB
MD5dd3474e6a72c08266c25f196f78b13fd
SHA1b70c6bbd7794b49b6b9afa6343987a7f553d1268
SHA25682acd1c6613bb2c907a26be1f61f6556ee03cabf1aa73dad27d012be88e05318
SHA512cf5138ab09f19034fa5d058819956fd0556c56d674268e496dbaded228839d2be576bd74cda26127adf03cce9a8ab485ce6a07c7332a2c65a77ca9b56d92c79d
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WRLUCZ87\www.bing[1].xml
Filesize325B
MD5fdbb76b0cd38054ecc1a6cb90f174f7a
SHA119aa5ae4920e035af2c729f417c9463353b18d32
SHA256e8c8b143087685aeff12a418b7fb23fa8724fbb6274caf84c73fdb756e436aca
SHA512e768c92400b85a875a91808790ce1b453d87531c192f6d592280ef1d83608d9d793d1d60526af10eb8139fd4642666bd31b6bc0c8c358503aba3e0852003e61a
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WRLUCZ87\www.bing[1].xml
Filesize15KB
MD5c9c00c182f946511201b1d55acbdcc75
SHA1a8b8e6d06ec6cf10cd94a4876437b70bb92c46d2
SHA2565ecd9b64cec986a383459bdd72e04f37e7b492d1f52605b72d77a7880b6ecaec
SHA51256044139bb50fac96ac0e25365b702f253df092babce03a0afbdba2488147e158bbc8dfb83380e3a6d5a43c916e8ceedf038d4d0a4cd59fbab4b43fec7c91d70
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
10KB
MD578e47dda17341bed7be45dccfd89ac87
SHA11afde30e46997452d11e4a2adbbf35cce7a1404f
SHA25667d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
SHA5129574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
152KB
MD5dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA256fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
SHA51265347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
-
Filesize
21KB
MD5846feb52bd6829102a780ec0da74ab04
SHA1dd98409b49f0cd1f9d0028962d7276860579fb54
SHA256124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4
SHA512c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9
-
Filesize
280B
MD5449766340b409205a02c79c7ddda9e6e
SHA19a9a64b52d9d2770dbf3389221d91ed546ae3651
SHA256a49176f719fe766442b116ba05b7d235f82c18330a0dd1a58cd45108806a252f
SHA51278423bc612e94a389a8a73fab6df25c054eb90b503f3ee8983b2b5e8eb2ffb34a09bf42fcac7484349513e5cf615afa1cb4c3f8d5d7da3a178ba916992f6555a
-
Filesize
280B
MD558cfc5be2b9b0bdecb19ab6c6636d57a
SHA1ec5fec37b8247255100e6dddcac66167cd6235b4
SHA256ffe3756c53b7aaa792c6f922eeb123410a7a8265943fb10d1afb17042fbe9114
SHA512f9f727aca33d5ebab38def50f7c5b7881db707fc68473a2c02fd32b9bdd30f21859d8defd3a909e4e42337cf7c2ce332a468fd2d57d36ddcebcfd68d0fbae4e1
-
Filesize
280B
MD57e00537a42713fc923f030a0ff7b77cb
SHA191a2c096766b8c09469b73db79d3f7a28d2dcb48
SHA256c73507366739fcfc08809c36c9f983cd6492c06d784348db818a88dcd273e3b1
SHA5124c6dd9aa5fcd9628a2132eedcb88ef1681dad6e5ccdb3af0f0708a5fe942fb2726339dd172aef2f60cc6a85163e872b80f719ff7e92cd2eeee0c11eeec3718bc
-
Filesize
280B
MD5e51600b49842349110c4667a4c557105
SHA169b589cbd677fa672efea94ae364b6c57e72cb41
SHA256708fce9eac41c20f6cadfbf482a6466d03b0291c4e1739b6914180269948fae9
SHA512b81fcda0c1d25033bb9eda8fc6cc277944798be3ed949f6ae9084701dd3e92cfadc00dc668dc9d9050360d381b4514a4d78cbfd206cb77bc63114795bba27e18
-
Filesize
20B
MD59e4e94633b73f4a7680240a0ffd6cd2c
SHA1e68e02453ce22736169a56fdb59043d33668368f
SHA25641c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
-
Filesize
48B
MD5911cbe6ad1c98443b67000f3f305b85c
SHA17db9209f4e3583899c0f47fc2c0f7933747a08da
SHA2561adcb04c0ad69b0a219b56ad9b37f598ea60ee418b12f3d467898d6f2a8b8a5a
SHA512f24646786269d75b05377a20b9335dc5cd7ec2d34e38da243edc9ba28bf8ada49c7289a35714541669c5479120ef199afdb70468372ad296c75d096ad425d370
-
Filesize
456B
MD54ae731116d17a968aa6150692ec78de5
SHA154aa7d60c8c2dfa8beff439b3eab2addca0a8548
SHA25680271906152fa7e44c5d549fefc4f9b0730718a9626c30e1775f1117374cba0b
SHA5129e4d15d82136cddc17b1e4c0670ea7308d30a0a24c5bc3f8c0d45cab3b5066915e72ee8e22a21d6b782209a2f20193287e8c4310452fadc73a3369a6397793b5
-
Filesize
360B
MD52f6de5a92f55d78da743da34b6f54f30
SHA197e653adc687905c14bd6d194f415a6581e40a97
SHA2564a04b7eca01eaa3576e554c1d60331a7b3d17011476ebe30f9c7adee6b492fea
SHA5123ae74d2b5ac678f8b56e66f2b9e3e7e3a1051e69a815fd6320b4f50f915ba9bbf90d9c0ab35578dbbf1c2504c10eb3c0e7760bc35642146b0f51423275f4bff8
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
184KB
MD594709f62792e26b5c076c1be1eb18517
SHA1a5cd525ed7b61f002c91cad886d3c6a908895e05
SHA256d8dad0ad112c67c66fafa03f058613a2879b13d5f5f5d8040e621437d8eb3a9b
SHA512b373bf380b20fcbcd5b4049cf66845365d5c5d8758e76ab4468f470374f577bb2530d6ee53356d65d5d0773059b61076db22766f3a953cca550f2f0ede77bb74
-
C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\64e94839-648a-4840-89e3-7402d16e4478.tmp
Filesize40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
396B
MD5b0def02d41de7587356b94d0a96fd672
SHA15602ed42489e6d9ff827a0174d8345d11ca2f32c
SHA2566569dea65a2e43f0e4acf2d2df1a081274aebf2299843d7564dddcb4c8b29733
SHA512f696b5c4668473e78086b3c14aaeabb804f6f9d983915ddf396a23d70cb9c4055342c14a7c3febc4d62218f68945d30f8803c0b336d6df56ca4cf21b1be39abc
-
Filesize
427B
MD5825807a6174e867a3be3ab9e5243cdcc
SHA112964351ae45879fe1309a854a2d2743adc47998
SHA2565b57d4d0ed13cb9679a625928f7a47c554b9a2035a5b844599d5e5094bcf7a67
SHA512443ae69b7f723a0713d19d26313a2d01786b0b0ed26eb87b71314c3251ad23660ced4a0038f9387a51426fe04e2999b459ace0b296099650bb0415cedae0ffab
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
188B
MD59ba4975964d3641cac49c41d8147fb17
SHA1d0eaa236f1bb8a6b9176ac1d7381ee78714a7ebb
SHA2566e985259c7de37de1d9f6936b5e7a6fb468d6ef1ea7e333afac6946a66d24456
SHA5125b23453d2eeb19714c688f9f5cf2f5ce52b9da8b89ef1ee4f19b36805360757e2973f61455db68c991201f4c0878bdfefaba20e6d528975742de3801f3e1841d
-
Filesize
188B
MD50e6571319b8f9b9bbffb1e6628f422a1
SHA1fe2bda67b6720bc44cb1e42eae730593169f8d73
SHA256fc5527a390051c2de52c7575075bcf69d6d1e5c14761dc858b87572526b0b194
SHA512e5b09a8daacd106c48e7472bd704898df90398b44068a35a35a4f24defb831e768d5a7cbacb2e846c88d1e6bf8a7a2e3317c1a58e0fcaec5dee5dcf87ddd112a
-
Filesize
6KB
MD5a021dafdb85f7bdc2011d1838f7d2e08
SHA1034e85a9005319437cddc7717c0a437d3ea05c75
SHA256f8faf1484379f737c88f0c190125ffc375c9dbc83350c2142e42531276d64880
SHA5120bcc81cd58e560546f7c255f43def936572a477a09972bb9e41ab842e2503cc53f4af26fe99adba2f02329fb4b652c832ee9566db3d8a9e7031d7e35524fce06
-
Filesize
6KB
MD5aa5aae4d41497a35b81d79d2a8457433
SHA151e4c46f4db52cbebdeb18ea41e3eaf19fb4d4a3
SHA256df112606e674e5cc95728b3488d2d9ff96410f57fbccb02fd126518c3545bc0d
SHA5121f441b727d20545ecbc245a13fa909d5b6be4d345f74b1e7aba007d8d1fca6a3ae4112347dea075ec41adb6f9818e52bc15f2e85c220c178cd94ef7a0d61079d
-
Filesize
7KB
MD5eb88bb11c3eb59f53b5e0051f6b2bc50
SHA1277f573e4152c97baf6341e90b4aa1b93823e01b
SHA256566db6fe3f68b497c755d82efb4063a14ea99fdc08a8aa736058e1e9c84d1a5e
SHA51280738ad4c3748f7a43e6362101280e6bdbb1cc016c1c2f2d8ba9efd8c53b0a8373cf8cf97164d82de07d11c13790fcc5faac024d3fda0470ada42ecb13a3e1b0
-
Filesize
7KB
MD50d7a4bc2fbe8300737b803cb43f315e2
SHA11f6504f4731494952df09bbf83576e4a104b4a44
SHA256f12ae5bfd9f57ff3e3ab6ad0ffa2b4ec339eaf3a9099282b06c38ab20fe96e30
SHA512f2b1f7480e5087f30d52fff2be9d1d7d3d7e12b27575656b677675712c01c989f7c5e27e9150975d6c78ef6eaa35746f800a4ffe6ba795b509c221acabe3bbe2
-
Filesize
6KB
MD546976d5ce87a33e3b28ae0c0323fc538
SHA1592873ee1a8e42024dd43a194b357563c72832e6
SHA256fb22f9c3829e196cb3f5a4882a06c72fa7ce479ad4ffdb298f4151edae301c82
SHA512766ce43f019d979fab44af816ea1b06832cf666858ea6e1f3931d63ddfa2f7dd13d0a99987c0f45e863d06cd8c9e7b21ff85c8406257272158deea02f93e1b97
-
Filesize
6KB
MD503cea43af88b39d53ccd238ab8047598
SHA159848480fbb1f0d2bbd16ecd80f5b5b1fda87a97
SHA256960bdec0bc8fd84e56d0f5cf5243c3db70e636a4129cdef94b8a788333c51ff3
SHA5129092c366a7e4c9b9d101bf8f03bcf0237ce1a8229913dac6c4734da583a78f054bb6534987cad391cc6a8f850d8fd13b2b228232d22d1460813d182991fed2a2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
14B
MD596fb5f155aee0f8cd88274656c58ca83
SHA11fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA25606205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
SHA512fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
-
Filesize
19KB
MD5a2f3eef19e3974c1b3d156d0f8709c0f
SHA1cff07388555f7059cf0d38f354117c090d43650d
SHA2569d1b03b6ae49446dad7a4abe3fcbe37538d999d32f1500d89e67433d959f6ea6
SHA51211aeea8c3aec196640cf3aa74e65500dd86147052b13e050ca8deed5193c5daa65cbaa09bf4a6116bbdda4adcce9913f33cb2eaf5576f6c7e079d9f31986c689
-
Filesize
1KB
MD551529bd167070eafd1c31533c8734a3e
SHA19f543b93a74e1ad2be6d5745cb445e7e6b9fc63d
SHA2560fa27e51558e5a89e0a027fae48bf215cf3c9f698a04d1dbc8d9c84d34326b7d
SHA512858df63dfc67877b84086630e42b6fadbdf699a33dc5028662e82dd828a76223970ad8785a1a532a17e91fd6caf26b6d624c0ba76590c5e22344b547f7b9a8c3
-
Filesize
2KB
MD5f84b2487db78594b0b7c8ab5e7f40525
SHA126052568ad9d287db04e95bfaa2b9652930f7d1d
SHA2564c9adff3c6cf731e45b27027088c14e4e7a80d3bb901b12349ab6ed528366710
SHA5122f07761daa53f2ea638f726626c072a4f6e0638dfc72ac266955f9bc0a29e7d6caa9ce01a6e3b986832aa5edf8de7ddde51538fa26e86c16f8db2077829816b9
-
Filesize
16KB
MD53f14d9388c2b5ab82db5082620efe584
SHA1c33fb858371b5516c0ff308bef42691d266c40ee
SHA2568e0fc78e9ee919a8cc22d2740be9036243a75a1aa0d77e20c48e67142dfaa3fd
SHA512119a05ec526852ceae4e54e2a1391badf17706890125ca62e718c055fd7e0b9f694d188e9c4894809c7c194d3c6abb3bcec42e4c4fcf871bfd57a49af2d6ab4b
-
Filesize
3KB
MD5ab005c605be71365d2862322c6833c75
SHA1e6e92414290510b233ca196e38e7a0805c8b9c52
SHA2565d5b9b317192412818db86b5ebc4c15f699d3b50e0edcdd9925b01abb90c57e6
SHA5125bd34ba9dde7c6a9528575df513b310814b8a6a281df9daaaf7021f37495499e90a34206f08a2a877e3345bb631b8f5b550977c1b7aef1ba752a04a3bed0c531
-
Filesize
17KB
MD50b86c45eceed6f19507e9813d64b5195
SHA110a66434f60cfa6cecd1e5fc60c287826f7c199b
SHA256d0b12e49574a654b9489bb5369b93397909f8198cbe871ba6a36dec3bf94c6d8
SHA512f326da8e1b131542bdc3b296e61f5f62e02e10f9c624d8829a2aeeeee706bb0ad1a5dfbf7a5e26bb1d1065602b8272c962bc4a69dc55c415ca847950e7cc680f
-
Filesize
16KB
MD5bb559f155fac2f2b9232e518e317632e
SHA18d1849c5078a275216f904d0ea661d8cac1eef2d
SHA256ff4f89a161ec27569f5dc41eb1fbb98cc60da499d37f48b7befa853fb7d3d48a
SHA512e0fa1556390997e213d5712789cf2efc813c12560f8fb395fe2458fc6157c6fb2dd2a9f555d37970d5b3e3d6d2542157e94ec9ea19999b676686cfe9cc201f1e
-
Filesize
19KB
MD54c9cd324b9dec660f3b4263457616d4d
SHA1ad0c224a091a61736104ee01e2fc9fbd70931074
SHA256a5c98a84c50011c30e637fa3306526180ae8c72062f43c5c9cb8a8a77d19ac21
SHA512249f1c78cd36070859bb7a020969f81814cdfd1f9297fbf3dc7f2a3273f8f2e87aa339c09c34c06525c92573133489263b743cbe075b93ebc148c33c7c908a8b
-
Filesize
1KB
MD5fc11f904a2571a2c411c5555530972b2
SHA17e8b80f59ab310a3c1538a92a56f09e21b3d2f76
SHA25695439706aab56ea8a518fd812d87a0bfd2f4f7064e827b22ef145f548bdb8fcd
SHA512d40766dde2433ea5ee442eb84000d4c418aecb08eeaad7962b5f4f1dd62b40b8dc097537647b30ff5c0fb53eee8c30769db4b9e49fd39f3017ad5275d2bf0cb0
-
Filesize
8KB
MD5811b65320a82ebd6686fabf4bb1cb81a
SHA1c660d448114043babec5d1c9c2584df6fab7f69b
SHA25652687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf
SHA51233350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81
-
Filesize
11KB
MD50779206f78d8b0d540445a10cb51670c
SHA167f0f916be73bf5cffd3f4c4aa8d122c7d73ad54
SHA256bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec
SHA5124140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478
-
Filesize
264KB
MD5a0fd12b78adab9bc5c9305e4afd07309
SHA197b4e8cbd2c3856c144cb0c178834862c8322e88
SHA25641d72dadc3295e80c5bdc5dd8a363acb099b80b961ea07a448d12d80046393ba
SHA5129f96554d6f63cef4b2da10ca885ff0505105ef9a3610d9fda2b867a24d3cab397bbb49fc1d0f93e181c1ab8389f0c3fb43bdd49fd61e1d1d6d05bc4f8f6fe46b
-
Filesize
256KB
MD553e4f8cbc956bf1bf8f21984debd4014
SHA1f9e192710cd8880edc0847413de92916af0110c0
SHA256e54c1e381b509797f137b532b677106e2e8f2ca8ec550fb28bc91ed5483974c7
SHA512687fd51b1d854172ed24bf09c822d6602bc47b63d32a53d1d6ba84d433ed0da769c8013c7188ff0e2614284297e326f0af55963e04822bb703c4a20077cd117c
-
C:\Users\Admin\AppData\Local\swift\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules
Filesize1.8MB
MD5d7c9c6d2e1d9ae242d68a8316f41198c
SHA18d2ddccc88a10468e5bffad1bd377be82d053357
SHA256f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547
SHA5127fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3
-
Filesize
24KB
MD5aad9405766b20014ab3beb08b99536de
SHA1486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
-
Filesize
86B
MD5961e3604f228b0d10541ebf921500c86
SHA16e00570d9f78d9cfebe67d4da5efe546543949a7
SHA256f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
SHA512535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
-
Filesize
860B
MD5c6b9f3b758b5196475a817e492ae0f14
SHA1a80151402cbd59d7a58a18ef9324a3bfc02714a0
SHA256e8a7010d809ef76217257506067f1807ef5251f604e4a780775818f8e9ab9b00
SHA5124e6ccfce77e78081a8afcf902e5bae0fac0a361b8a4776ffbe55317ec1da2d75c84d48d4ae6706217eebbc7f21f405fb5ea80e956213b556841839681709e3d6
-
Filesize
853B
MD514b30415ccbf80685d0e45a6adbb7ec1
SHA1dc656498a8e1b3722f3e5b7cd37f87ce44dacf0c
SHA256cca0e1f978c4f98231863b9d0ff47f0362e3bbd3ca31d5688fd5bb87b8a6a17f
SHA5128126b648f290e9ac1938e5cd51165713a3db4a76e732e9dfdd1e6de3c94c1fb3f7785b62039818821a806accb2b7b81e203483d206d0370ef123bca0c0935058
-
Filesize
22.5MB
MD5c568dbc5fd90067a6712055023a18568
SHA11546683eb7ed167b54b9e4fb0a8ae72374f688e8
SHA256ed927320654bccb0164b7c1e8835975ec9f680d607cfea982c7a0a103684d188
SHA51272da4af29fd9aeda9851fc0a0a4ffc8a5b35f260074f2203381a760c94e4b836fe28b11186a6d3cca4d01de65893c0063edfcf355268b689330915ab66339816
-
Filesize
20.1MB
MD5532e28bfd55208ef66d609a48a65cf91
SHA15da3a7f1a437cae4109b4c052b7de697bc58a674
SHA2563b19486b4e14b206ec8ab2602ec6a430f9fce7ef40247b1e1f4c6f004ee468b4
SHA51210c57c4bd1c18242405bb7ac89361121b6169f3444122dbef246e4605b0f793f205a9fb36f5a8d820e9c8617bddb9df65b9590acbaada19a89ac7a064a23a0f1
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
865B
MD57c17d009a59f2b662e6043c5bd845908
SHA189b5930cf0dbd9e1b40cad43b84597ceb56e82d0
SHA256990651ab6aa61083a4f08cfcf267f5d6fbb4606fd3060e118d61fb9021fde68c
SHA51233ee773c9dba450a7305492be0a5182914a8c8b65eec3cf3484e2767660460d6bd073cca460e50f33d9be322742da0512f7e27267aa313bbe7be25619d3254e4
-
Filesize
85B
MD5c3419069a1c30140b77045aba38f12cf
SHA111920f0c1e55cadc7d2893d1eebb268b3459762a
SHA256db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
SHA512c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
-
Filesize
43B
MD5af3a9104ca46f35bb5f6123d89c25966
SHA11ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA25681bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
SHA5126a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
-
Filesize
160B
MD5a24a1941bbb8d90784f5ef76712002f5
SHA15c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA2562a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
SHA512fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
-
Filesize
1KB
MD5ee002cb9e51bb8dfa89640a406a1090a
SHA149ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA2563dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
SHA512d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
-
Filesize
79B
MD57f4b594a35d631af0e37fea02df71e72
SHA1f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57
SHA256530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1
SHA512bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360
-
Filesize
160B
MD5c3911ceb35539db42e5654bdd60ac956
SHA171be0751e5fc583b119730dbceb2c723f2389f6c
SHA25631952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
SHA512d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
-
Filesize
135B
MD54055ba4ebd5546fb6306d6a3151a236a
SHA1609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA256cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
SHA51258d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
-
Filesize
134B
MD5049c307f30407da557545d34db8ced16
SHA1f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA256c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
SHA51214f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780
-
Filesize
176B
MD56607494855f7b5c0348eecd49ef7ce46
SHA12c844dd9ea648efec08776757bc376b5a6f9eb71
SHA25637c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd
SHA5128cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a
-
Filesize
66B
MD5dee9d3bdd016c697d11e370a995e7332
SHA1ef13d667efd507e160de165f4f1fe918fc728ca2
SHA256a84789942c4436967dba5d0ce45a3f6767bcfebf67b951fbef75cca32e9acd96
SHA5121c798ed77fcaccc5ec237cb6618e6425fb7dbbe5f22b2a969b915987fda4be8ecadc265871832f0b7f9b5656433c27f8495eceb16598294fab80e709b2cb3d68
-
Filesize
116B
MD52188c7ec4e86e29013803d6b85b0d5bb
SHA15a9b4a91c63e0013f661dfc472edb01385d0e3ce
SHA256ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62
SHA51237c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656
-
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1444119020\_metadata\verified_contents.json
Filesize1KB
MD528706ad42e4c615a683c2494bc0bd2af
SHA16b0465b3d5e85a3ea76c646ba8652c4dc0248dc0
SHA256709bbb3e3a17e2b7bbf9f4afdcf465312695342ce4eb203df284233eacee086f
SHA512e95da92f1ad5f56ef61a5992a1b465d46f36eff1fc85643cc5ab3f357b6f14d81a5b5590d0e18d4da5fcc3ac537a469fd0c15b116a3471536707a9716119fa5f
-
Filesize
66B
MD55ddbc1878fe757e9fb5be515f8f95864
SHA1fa7d42b5adf36a370a95a0abaa20c6094b2b47f8
SHA256a0b13e5ecb7638ffd1e054301fef148b47ea17bc528779c56d77d4e7a6152983
SHA512ae2a76a48c46a90085a46cf03eca6576ccfdff6d76c64f095c2d657641c73054581b3e8c8738d751f2f8465fe6a2298e01188f807175fd7f4d1995078c7bc1a5
-
Filesize
76B
MD5ba25fcf816a017558d3434583e9746b8
SHA1be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA2560d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA5123763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
82B
MD52617c38bed67a4190fc499142b6f2867
SHA1a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA256d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
SHA512b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
-
Filesize
66B
MD5496b05677135db1c74d82f948538c21c
SHA1e736e675ca5195b5fc16e59fb7de582437fb9f9a
SHA256df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7
SHA5128bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c
-
Filesize
1003B
MD5578c9dbc62724b9d481ec9484a347b37
SHA1a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d
SHA256005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0
SHA5122060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640
-
Filesize
114B
MD5e6cd92ad3b3ab9cb3d325f3c4b7559aa
SHA10704d57b52cf55674524a5278ed4f7ba1e19ca0c
SHA25663dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d
SHA512172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8
-
Filesize
289KB
MD52b59269e7efdd95ba14eeb780dfb98c2
SHA1b3f84cbc37a79eeecb8f1f39b615577d78600096
SHA256ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172
SHA512e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7
-
Filesize
102B
MD5a64e2a4236e705215a3fd5cb2697a71f
SHA11c73e6aad8f44ade36df31a23eaaf8cd0cae826d
SHA256014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846
SHA51275b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99
-
Filesize
66B
MD53fb5233616491df0ec229ba9f42efdb8
SHA118a8116e2df9805accd7901d2321c3fa92da1af4
SHA256946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
SHA512e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d