hxxps://github[.]com[//]ave19930hv7/1ah-Arsenalh/releases/download/kmleg9s4at/dmg93k5b1q[.]rar

Analysis

max time kernel
245s
max time network
242s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
31/03/2025, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com//ave19930hv7/1ah-Arsenalh/releases/download/kmleg9s4at/dmg93k5b1q.rar

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
134	2432	msedge.exe
221	2012	firefox.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
2404	winrar-x64-711.exe
5948	winrar-x64-711.exe
776	7z2409-x64.exe
6272	7z.exe
4832	7z.exe
1600	7zG.exe
4160	7zFM.exe
6836	Launcherkks.exe

Loads dropped DLL 3 IoCs

pid	Process
3316	Process not Found
3316	Process not Found
4160	7zFM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5328_1724882038\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_110642245\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1527379091\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467166918\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_942101036\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1145132055\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1588175915\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_942101036\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1145132055\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1527379091\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_942101036\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467166918\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_942101036\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1145132055\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1588175915\deny_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_347639911\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_942101036\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467166918\edge_confirmation_page_validator.js	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-711.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133879080693060771"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Applications	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Applications	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8c003100000000007f5af27a110050524f4752417e310000740009000400efbec55259617f5af27a2e0000003f0000000000010000000000000000004a00000000005b77c000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Applications\7zG.exe\shell\open	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\dmg93k5b1q.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-711.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
776	msedge.exe
776	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
3828	OpenWith.exe
4632	OpenWith.exe
1816	OpenWith.exe
2084	OpenWith.exe
4160	7zFM.exe
6248	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	firefox.exe
Token: SeDebugPrivilege	2012	firefox.exe
Token: SeDebugPrivilege	776	7z2409-x64.exe
Token: SeDebugPrivilege	776	7z2409-x64.exe
Token: SeDebugPrivilege	776	7z2409-x64.exe
Token: SeDebugPrivilege	776	7z2409-x64.exe
Token: SeDebugPrivilege	776	7z2409-x64.exe
Token: SeRestorePrivilege	6272	7z.exe
Token: 35	6272	7z.exe
Token: SeRestorePrivilege	4832	7z.exe
Token: 35	4832	7z.exe
Token: SeRestorePrivilege	1600	7zG.exe
Token: 35	1600	7zG.exe
Token: SeRestorePrivilege	4160	7zFM.exe
Token: 35	4160	7zFM.exe
Token: SeSecurityPrivilege	4160	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
3828	OpenWith.exe
2404	winrar-x64-711.exe
2404	winrar-x64-711.exe
2404	winrar-x64-711.exe
5948	winrar-x64-711.exe
5948	winrar-x64-711.exe
5948	winrar-x64-711.exe
5336	MiniSearchHost.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
2012	firefox.exe
776	7z2409-x64.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
4632	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe
1816	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 5292	5328	msedge.exe	81
PID 5328 wrote to memory of 5292	5328	msedge.exe	81
PID 5328 wrote to memory of 2432	5328	msedge.exe	82
PID 5328 wrote to memory of 2432	5328	msedge.exe	82
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 5072	5328	msedge.exe	83
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84
PID 5328 wrote to memory of 3348	5328	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com//ave19930hv7/1ah-Arsenalh/releases/download/kmleg9s4at/dmg93k5b1q.rar
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffb3597f208,0x7ffb3597f214,0x7ffb3597f220
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1868,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2212,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2328,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=1572 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4908,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4924,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5636,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6620,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3548,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6360,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6796,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3976,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7052,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7384,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=4824,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7668,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5464,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=5516,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7684,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4784
- C:\Users\Admin\Downloads\winrar-x64-711.exe
  "C:\Users\Admin\Downloads\winrar-x64-711.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6772,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:14
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7844,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:14
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8128,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5204,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:3488
- C:\Users\Admin\Downloads\winrar-x64-711.exe
  "C:\Users\Admin\Downloads\winrar-x64-711.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2716,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8480,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5980,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5700,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5012,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:14
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7432,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3316,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:14
  2⤵
  PID:6436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3560,i,12782450910068991726,15009619694616725062,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:14
  2⤵
  PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3828

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\fa98804ec85c40febdd5b32c01419d82 /t 6008 /p 2404
1⤵
PID:5796

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5336

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\b61d3c69df6b4464b52b5781bdcf26ce /t 3504 /p 5948
1⤵
PID:6080

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1688
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {286cbdc9-190a-4a41-94ce-96fa5c4a99de} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {c0a90934-e7ab-4996-83b1-8bb6988348ea} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 27274 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {b04bc498-58b3-437a-abc5-cbc1c39ebef4} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27274 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {a88661b1-fd12-467a-8243-746cd0a16b79} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4612 -prefsLen 34773 -prefMapHandle 4616 -prefMapSize 270279 -jsInitHandle 4620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2928 -initialChannelId {1e5917a1-af39-4b6d-960c-4df11ab43054} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2848 -prefsLen 34822 -prefMapHandle 2852 -prefMapSize 270279 -ipcHandle 5000 -initialChannelId {8db648bd-9be9-4e5f-905e-517d41aefc85} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 33031 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {d9967841-6940-4e7f-8ba9-f2551d0b9263} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 33031 -prefMapHandle 5796 -prefMapSize 270279 -jsInitHandle 5800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5808 -initialChannelId {dc805b8b-df15-4c57-a95d-650c912e2335} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6024 -prefsLen 33031 -prefMapHandle 6020 -prefMapSize 270279 -jsInitHandle 6060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6076 -initialChannelId {8b6d95a8-940c-4a83-a052-3e53e880ee52} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6468 -prefsLen 33071 -prefMapHandle 6104 -prefMapSize 270279 -jsInitHandle 6416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6504 -initialChannelId {a75ffc98-6f13-437a-9a40-97cd2ff4c69a} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6428 -prefsLen 33071 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5760 -initialChannelId {a060f8ad-aff2-4c96-810f-e8fdb278f53d} -parentPid 2012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6408
- - C:\Users\Admin\Downloads\7z2409-x64.exe
    "C:\Users\Admin\Downloads\7z2409-x64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4632
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\dmg93k5b1q.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6272

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\dmg93k5b1q.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1816
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\dmg93k5b1q.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2084
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\dmg93k5b1q.rar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:6248

C:\Users\Admin\Desktop\Launcherkks.exe
"C:\Users\Admin\Desktop\Launcherkks.exe"
1⤵
- Executes dropped EXE
PID:6836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
551KB

MD5
b6d5860f368b28caa9dd14a51666a5cd

SHA1
db96d4b476005a684f4a10480c722b3d89dde8a5

SHA256
e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de

SHA512
d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
967KB

MD5
4eaae49d718451ec5442d4c8ef42b88b

SHA1
bbac4f5d69a0a778db567e6978d4dabf2d763167

SHA256
dc4fdcd96efe7b41e123c4cba19059162b08449627d908570b534e7d6ec7bf58

SHA512
41595b67c8506c054c28ce2b5dec9d304651449464c6e1eb092a049d49326594584900cff4e9b8210ca3ad8a23e9c22d8df1ae8af15f44a69f784cc546fcced3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
e03115ee7530777231a0051667ab23d3

SHA1
5ded32077cda52b5527f75017552a598b0523db7

SHA256
cccf6f489961bb78c5c4baecd964442b14593799403e2b6e4d50082c3e64803a

SHA512
053f81c647b55df05bef067f26be1d25b44cdd1d5a59c4341904f0b9173a1ad6cc3209035ed4782626b150f090f52276c7d99e77eaf108b2fed52f2179e959ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ec13c91-d825-472d-8830-608540bf4496.tmp

Filesize
50KB

MD5
9a9bc023f4bda9878422d85befdb91d0

SHA1
b457bc8ae7dbd0b90752ace846ddc4361d1de066

SHA256
4457d652a03cb7b4090b896fcb138a65c30c0e633b3fb7a97f9e51af3ccb568f

SHA512
a67086107af6347fece81a9d625b03e226bbe3091c8aa89a15bd2d9fcf311f20aba61c51b4131408c8cf1f7cdad13c780137d40fde81892f20be0e6365d5bca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
682ff716e69471147f7a0e231efe86ac

SHA1
937de827ecedfb18ed3f399ac647f88f2579c6bb

SHA256
11e566a5d7934e7f13ddb561000aafff386430a3df22a36424f2101e9ba76662

SHA512
4fffcccf9a78aed772e46ff48f817d586934c8d46434535d25b080c4fa264e018e6c2fe389d8d42b1f3b911e402abbf00affd9b890b77ae68d7074a31ee3e93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e

Filesize
72KB

MD5
0c24bfb73d5151493376eb1d19031fab

SHA1
a899206d003d703cff22f20464588743d2b618bf

SHA256
3244024bcd81b9acbf69488de4d07f9d6df8ed070990ad1706bc4f510d63e64b

SHA512
b73528b77c5b60a97f79ecd9debc1d49693dd7ab4e1df756afa5c3c455a83bfb2a8686558c0962401594e3f69fe662b8e7830f9a546a3b917d4ee66903bbaa2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f

Filesize
67KB

MD5
42304c8cb0c1405dbb8722ff0851092e

SHA1
d29d977dbe442bee281abfef45d2fe727f4e2971

SHA256
852a971f5f8d70afb548e7010a25dca7c0e97d350bee2e8009e8063eeb80bb0c

SHA512
4c0caa6d7deefffa50ab323826df30a1de5f1393810c8adefae8e93667049ebe335193650f3f40b3af5c3e5a00dd01623c0d0d7d7c88830a6732f84644225b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082

Filesize
71KB

MD5
248a4d793a67c45da831f341c6e08d27

SHA1
93cbd3c8583207fc76c13a269c3aa2b50a290b26

SHA256
47af4a758c203809b381228465302f138a519c76490ff09322883f9fa7a8c5ac

SHA512
c73871c2f15bd0f9c0e2363611350bd9036411c75d0d9ad177640cacd001599139a549559681cdadd17a6dba9453e6e3c6f9b679822da1e30d06fd281000a5e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
797275f26e480f913e0a1e4aa7850684

SHA1
487e4fca262776b390c7365976b61526f725d23f

SHA256
a7d4fcb7e2cdd445deccfe82cb647acf1f540b95819102a2f81b9639b8ec6bf9

SHA512
6e86a62697e6012c1fd146aa41e4fa7dec41bd9d7b10af8ea12cb6977211c33566396cae09144daedc759ed33890c9a397718bcc025803a13e89153fb8cf5619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ab8d.TMP

Filesize
3KB

MD5
e151bd9223019e33c039a217c0a4c987

SHA1
538040ab0bf8ddd8eb6b5806a6704c9199f22159

SHA256
9feccec95bfbcb7c2baf1f61bc5b8384276457a35f4aa33406049102bda30f3f

SHA512
5bc28ffc8ff458da784f516a47bf42c854b5ab3801289972919ee4ed75dd3eea706e951b2fd98295fff247d4be2970b45b09bf4d02d8a0b7c7f4fbaa53fa931b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
a9d6f15a7554dfe9a00265c5b0bfd4db

SHA1
2dbea0db9491ed6072161e1d63b86bcdf65e299d

SHA256
b14611eb4ac735d60af8d25de51842120f5513a14c47fc8e626646387c0a7b4a

SHA512
cd106101da38c629c4da9c8ef15a019e1481af98eddb3f02ee153c3c16400ea005abc26819b1b3d017f051c6fceac41de95572439c8b3802e547d375697cae10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
b2b043d43f518a395ca75b2765245f97

SHA1
3986bc6ccd78dd8b192878ba9c7dedf02f1cb92c

SHA256
3fdb5d8541b1da877912fef027f156743b3dd46d7d784eda99c99fcdbfb74d89

SHA512
06e5dfdaf1818c3ce763c8aae078bac458780d60e3169d8dd26d6b3842c695eff33d3f79bbaa998adb5afea618a403ff032943eea46e762ef07f878ff3d2b82c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
60975c4a1d52f0626c0eb9a5e2e1f9ff

SHA1
5bdf1129d9ab6a69fcd953d8a3374367e653a9d4

SHA256
75d58a60f1ba2bd17df6a3b13ce1bcc55b12d6984ba2c969647d7a393abc7977

SHA512
ed6dbc548192d40df0523c8df6f217be3db38dd5fb38aff0e82faa6affe248f8f7ca3cbafeca4c2117d71d911678f03a6c983aeaef72de130a40ce71ffaee194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
726406952d11f30e861eb28b16a50585

SHA1
814a626bbd3e6d15cd039a79e53ff2dc2efdae6a

SHA256
c6c78292ca37fe2b9bdff61cb899610a9ac8dd5e70992c785bbde27c40581471

SHA512
78a79b173cdd69c228a2174f8e96caac860f9702ad9ecceafc24578faefa4ff2cc1612aec2deddfa502b67b6400c67ee2defcf4e33ad5bcc7af224223890e06e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
056b94a75a3cd52dae96eb0a63bd4aa4

SHA1
a77ea551ce2e41440fddf97aea20eaa9357a8893

SHA256
23791fcd2689e924189374b9c51c4c5a9d4b231657492b692674b39f23901bb7

SHA512
4ee9ee4381b7d891e858483dc2a7ba7e60ebe49800192c0b2e4a8087e267177e704e0ce9c346ba83cbc704b2ab5a38166c5e2b10d03dfa43f73b17ef1db250b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
e1d9977a542a28d9f37bca3d3d5dcc3f

SHA1
1858733893aaac869ae11ec8da3fafddde875919

SHA256
6969ddfe40b47d0ca91258aee12887841cd7304e8526fac58f03b1eefb06f79c

SHA512
1952f14639cba37593698b8a9ca94d1f3acda657626420adb69609348bc5360ec8dedd451da834a0a9271b4d2e9b4a0e85ba9b34c3c3a3e0b3650a0eac3f4fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
c459e933c9fd49abf550caba7d0923f6

SHA1
84509b4bfd2a942d1871f406fd581bdbfaafcac3

SHA256
963ce46a517409feae76f738eb8c667faeb9a3a987b1fbf24e93851779434b16

SHA512
6ddc6642c46e7b368092c702830b63d311fa2cfd8694c08c8dac9277bc6b8ce1a4ce0854fc8b9d61867e816b900570414ddbbc0e49ddfce6346f188f55fe3609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5f443aa7-7e74-4dea-bd9c-a46f8d5abd1a\index-dir\the-real-index

Filesize
72B

MD5
3b6e873c30bd20b8ceb1b2edb1fd651f

SHA1
f7b8ef8cc16b07b6ae710a2c2e65182b2ada8206

SHA256
b122af57efff85dffb9fbf69c88eaca534d33af9286057b71a62b96403334e18

SHA512
ff7cc3ad785a6376af548b687f7b646557897b7274dd0ed20ffd3a027d7cfb0d24586a80bd9aad65045917af516a9410a07dc4ac1568a281240657655de98a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5f443aa7-7e74-4dea-bd9c-a46f8d5abd1a\index-dir\the-real-index

Filesize
72B

MD5
e1741fe8cd4474f581eb5d94099135a4

SHA1
bfd9aa240360ce491f431f1db04d4d603b1fc81a

SHA256
bfd73f0133ac7d13e2a5c1540458170e7a6537cedda79b77d85ee455d4fc8355

SHA512
95ae7e017186c803eff54c769ed2c9169b18719248bcda72cde7b635455eb2230b866061f927462e3c3ef652c321fa59e7be1c1ec7c3eb3cfb36242d175eb62f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\82addf26-e437-4cf1-9d29-1a07c62eea57\index-dir\the-real-index

Filesize
2KB

MD5
427dfceed9baa0655f645eb03999414c

SHA1
aa6c936fd40901586bd221506d883df4b07cf210

SHA256
3584edf39c7bfcd1cf4d3e96ac34855746d431c642e77e1511b22b8c7a88f115

SHA512
f5b0250c437134b25b8f46cebc5988aad5dc304c6a2ac5b2e56540ffa4d300ae1b8623a9dee3fec5887505855baac21607dbb3d4aae853a8c8999d90e90879e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\82addf26-e437-4cf1-9d29-1a07c62eea57\index-dir\the-real-index

Filesize
2KB

MD5
e3cb06082008678545f7aa78e648dea7

SHA1
425bd64196aa8a1d05b4651f15fb04118ed3f11d

SHA256
9e5bd322979f510dd2c87e65c5c8a480ca478c16c34b82e4b1350e89beb55d07

SHA512
df787efdf7bf7db0b33aab92bb04ab4a2c37cac6a65bb7fe2c6aeddb85fc743e0f95191c3e57d5317330634aa653c6b87ff326fc6cf7e47d8e4c118bfc5c62e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\82addf26-e437-4cf1-9d29-1a07c62eea57\index-dir\the-real-index~RFe582bbe.TMP

Filesize
2KB

MD5
0fda4f61b81f38d07e53de372adb688d

SHA1
27b3618a9390ed46031509cb9df2d208e6d9d1b5

SHA256
897103ac1d2c2bd342c50cdc3768696fe70bf149c578ec6cf1c70adadaa5f3d4

SHA512
55e9567a2fbae20aefcf153204277643fb6db6b91ff598d9072f04af9ae87d4323e1d38cfca2c58114658defe63330c7c27adb63682aaf9a0f0350fb6307781b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp

Filesize
253B

MD5
0ead3d533075a06674deea4f551fb03d

SHA1
1c97520e430155a535873f667af788db8a495dff

SHA256
4fa9c85c1ffa0cc32c0a37c64627c49ab361f836d01f2da4a8277028f7f15886

SHA512
1e71d8be11ef8c4aa7bcbd97de182425eec55a10c921a79dd07ce58e0452fa14d6c04eb06dd9e7477137e74bd88d868bc532bea73b78e1ac653cfebd67dab953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c207773327304ef533298330b614382e

SHA1
90390da1207f6d3ab197f823b53dc586750f25bc

SHA256
bb3d3b2d440dedbe38d851151a4ff5247f327e7b24ca11c48d9186d50b104e14

SHA512
60a36facb102afe5a4eea5a9bcb32b5ac2f4e671c8388b6f402f68f3c61890df15781b1f5e21f59b5903a2dfc3e452909d6fc372db89b34a79206289809061af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588122.TMP

Filesize
48B

MD5
27195718c354c95f1187a60d3d10ecb8

SHA1
f4b380e12c7ad25e800fe5bcfeb09de0a3f26fb3

SHA256
029bd0ead2eb3c7b40b3271d169d376a7ab973f371f9535f0000c8852e45ed17

SHA512
6543dfce917a8344fb5b999d4c067acc30e32022464c966ee9a0b492685ed6aceea78728ed412459af69902c6fe7874de8769f9cbd7dc65a12e57352a4c8ab64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
f8e7f073933be6cdb2252c2d43f648a8

SHA1
a600b291ce103cc61e6bfc754b27280e17f71ca5

SHA256
ced96650b07dd7d8fb61eb674050fc616fff454651b2837efc1426dce274c752

SHA512
8a8165526847bb40d5ea0883f432b596417d1d1e4a4a9727fdd1f8a99d2d8bce5a4510d32013dc846a88d669cfc87ed3990cf5a1a90c42a91465aad39d1a32ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\238aa7ea-e89f-4815-82f3-06a309b53d06.tmp

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
d85ea560caea523c77dec4dc6a88be60

SHA1
4c6287fd06ea720e54a771bee551a1de74587e98

SHA256
07f4dc2e450fc7b74ea9c4a15bfe6b388de509a3adb091ae73acef3df60ac7c5

SHA512
ccaacc992e9eddf3808aef6ed7ffe285f99392beb4eaf3bb1e80a8c6a9cfacfa3b17ad6386f4e68ebe3dfa80280dfc85676e6c0d3f04d1f7550beaf5f265496c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
82380564b00cec2b6a6977907c9e9ede

SHA1
6a7055963fd61bcbc565dd87d3cf15014c3de0ac

SHA256
0b7eb7645557e5f0a33517893bc0f18e3e4455db4a39374dfd8e6f4fffd1b11e

SHA512
0d6bbf19d59dd57651f397ce9a56353249c9c227bd1539304cda346ba286ae4d22336dcad56550ebabd105b7075817cbc8415e83b4d53ad695abafc695bc5baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
6f4d5c7fc1f05277b9d97ccb30e8c92a

SHA1
8db4b5ff64c436a633e272e5aa532aa62562a308

SHA256
1e2d725cd7e1eddfb7dab765d4fb06aa382260a864ddffb7336545d5782d9944

SHA512
16f0de753f02c3d4104f64bce64bf0fef1c0a09565dbadc4f48917fc326a32e2e2d70aaf6f624311b59776fc329aa679bdb9671084f847c3e200543d52379153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.31.0\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
0e3ea2aa2bc4484c8aebb7e348d8e680

SHA1
55f802e1a00a6988236882ae02f455648ab54114

SHA256
25ffb085e470aa7214bf40777794de05bf2bb53254244a4c3a3025f40ce4cef7

SHA512
45b31d42be032766f5c275568723a170bb6bbf522f123a5fdc47e0c6f76933d2d3e14487668e772488847096c5e6a1f33920f1ee97bc586319a9005bacd65428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
671b4105c922e0a30dae70e8980de222

SHA1
e641481c70468824d93e064a48bd503eb7879501

SHA256
98aa09ade8ab37eba9534de3fc4336071c13fe8eba308d17a3d786ee18125bef

SHA512
2302fbad0ef680d188caf322365bb2fb9053eb85a85fa21843c6dbc145faff7cbb9c8883ddd7ed2e61c85a99a3a96a165d70c8c7394219fa78ad7d2fbf6cb11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
433611ca7b1067be9c059aa38ee0a56f

SHA1
12c542fc0d84da8b0db50d6b07bf0b8c8174a46c

SHA256
ab97f1ff3e56aac8983c5a6d754e8ade9fdacd41a77c959677db94ecf15dea06

SHA512
d1fede0a6380d13089c00e6dae1a9d3545198947838ec458af0a90b6b01247c24cb754b3b1e79140d4cebea83f6640a6b3dd323f6e3715d429e638d8ddd07a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
c430a373945aaa461aa99d5d03d7a2b9

SHA1
ae7140d28fd6aa42a9eb34c741d79dece6986c86

SHA256
5750583df3aa41ccc0374982175b1335bcbbfaad500385b88f0bdaf4f1131452

SHA512
ebbd724476eb4aa2fad58f5572cf3aa861e5124e59e9db134bdf3fae84b0be7fd6703f1de90e3a349b1dafffa148c03e344602377e6272d5f2ef7bfdad082ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
dee4e63a6fa8a44db5d12959eb9c5694

SHA1
bc0ea1ee021482a8212e8b8654618b4c889371cb

SHA256
bb4b12a1bbd2e2bdab22be48ed2e0225ee131da234a6fc9204a34cec9a37e8d7

SHA512
8dbbf0b9b2ae5f3e567da8d0b251b59cbf73da11ade250e1ca38262a0f8031bb78aa07b7d1a1d416e3167880ca1cae7c92c9f6ca2d94eb013ca8a569f6b2d657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
48f9d13a95aed7522a17466895a28c3b

SHA1
3875d630bd1605e159852f5545e83b9eb03932bd

SHA256
ed9a5420b8d03aa6d60e50f6b3bd944daaa43f7b0da7ea0794f44a72ef4246ee

SHA512
925760371f5e4137cb78868be21bd7a203d301239dc67ea0f8d0c5a0547ac397de15d38a7fc892ca975c6e336f7bdee0be3b9c8cf45c4d5cdfc88dda94599fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
392b83b140da95218a50f79ab287ef6b

SHA1
0b0f3fd719b2aa0606bda262e9cd68b406a2ca3e

SHA256
c0f2253236066c88d6b7809aba902ebeeeb9d691abb84a23ed20bf22ad3d9d0b

SHA512
9928cd689a933ee1dfe3a0ced236ff2bcf939b4a7b9922b5b6b285aa1f7214db41c26028e31a7ed26287284a0fc6daf7b1da1e910624b1ab898cc118c17ec30a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.31.1\typosquatting_list.pb

Filesize
628KB

MD5
c900ffe1b28b9a4314051c8511e6877b

SHA1
72a51a35e83ea5b3258a820b0a2b51e49e06a17f

SHA256
cfb1eb35033af3f46053a42f4fbf4756e7e64fb6fd2b66a14ba9e5215262421d

SHA512
b9598a8fe3d9d3ce2f614b3a5074d60edf3c96b5b4139325c33fe08f05e395934b1c14704cf3e51eb8bf9a4e4d1a54f9144710b18fcde0d5d763a31c27c3d598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zr0euw58.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
5338c07df173fb031466abde8c0f6f06

SHA1
f5b22f3743a78c598240bf3d29b754aaeb452e01

SHA256
be12b198b639d03a3fcd61c8ce7d7b6ef04cb1c4aafa36d2f6287caaea8c89d9

SHA512
338d83f73e4859a07b6cd8952c878341cebce406a01f0e2e515cad175540a1545331f9d8791ad577cdb72da3d1f7e771090f44cd8cdb05f2960bf5228cf69631

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zr0euw58.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
ea6d854b9af14b04fa8d604286b353ae

SHA1
d8c7754be5062ddea4b4982c9c8f93fa810a2b7a

SHA256
0abec0e99851f18dc825cf8352b6469beca592f69791899a414853740aaa521a

SHA512
c5f0042dfe7adf27530f6e9d98aecbcd7304841b7ae65bb1adb9ea92e40bb776b33e827d4c1284cfcbc117d46dba3be3ed09980778985e9056a4c4d996ea1479

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
f89a0dd4ee4929eb62b12c3abed24775

SHA1
1eea9d8c1aa2d753ba7fd3fdbf06cd2df3e69ae6

SHA256
3163a399cd9c4930c1440dd87c314a2644c10b772a0172035c61da7570337f67

SHA512
2f130544997993d5269246a5f443649aaebc0ecdf727e469a394255858b265bcec6368caeed64f3b1355046f3e1fa996013c558c4c2f732d953317604ead7fc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\AlternateServices.bin

Filesize
7KB

MD5
83cc8dca427bfabc982412963438ae06

SHA1
0e578c453f4a28e700c05db752a45c40e3afe28b

SHA256
28c288b2d91a3dfd3749e72b524dfacbce4fb68631fb1d4873d9e1b9014018e8

SHA512
93bd86ee410d2cf53a0c2acb21657a7428cf412b584c86c72473637adce15cb94951725763762a1958e86058a99b42b25de429111786433a10343911e26dd73c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f362d63a2532088ae4940b4a5df5a8dd

SHA1
ec1c56cc74399920fc6f48ddffe7fd2e70ff87e5

SHA256
4ea51e58bf0304287bc7578c4f9a4174bd81109ba56d9e6a1673d6d3b8a9cacd

SHA512
418662a6a69f8a73377f1906ae09328d0bbc54d3e13843dbd9206423062b903b143204e7621d177fbb709993b1c6ce74241ef0aed7217d7faec3ac3227cb22ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
311e803af4c71b2e77661fa76098af16

SHA1
5ffbedfca1504f844f714fa9a1053ce1d9bf57cc

SHA256
464bfd19ba967b7e62ac05d925a7fb7071996eedb2a13f9a28abf9ce25ff7a2f

SHA512
d56c775dd66ae70b9a537cc63d5da49409cc23b3a4c076ac2ce6d1f35a833531d389f809905fd7bbccba93f16031b7d72b000b8eb01705183adb1a6c92132184

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
1516a9baa6c59dc766430a0a3308d075

SHA1
531e3b1d7dfccfd146a320e992da5cdc424782e7

SHA256
9fa17258302b579f5eee11047857eb289b8aa4f5672a8a832f026f41e9085bf9

SHA512
90435f6915d33a67f155f07ba0f0a6f6b839a59c049d06d8010e0da48bde8adf38188282936d04c4a13d6ee1ec86c9fcd3f7bdde6fcf6c06617485735d36342f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\events\events

Filesize
5KB

MD5
d2574aba94720a7b47962150fc68f3a0

SHA1
0062b95affb845bf9eb67b4a54eea593d8b5f3d9

SHA256
8a702fa87aa3b3725db6eea776b47490a1ea8908a785834fb9194d5a7a2163f2

SHA512
0c90ce35271f34c335c55c75487a6223c15316199ee13d91aaba418c03fdfc6e101911f2a0155e5766039e619553d6ff34f02832e5675e7a9948d084afd289b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\pending_pings\19f3b732-121a-4b00-9dad-60a5a10ae6e0

Filesize
235B

MD5
3e84df6911a9e7a5eb8d8aa9393aad65

SHA1
8334259e5caeed101629b4dbdf16ae0e51197974

SHA256
05f8829880eeee1c4035ff23d438f759a13e982b63aacc0b4a917136d240d847

SHA512
93b0ce95c2899ffa9e1208be96c9c92e0074bbdd1c1e5a3b10e4009b4d02bf13df6e194918f99a4555714424de369abe2572df3c47eab698e1493dd4af132ea3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\pending_pings\47bad358-793f-4eb3-9f15-dd15a91f85fa

Filesize
16KB

MD5
7d1b27d16a6be68ff901ceab01ba7c25

SHA1
ecb89f517a63b6c4a9d7c72111a06b4033715da5

SHA256
16c0aa124f47070ad65c348b6afd2efafbcc29af309ee9b8ef3c691038f39f3a

SHA512
3ad63e410fee14272c28db25c37e0a427bd7e0b7402a2c33954696bf8849a3f2662b3ab63ffcb5e64b8d88064535cdd2d975217cd3f3d588f79733d9148c9803

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\pending_pings\5a32b9d9-9403-4f7d-be59-6651ed0af976

Filesize
2KB

MD5
86ff00314a0137ee7e83336a42148483

SHA1
d212d0bb0fd438ccf6d72582cf5fb7bca0d6e84c

SHA256
040ac82489780408851f33c721d828b371ddcf39dd2c4c6ed42ef3aec0d4dd9f

SHA512
97cd731e9627b29be6b13e91a5a1ba5d4b46c25aeede757ca3aff2ab25b5a34e2818bec64808467673dcc4e0c7e2e989bfebdaced6dd7d509fa280c8989b9d0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\pending_pings\82ea1cdd-4f83-4da4-84af-2ba408402a19

Filesize
883B

MD5
0a9dfb9c0be1a4523ceb90f3d4077e4a

SHA1
b64fcb2a817ca5d7f0f7c765104b49c641ccf7d4

SHA256
7211063dbe1bc82142b8e7de19f51a811c32b2a3ac70a4e3eaca9c14d004485b

SHA512
fc76d07f5a6c32c40c15b5d4e7348db2f84d59f01c10465f1e5777b1943ef6c66154c4f752b55a0889be019d1ce76da49e17054a795a09f16c0e11a1e86dacef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\pending_pings\a8c769b7-1e5e-4581-84d4-77fb09dd43c0

Filesize
235B

MD5
a4ff2c987b815c4892107982ab756a7a

SHA1
441034789527694b4fab3166b417f90a36dbc41a

SHA256
fc22e977a214ec2e297f70807ffc4f35fbbe953b6fc0b49e200ef2c22977c8c1

SHA512
452ef3364f2a897219ed0f2e4da952f4a0598ddcb6646c8adf7b22884eca1f03cc888d0cb2734ba2df26ae8f4d03489096fbab536bcd00642d06b2a027d037d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\datareporting\glean\pending_pings\abd0fcee-cf23-4ff5-8c75-b148a5fecd93

Filesize
886B

MD5
18932d81e1e422454d9a714d4f6a9574

SHA1
83eb6167064a3fb56900f56ad27accf3754b21bc

SHA256
68afbe3e2b26ef1962512e544762db760327da55a4e1a0a3601383bf9fbd6b43

SHA512
6f6f76d888f96861f6d2d9ed8feee5f2c66219e833f3d29b97ae678ad524ac3e2f90da3c7230164d8362aefa4457f35b867959dcecd13e2b6d04dd8bcd08498f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\extensions.json

Filesize
16KB

MD5
b6f83739b608cc4a35157b9ee936311b

SHA1
b0ce500dc4e28565c8c0de1bd88e78b0905e4bda

SHA256
016579992e49a46b52bbbc9670f85128a6b0e3d9783f64151586c74075ca60b0

SHA512
2ed5af5f255ad81bc84004f62e0e206161107b758cf1cffde20c8491b3890738cad34c0e1b56b4de0057dbb6f587f9d5c3ba1dfc655cfbf2a1e03e46439fc2b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\prefs-1.js

Filesize
8KB

MD5
63fd9f79c5d1c648782401b11756166e

SHA1
8917a77c469345964c34a49dd8856716eda87803

SHA256
73da30d762b11c3b7204f474744fd23fdf536465dc38a4fd3efa7c39a3143f74

SHA512
479e87e1fc06e32662e0a2220b42986990d97b62566d9ad0a5ef4b2f0921560d319cefe72d0cf925d8724d7b31c312e703237735fdd6a1657cb3957cb7ac8205

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\prefs.js

Filesize
6KB

MD5
f45b48af346231673a8996cc7081ec03

SHA1
e6d36a2a96e4dcc3da547f075c2897075615448e

SHA256
b98faf23454ddbe7b853cb9bfd152b1029aa5e1b49a2de7f56df60d0d437fe37

SHA512
27408964ad031e7b91b653715df1a9153973c0d6497264cc8cb4ef3f6946e4dd8a263a7245ef4e8ec18cf425d4c594fa8973639e5bd8b260c1c67f4e1bcab1f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\prefs.js

Filesize
6KB

MD5
6cf9ccc19384773b0003211e7b9b259e

SHA1
8610e3a4bebbbcc45ca5a2e7111d7e653c751365

SHA256
bf551905b170853116616004ca2f8e24a537df7415502c8cbfbccd23e5381e19

SHA512
3da8dab50c2a0ee144c7ef61295f17a77435a48146584184c7e57a8eaae8b1862ef9f69151295591f46ee68bbd7fc3784c0e88e40d186d8b115f8116a9a87c83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\prefs.js

Filesize
6KB

MD5
6ac7d78b23c56cef48cf0b8131495100

SHA1
6841aaef18834b6574a35b785ed3490ba1a8ef6c

SHA256
eb06270725564f068aaa6fa20ced23bce97d1e2b2cbabd1d73459ab016fcaa9f

SHA512
ac29865d1edf17b907b33adb01eba1fcc6ecd49f5d8aee3498ec2a5d5fef613e5829f46094f86f54756d93c64f14b0242c3f1d1157c213c51a9dfd4140586bfd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\prefs.js

Filesize
7KB

MD5
a2f56f27462fee04b1b6615c78d689c2

SHA1
7552764879aaa9b84d04cb8a80e30bf1ca98ed8e

SHA256
c747ec351a085b6b91aeec08c9073398fb5e02445aa72f8687ff4cea202f26ac

SHA512
43a1c069d4bcd720d6995794963d516a190acd66d14078dce9a6e9f28ef6b4304d94aad61c26f3cc0816b203f397791fede008667fead22f7203cb424e00864e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bf9e329d400afbaaf82ceffbaf1cba42

SHA1
07527a07f0cd2ec96e622cf1f23c99fc751765d4

SHA256
814163b66a157ae4e179f37db304e13bdb06a6f06e986a7b56ee38e26a03eebb

SHA512
6a96339a7abebf3797012f35294535fd55c8e8db703018f2995e6a3847c6b880f7e25862b3a9c2bcc24062126bfa43bf4e785fa99856b9839967864de38335c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.8MB

MD5
661301bc1db1235740d18c82490c5e41

SHA1
36a997cc48d8c13294adc0369c8bf3ed36ffebb7

SHA256
e1acc44f79f6011bd93690b779ab3ccaa4e97fa075a5f28964a6600c6c748054

SHA512
eb2649fd85fa962745f21f4b4dafccb8683924d3782969ce2754f148ba882a3c195599c6e5e5d84d3a3aaaa1f63155cf81995dd7a726837d29e9f33630a0dda2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zr0euw58.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.4MB

MD5
9ac06fabbb33d3bce55d95361fa4a09a

SHA1
95408e03ce2fa941400c983a67bd1beb3c1c25da

SHA256
6f9c932ce5a0e8bac9a91432a0539f361bd910345f05d3f62e00e5b05c2a63ea

SHA512
41231ade62c3818c0873f4d00b83c9bd96833974827ede48f4d8899f67a73eb208f3569e6350df9d528b95ee6f650451e8d98632175cf653d6612de3f2c2b4bd

Download Submit
C:\Users\Admin\Desktop\Launcherkks.pck

Filesize
374KB

MD5
629de0818f1ddcad721e870d8a211bdf

SHA1
d251a07f8be2abdd3f5f4032fd820f641f1b9750

SHA256
0d03c7c6335e06c45dd810fba6c52cdb9eafe02111da897696b83811bff0be92

SHA512
e0652bc32229e7cb4fe7f18a45c68d2a43c425982750ca64ba775e39a04cf0a373e231f9b8b7eaf6a281c8492342b6d720901139c970676f57324b38ed7ec7ae

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier

Filesize
583B

MD5
5c01d3810691b18c28bd5e399a452c22

SHA1
65579e9bd5b0b4f5655370497cc90223802c02a9

SHA256
9134dc67fb34c8b266f725c9f7a088783953406f0edac77e0915b3a5370c90f6

SHA512
61fd7bf2d2b4287c245d09e882c9837a214db8af96cd72e273410d6edeab3c0cd1bb488aa73d37c8000b719c73838cb1f1809f5fd83864ad844b34f2761767bb

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.zAvxIyE1.exe.part

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
C:\Users\Admin\Downloads\dmg93k5b1q.rar.crdownload

Filesize
17.3MB

MD5
b18017525805b6fea9e5115f0b0c71ce

SHA1
3f14138c59369a0e66ed16cfdefc06e39bb3f59f

SHA256
260f06f0c6c1544afcdd9a380a114489ebdd041b846b68703158e207b7c983d6

SHA512
28a8227a769d89ef6984a374e0498e5d771f37ef29bdacfc68da5f449a4c336fbbac16e5174aff06ecf60a0b29cf5ede4c5883f0f248e996b994ad1ecb1f5cc1

Download Submit
C:\Users\Admin\Downloads\dmg93k5b1q.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\winrar-x64-711.exe

Filesize
3.6MB

MD5
f033a919f2f6c705fc986ca56c502e8b

SHA1
b22fb6b92338f9a00777febfd91d689cdeb49a8c

SHA256
4e447dd3a885340845dd89e748a4cb566e19c4da7ae2939f9f26bda067623a25

SHA512
5de7e321f439540febcf2b4ec924f6f2b2d104c3532bf724e24929efc8973488279bb1a8ccedad03534878087495e1cb8af7d7bc0b50bf4f892b034a769ce557

Download Submit
C:\Users\Admin\Downloads\winrar-x64-711.exe:Zone.Identifier

Filesize
75B

MD5
cc0696988fb91d676adc27bf3949786d

SHA1
0561557bebafa161aff436b63f28e213b99d9c5a

SHA256
c95c0ffea82a8baa88cd2ef8b099ab37c1e78f64dcfaee17e22fa4ebda309e08

SHA512
a8316da6329998903726eb1bc4321f2e30458cc63cf1e2246623a44ce58a26ee7f84ce04c40651d36977ed38b55e12d426f86934b5a5340b7e4bfe1e5449e631

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_110642245\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_110642245\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1145132055\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1145132055\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1527379091\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1588175915\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1852508082\manifest.json

Filesize
118B

MD5
cd1d4274760a18d1f06020875ed4e124

SHA1
ea252982d53eee1c8836745044006608f0bc3da6

SHA256
5ea4457e970f9096c4a5b204324e33cd6dd51aba345ee3d0e9da0a4220409c27

SHA512
aaff1c564bb6e949e272c7df4a64f775e369c8a49511297992892e15092be6f83ce84a28afd6360dd6d76c9a503d452bcd8904f947c975b32e7f695a6818bfbc

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467166918\manifest.json

Filesize
145B

MD5
465cc76a28cc5543a0d845a8e8dd58fa

SHA1
adbe272f254fd8b218fcc7c8da716072ea29d8ba

SHA256
e75fb1fa1692e9720166872afe6d015e4f99d4e8725463e950889a55c4c35bb9

SHA512
a00286cd50d908883a48f675d6291881ad8809dcae5aca55d5d581e6d93a66058e1fe9e626852bf16e5bb0c693a088a69d9876ccac288181b1f74254bf1da1a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_942101036\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit