Resubmissions
02/08/2026, 13:54
260802-q7ybdatgra102/08/2026, 13:45
260802-q2d1jstfph802/08/2026, 13:38
260802-qxe22sbk8t7Analysis
- user interaction
yes - max time kernel
336s - max time network
363s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/08/2026, 13:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1531272736918343711/1533468675435397392/Carbon-v100.rar?ex=6a70997e&is=6a6f47fe&hm=f408f7f31df4863643cbce7efc6eae8246d3c34cfb12aa1ba062c112271811a3&
Resource
win11-20260513-en
General
- Target https://cdn.discordapp.com/attachments/1531272736918343711/1533468675435397392/Carbon-v100.rar?ex=6a70997e&is=6a6f47fe&hm=f408f7f31df4863643cbce7efc6eae8246d3c34cfb12aa1ba062c112271811a3&
- Sample260802-q2d1jstfph
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 1 IoCs
pid Process 1392 Carbon.exe - Loads dropped DLL 5 IoCs
pid Process 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Carbon.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Carbon.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4232 msedge.exe - Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Winword.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Winword.exe - Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Winword.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301519166682703" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8527" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe1100000033676e3d36e3dc010a81ab378522dd01b4d5d8d98522dd0114000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f80cb859f6720028040b29b5540cc05aab60000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5432" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134231911104219472" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{9576B938-11B2-4935-B48E-F41F94F9BAB5} msedge.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400540010001000ffffffff2110ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "12" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{22F12EF6-0020-4810-86AD-3ABE366A9E9F} explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8b = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668} explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea070500420068006700790062006200780020007600660020007000790062006600760061007400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000066c6aa8638e3dc0124abca3839e3dc01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070500420061007200510065007600690072000a00410062006700200066007600740061007200710020007600610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000062569ea736e3dc01000000000000000000000000420061007200510065007600690072000a0041006200670020006600760074006100720071002000760061000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\SniffedFolderType = "Downloads" explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}" explorer.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Carbon-v100.rar:Zone.Identifier msedge.exe - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 4772 Winword.exe 4772 Winword.exe 2468 explorer.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1128 msedge.exe 1128 msedge.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 1392 Carbon.exe 2468 explorer.exe 2468 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 496 OpenWith.exe 2468 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 1876 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeRestorePrivilege 3240 7zG.exe Token: 35 3240 7zG.exe Token: SeSecurityPrivilege 3240 7zG.exe Token: SeSecurityPrivilege 3240 7zG.exe Token: SeDebugPrivilege 1392 Carbon.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 3240 7zG.exe 4020 sihost.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 4904 msedge.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe - Suspicious use of SetWindowsHookEx 25 IoCs
pid Process 908 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 496 OpenWith.exe 4772 Winword.exe 4772 Winword.exe 4772 Winword.exe 4772 Winword.exe 4772 Winword.exe 4772 Winword.exe 4772 Winword.exe 4772 Winword.exe 2468 explorer.exe 224 SearchHost.exe 4964 StartMenuExperienceHost.exe 2468 explorer.exe 2468 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4796 4904 msedge.exe 80 PID 4904 wrote to memory of 4232 4904 msedge.exe 81 PID 4904 wrote to memory of 660 4904 msedge.exe 82 PID 4904 wrote to memory of 660 4904 msedge.exe 82 PID 4904 wrote to memory of 660 4904 msedge.exe 82 PID 4904 wrote to memory of 2556 4904 msedge.exe 83 PID 4904 wrote to memory of 2556 4904 msedge.exe 83 PID 4904 wrote to memory of 2112 4904 msedge.exe 85 PID 4904 wrote to memory of 2112 4904 msedge.exe 85 PID 4904 wrote to memory of 2112 4904 msedge.exe 85 PID 4904 wrote to memory of 2052 4904 msedge.exe 86 PID 4904 wrote to memory of 2052 4904 msedge.exe 86 PID 4904 wrote to memory of 2052 4904 msedge.exe 86 PID 4904 wrote to memory of 4156 4904 msedge.exe 87 PID 4904 wrote to memory of 4156 4904 msedge.exe 87 PID 4904 wrote to memory of 4156 4904 msedge.exe 87 PID 4904 wrote to memory of 1972 4904 msedge.exe 88 PID 4904 wrote to memory of 1972 4904 msedge.exe 88 PID 4904 wrote to memory of 1972 4904 msedge.exe 88 PID 4904 wrote to memory of 3448 4904 msedge.exe 89 PID 4904 wrote to memory of 3448 4904 msedge.exe 89 PID 4904 wrote to memory of 3448 4904 msedge.exe 89 PID 4904 wrote to memory of 4196 4904 msedge.exe 90 PID 4904 wrote to memory of 4196 4904 msedge.exe 90 PID 4904 wrote to memory of 4196 4904 msedge.exe 90 PID 4904 wrote to memory of 1792 4904 msedge.exe 92 PID 4904 wrote to memory of 1692 4904 msedge.exe 93 PID 4904 wrote to memory of 1792 4904 msedge.exe 92 PID 4904 wrote to memory of 1692 4904 msedge.exe 93 PID 4904 wrote to memory of 1360 4904 msedge.exe 94 PID 4904 wrote to memory of 3872 4904 msedge.exe 95 PID 4904 wrote to memory of 1360 4904 msedge.exe 94 PID 4904 wrote to memory of 3872 4904 msedge.exe 95 PID 4904 wrote to memory of 3872 4904 msedge.exe 95 PID 4904 wrote to memory of 1788 4904 msedge.exe 96 PID 4904 wrote to memory of 1144 4904 msedge.exe 99 PID 4904 wrote to memory of 4228 4904 msedge.exe 100 PID 4228 wrote to memory of 5000 4228 msedge.exe 101 PID 4904 wrote to memory of 4020 4904 msedge.exe 105 PID 4904 wrote to memory of 4944 4904 msedge.exe 106 PID 4904 wrote to memory of 1868 4904 msedge.exe 107 PID 4904 wrote to memory of 2324 4904 msedge.exe 108 PID 4904 wrote to memory of 2324 4904 msedge.exe 108 PID 4904 wrote to memory of 1128 4904 msedge.exe 110 PID 496 wrote to memory of 4772 496 OpenWith.exe 113 PID 4904 wrote to memory of 1828 4904 msedge.exe 117 PID 4904 wrote to memory of 1828 4904 msedge.exe 117 PID 4904 wrote to memory of 3980 4904 msedge.exe 118 PID 4904 wrote to memory of 3980 4904 msedge.exe 118 PID 4904 wrote to memory of 3996 4904 msedge.exe 119 PID 4904 wrote to memory of 3996 4904 msedge.exe 119 PID 1392 wrote to memory of 1876 1392 Carbon.exe 121 PID 1876 wrote to memory of 2244 1876 msedgewebview2.exe 122 PID 1876 wrote to memory of 4332 1876 msedgewebview2.exe 123 PID 1876 wrote to memory of 4332 1876 msedgewebview2.exe 123 PID 1876 wrote to memory of 4332 1876 msedgewebview2.exe 123 PID 1876 wrote to memory of 2080 1876 msedgewebview2.exe 124 PID 1876 wrote to memory of 3004 1876 msedgewebview2.exe 125 PID 1876 wrote to memory of 3004 1876 msedgewebview2.exe 125 PID 1876 wrote to memory of 3484 1876 msedgewebview2.exe 126 PID 1876 wrote to memory of 3484 1876 msedgewebview2.exe 126 PID 1876 wrote to memory of 3484 1876 msedgewebview2.exe 126 PID 4904 wrote to memory of 3980 4904 msedge.exe 127 PID 4904 wrote to memory of 3980 4904 msedge.exe 127 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1531272736918343711/1533468675435397392/Carbon-v100.rar?ex=6a70997e&is=6a6f47fe&hm=f408f7f31df4863643cbce7efc6eae8246d3c34cfb12aa1ba062c112271811a3&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe5ec1c188,0x7ffe5ec1c194,0x7ffe5ec1c1a02⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,375030713228511748,7975317745278634213,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:112⤵
- System Time Discovery
PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,284068177392607868,3595766886120201540,262144 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,239016316712800803,11525973230688507655,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:132⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6142146468457750103,5823785745628933449,2097152 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,17444453519359868216,15300318869403196393,2097152 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,4475395322075236284,3046421738043433075,2097152 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4256,i,12308971546911932856,2960584805067997650,2097152 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:12⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4392,i,7817033214017008037,17975890829308523177,2097152 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:92⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,15214037008693403368,8586738997206835946,2097152 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:92⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,8423424245534744673,3368966452667934909,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:142⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6066027013102019264,10188330328066709706,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:142⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,18020973362659583396,1189964544285242595,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:142⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5852,i,1237488073496105150,15445380427196716862,2097152 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,3280739127021327691,16457227053241037041,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:142⤵
- NTFS ADS
PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,11271852247652935766,11617835300138884238,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:142⤵PID:424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,11271852247652935766,11617835300138884238,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:142⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,7354843699862870686,3173265798054145746,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11403⤵PID:5000
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,11580211411156391478,11317115923834124032,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:142⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,2812405016526241102,2717032243426492027,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:142⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,17974496469230116723,6024973456650945377,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:142⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,911639745140783088,17616474625208846314,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:142⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,1489928865275583225,16281513252511618573,262144 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,7488427028021620116,17700463227771291158,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:142⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,6043052335273308682,17456679003459385010,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:142⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,4438753530676220736,1694826182173502983,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:142⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1020,i,14917839018362356036,18423625427271753540,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:142⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,736457291653658695,577223050468577560,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:142⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,736457291653658695,577223050468577560,524288 --field-trial-handle=2176,i,15702749270091734057,8322794348799704917,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:142⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1808
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:908
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2588
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Carbon-v100\" -ad -an -ai#7zMap7153:84:7zEvent139941⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3240
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Program Files\Microsoft Office\root\Office16\Winword.exe"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\Carbon-v100\build\Intermediate\Integrity\vc145.pdb"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4772
-
-
C:\Users\Admin\Downloads\Carbon-v100\build\Carbon.exe"C:\Users\Admin\Downloads\Carbon-v100\build\Carbon.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1392.1272.176603236542115160682⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffe5ceeb078,0x7ffe5ceeb084,0x7ffe5ceeb0903⤵PID:2244
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,3815610479052073463,17909960353099081823,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:23⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,3815610479052073463,17909960353099081823,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:113⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2300,i,3815610479052073463,17909960353099081823,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:133⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3524,i,3815610479052073463,17909960353099081823,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13⤵PID:3484
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:4020 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2468 -
C:\Users\Admin\Downloads\Carbon-v100\build\Carbon.exe"C:\Users\Admin\Downloads\Carbon-v100\build\Carbon.exe"3⤵PID:3556
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3556.3380.103869363165907162664⤵PID:4728
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x1a0,0x7ffe5ceeb078,0x7ffe5ceeb084,0x7ffe5ceeb0905⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1784,i,13737902106419402671,9978282228724367060,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:25⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,13737902106419402671,9978282228724367060,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:115⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2084,i,13737902106419402671,9978282228724367060,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:135⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView" --webview-exe-name=Carbon.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,13737902106419402671,9978282228724367060,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:15⤵PID:4972
-
-
-
C:\Users\Admin\Downloads\Carbon-v100\build\bin\Carbon.exe"C:\Users\Admin\Downloads\Carbon-v100\build\bin\Carbon.exe"4⤵PID:328
-
-
C:\Users\Admin\Downloads\Carbon-v100\build\bin\Carbon.exe"C:\Users\Admin\Downloads\Carbon-v100\build\bin\Carbon.exe"4⤵PID:5308
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:224
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4964
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4488
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 bd2ca4f05448f1799936d3e21cb411cd6dca6bb734225b11db907d14b45fbee0
- MD5 52be8769e75713edafa29bb64be1b710
- SHA1 0907db7dd5951f9a9d3a10de5da700f1e817b363
- SHA512 fc4d14da80e6762f5661bb521e202625657a2e8315e1c17efc3f532014e020eaa906e5c272e1236c8afedcb82c2783a98759f7c215a25e45719d0bc8599fc4fd
- TLSH T135D02B7332190936C614B23B4082F56C1006C22F0046454C5E36F96C1A808F10CD1842
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 85d85ed99510c7d0b9f34255c2fbadb8ecaf3410f2e3f96b80885076f7174aea
- MD5 649965f43583ed233f9f1ac0b592ff55
- SHA1 bed218ef5d166d448a6786a60d9b57a64ddfa374
- SHA512 e67321785f819e0573ae0c9f9ff71627b3eead38698ffd5c5b04342d4f94eb0d07179b52d9eec02b8e3496cd1cdc4ecf9d8867635bdb9df98c30a898c3e902ea
- TLSH T155D0C0F633090D37C324713780C2E4582280C21B2086415C2D31EEBC1DF4CA30DF84C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 24cff498566043babd15e529c1055131d3324b2f3a04d4a7db8290fe6f7dfedd
- MD5 d025b39ff6fc9a10c54f34fe9c973610
- SHA1 b37ec0861c05ec9d75063f233cf8efd8b5361c2f
- SHA512 74f00ad88547eeb07da63e6a62350212b7cc512a740bea4e722480209cadc1d60aff846205258c8fcb569b707410efa95cb6af581c142e531eec86ec4cab7b21
- TLSH T17AD0C0F633091937C32472378081E4582380C11A2086425C2D31DEBC1DF4CA30DF84C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 a6288d6a3949519e2e83259d3fadbb628f23a6303d8d6ac8b7638a0408e4de45
- MD5 d4c92191bd5b77edde84f915931f8b47
- SHA1 18a1216a72840261c4185afb7b773d6279171af1
- SHA512 bbe0c7825fc56e103d75602dde8c47b8a2ec55d1605341f836ff401470b877ba6cf1b1fb9ff0bd07a7f02490ad58a822fa65eb9144d780fcfc265fa0134345c5
- TLSH T12CD0043371440417C404D13D1011D534010F55501051174C4411005C14D0C304471005
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 cbd9a503aef21189102351fea021dc6dc8fc15eed600b79c8e9455cb9b80002f
- MD5 eab48313976f705f695a6767b54d0602
- SHA1 1eaf101f12edfdc91837297b38d2710b965e38ce
- SHA512 8ad28d31a68a2c84c86c8116721ad36fe97f8965a213b6c4d06f1a9aebffc6409a05035d9c2b778b5123a9a98133f42f033e852d3617c1d40be1d361659a93a2
- TLSH T17FD0122332410539C41061371003B51C0406D21B4045414C9829856D2A548700D22442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5cfb5f.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Network\TransportSecurity
- Size 188B
- SHA256 c7385f11d5002325eed1d3318909dbb4ec2e04678f01763a00d69429e63ba364
- MD5 b155273701bd15e760beee9683ab2d32
- SHA1 7dbe7971bd4d8d027bdbb5efbdf890714f6af496
- SHA512 a12a3cc88c853d35a025cf1ad65a480732882583c4e77e9d933c471be67aa6a57709b36a0b61c60ec2c364ee4aee2b21e4da342b8a428e449070a6a02ce8ec50
- TLSH T13EC022A2C069F0335038062A18807E00BE36E234004068E8C2424A28E1500A69103023
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Network\edb24354-215c-41b6-b55e-14152119363a.tmp
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 95917152c0180d7e1d040505f16264e7fcf84092402319de8fee615390d91a0e
- MD5 6b4c4d2eaeb66751cc2642ef8667ccb1
- SHA1 783e05a61d6a396d6efd8695ff06a9e55b7920f8
- SHA512 cf95c16d7f96e2e2926be6a5081164e34d0b477bc4843ecbad6e4c7d3335210ea6f374fb45b5c1929d8069fa2df93e443d482574b2388d7692db2ceff487028a
- SSDEEP 96:stL05cOp+b9fffqAZ8i0vhE5ikmIm/7qx+WVHMSm+uecadQjw+g/OpKEB:stL02RfpZ8pa5yh/S+Wi8dNgpK8
- TLSH T168D197069E28A97B4CC7E21D7A35BB42D2FA202265D41E98EFFC851C09D66DD530B90B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 315dc895e5bb3fa1e239c1eaa9527fa27aba57b14f632e66e58a9d03c2473419
- MD5 9aa0e538f065e68364e34f61ca7d5d79
- SHA1 c576772db79806ad0ecce9297ef5d163751f0b22
- SHA512 2a3f325242bf8ca1fff966722fbcf5a2ba799dfc858770af4a1154f2c0446110674b56bd45da48332d7e5c3dc818913ae94d7b2a24bd290dc6fd9e2c202d8ec0
- SSDEEP 96:stL05cOpnkbDfffqAZ8i0vhE5Hkmlm/7qx+WVHMSm+uecadQjw+g/VvMEB:stL02UyfpZ8pa5fI/S+Wi8dNbvM8
- TLSH T13ED1A6069E28A97B4CC7E61DBE39FB42D2FA102271D40E58EFF8855C09D66DD530790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 e92c28ad4a702d8740f7b2d735ce2b081e137785b9995e973b248ebc86f5f886
- MD5 5b13654a709df38821e92c5e99c4c6b5
- SHA1 3c2236e0fb3ef6c412ada7df625e46eb9831c60e
- SHA512 7671f8564d617e381c3e0e88241ac11fe758fd94d52859721118a193ae5832247ca75dec75393e5047a18258c77a94e70cb795b07312952925fd82099e879952
- SSDEEP 96:stL05cOpnkbDfffqrZ8i0vhE5Hkmlm/7qx+WVHMSm+uecadQjw+g/p6KEB:stL02UyfmZ8pa5fI/S+Wi8dNv6K8
- TLSH T1D0E196069E28A93B4CC7E61DBA3AFB42D2FA102271D44E58EFF8855C09D66DD530790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Preferences~RFe5cfb30.TMP
- Size 6KB
- SHA256 c7b81856ba093fcecf7646b5b94230a617c1254af6f74a4caff35c36294545a7
- MD5 4fc96f72dec7fe7f00d6298307fa5cc3
- SHA1 cac509afe5f1bc27ff7f4857c1d69f78def3109e
- SHA512 e7839fb79fdc902dbea08cfd2edd93dd61a505c4bfd4bea6403842d61aba2d0521404082e5a0d22a94aa108c66d0ed432909fee6965696e5db4d965b54f2ab43
- SSDEEP 96:stL05cOp+b9fffVZ8i0vhE5ikmIm/7qx+WVHMSm+uecadQjw+gQqMEB:stL02RftZ8pa5yh/S+Wi8dNGqM8
- TLSH T12FD196025F6869774CC7E2197A39BB02D2FA203265D40E98EFFC855C09D66DD630B90B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State
- Size 1KB
- SHA256 31c1cdb4de17b5c465521bd1e26132cb1c07440c3ea7471dac6a56d008ada81a
- MD5 d1d3f699a6222a6d42b6e3cb5fde11b2
- SHA1 760bc6fc40692ca1057961f1c4db3bf68d1acba7
- SHA512 27844d43a73898c595ec425e49186479cd94617be54ff44dd3f14d1eec059610be2777f9cd31f6617bb6cc0f93ae6ed9cb52f86a480b1ea5b474b6e2e463a219
- TLSH T1CE31A973D4A06E3A9CC52701B1463BEF6D315076C1604D14A9ED0F6C05DB6DCAD39D2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State
- Size 17KB
- SHA256 876a4ced8146da89c2877fd0a2e7972b32c10fc252d3a3d8d277d9bfd57b8dc0
- MD5 6ae9af60be934be6b52836e6a0d2366c
- SHA1 cf898f502d973d3c346d54c42657fcd82d784a05
- SHA512 866ba77c9cfa7331ca88da705d4cc70d48e7a7fcdc704d62e90b1e14e416abcb9f6798a5f808a21936a464c0581f0eb24032313148e84ab72161cd7bd8d4c986
- SSDEEP 384:zW+aQikB+z/xvxjg/qhEINbkjDOLoSzukDzk9ze:F/UxvxjgC+PysPFe
- TLSH T124728D2F69687D2759F3E6057A1C0B8FEAF484B390C16E784DED1F0A069A3E81707D16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State
- Size 2KB
- SHA256 ceab48096f1b1a09af613370d571a95349d3b625bc41ff1be652ad5e280886d5
- MD5 8869cfc4489ce81f89f73baa53f574cd
- SHA1 5ff02cdb220d3fc49b3af943ac1942889884cbc2
- SHA512 cce0cf29332459c2bd80a668707db0aed0e1294b8c2f258f7a5c1ab2f3da659fa67d7bb512eb02f8c4c14707156b23d558ca6425e1093c93104d52661bb68caf
- TLSH T15B51A773A810AE3B8DD65B44B54A3F67E93150B6D5A11F60ADED0F2C01DB6EC2706C2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State
- Size 3KB
- SHA256 3d514d958c2ff0787fd7d8cbe7f0d2068ce088c414c341d207e579458738a948
- MD5 eda1276bb6776c80248a3619b1a86f14
- SHA1 934c425b698c148dae2102a9980ca6e26331a20a
- SHA512 0afd3e33847eef0c8143dc42a88c7e3fe52641813012f1b5747378f92e826a9718f0a15d1497f7821191643ecca6d819b7206766c26b090abe61467b0688a4c7
- TLSH T1DF71B537A964A92B4DE69A00B8863B1AB6715037D5D53FA8DDED0F1C01DB7DC2302C1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State
- Size 16KB
- SHA256 852ec80f73d22205be010a1dce3f2e61a796acba2b1706db388fa024f6df5e85
- MD5 89e90a476b5f74c064a10b184e9d777c
- SHA1 be29871cec0b8f2ea2b3a83e5961f3abf0ff59f5
- SHA512 598417f809229e60378c20d23a5c28a9952d96a6d52299c99ec7db25e20ec4e166ba8cc39d4bf6f753d5dcbf0847ab5a9450e2c352cc5bf47b7257cf3e439e6b
- SSDEEP 384:z6+aQikB+z/xvxjg/qhEpNbkjy5LZyj9zt:R/UxvxjgC++0tQFt
- TLSH T1AA729D2BA5787D2799F7A605790C078FEBB494B290C16EB84DED5F0D069B3E80306D06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State
- Size 17KB
- SHA256 6106074b9e7ff1eb3c10a9fc495d3c93235986cdf449785b11375e030de19443
- MD5 472ea92199ee084da0f550b438afcf65
- SHA1 6eb9fe4fe9927307b9e266698f408c8595be8f3f
- SHA512 9cd30c5105e3c420ffa8c74ec411c589b7525b4a0d8f1787961a449ce15e84c560c28f338cd764b4f094b149ea6d0df1639dc2acb2d64d774e19a6b2114a4764
- SSDEEP 384:zm+aQikB+z/xvxjg/qhEC3NbkjVhLoYzukDzk9ze:t/UxvxjgC+CgzsBFe
- TLSH T101728E2F65687D2759F3E605761C0B8FEAF484B390C16E784DED1F0A069A3E81707D06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State
- Size 16KB
- SHA256 d9672db12234724acf8a31aac4ed31c5a17e3ad057a44363c327b6d5281ce609
- MD5 3de5991b828da5cca92b6b2e30016815
- SHA1 b02b1e59a3037c93f1c334980268331c09cdbc7b
- SHA512 065ae60dcbe77d0c40f8fa6a85368a34539b7d6375aa49e419315a75c31657ef961a35ab5d3af0ea95ad7634035a8b22ca4f7f0fbf71da22981bc6fdb8d5f889
- SSDEEP 384:zA+aQikB+z/xvxjg/qhEE3NbkjzhLZTj9zt:j/UxvxjgC+EgVtvFt
- TLSH T1BF729D2BA5787D2799F7E605791C178FEBB494B390C26EB84DED1F09069B3E80306D06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Carbon\WebView2\EBWebView\Local State~RFe5cc3d4.TMP
- Size 1KB
- SHA256 a853b29de1ec1b4f82099539a5d62f19750b5a99077bdc2430222d074ae0b181
- MD5 7e6527ac6c09892e57d1715a918a2bfe
- SHA1 642f0d819518e7339b8ef8d5af0817212c7b339c
- SHA512 89e6646858db9ef515d08c9d0ee38b9993f1bd946b4f4ef4fad3a611420df98875abecc99f7cb00d10ca62b7349b0080984609aac61cd6efc592742f9b91d73f
- TLSH T13E219573C4A16D3A9C891A01B1427BDF2D209076C1640918E9DD0B28099BAECAE3AD2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Carbon.exe.log
- Size 1KB
- SHA256 ace00bd13383ad415244f220e08b210f1753641d6310dfde5e3418adfed56e3a
- MD5 1ba8777b61ea1d23104ae7e16159dba2
- SHA1 d2b0fbcb0cfe0e56db6bab74f4bb857d0e558e2e
- SHA512 671229748ab1ed3a1f147a4dcc3cd2934a49d9040a9b2bd5e207b8f0148e024ed961748807cdd61b6eacacf321a5ee00ca4e62cf44c1e9bad75a79b411a0d5cc
- TLSH T1812177702271B1D94D023F530C186AC427FF4749BAB4EE5CB599325EED2A0075B222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 88b16d3840dc1dc65205285943eab8668887984c4333d1f2b353b948b778ff2c
- MD5 42c96a13171d9e6ad6fe7993cbd5bb44
- SHA1 cb6a4734a53456b81ac15fea372389c35b8569ad
- SHA512 c611a3b3cf2043d2c5ff63619a7e27ff0ef29a0d5d7430320aa5964efbdcdffe8246ee821e2b68aabfd3578561207a1f6e8e32a92f2317dbd2c0c4863d10aed3
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
- TLSH T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
- MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
- SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
- SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
- TLSH T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
- MD5 7b136c46d44a9c4f8f42a3893196bfa2
- SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
- SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
- TLSH T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 7KB
- SHA256 b24b78c3c63896bdcc4fefbf25c9338a93095c080630c9b0b28b54cbd4f3b7e4
- MD5 7d8c08fbfec352b0201c0acde13dc9e3
- SHA1 6787868a47a5809a69dbd470b76c277372bbe4c5
- SHA512 55acfac5ad86b48645ec83fc9086d1dd2bad81fafd49a1a7802e799927ab140f3ce950d4c1c7d407b2e6bb9240b2100d3d27fbdcf7a0275b3d4f56760a805ca6
- SSDEEP 192:tjGdr0000000000000000000000000qq000YLO:tjGdr0000000000000000000000000qb
- TLSH T113E1268782D5CB9A9F06109F4DA4636D50B03B0AEBDCD608139CDDDD34CE4DBA8A5EA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 3KB
- SHA256 d00473a178922d52a228f2180d43ca44e2ca1b25b7eac3f07f793c79684fbf61
- MD5 a7e9e2663b1cf9fd867e7d547d99fa92
- SHA1 cf7f9f7b915d862763732e76acae8f91ef08dda0
- SHA512 015d768428999137656c82227914039564359b301c01d5537b3a878f214a778d62a00e2b53b6786d80a488395deff6caf0af49df25f7c5c1ba1320af78152bcf
- TLSH T19671C619015E0F43EF5F62B3ACF02D37F4328A859E435D6530A458776ACA7E5C2F041A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58990f.TMP
- Size 3KB
- SHA256 bc01bd3e8d66c48c5e991ed4237aeb912ab96dc6eb517993fb22a98245019a81
- MD5 4ae9d9f4ba090a8968c839d492b7ef82
- SHA1 a14d9e2c3916c77b6648a55faffe4e38e4432f1e
- SHA512 efbde347d82bc300a4f49d22e0700332c1cb611363e326a91c8249710605d8818198186cfe7ad74ce05c779154459410535e9b9403c298371357d798621be310
- TLSH T12071C519015E0F43EF5F62B3ACF01D37F4328A859E435D6530A454776ACA7E5C2F041A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 5ebe7e0ec8e6422ef0f28155fd92021aec4529ab7820d68de7ea4011af5b902f
- MD5 8af76c23c2c0c21e816306cbf472d20c
- SHA1 c5fb8088802a8d2ddea43025607d85bec13b4384
- SHA512 e73d0d2bd38d34d1252f87b17e4f68e3d4f38aa9faaa18bd97f9427748f6f761afd8f201f4559817058409432877e930c1bf12070043ee528a6d575f9b4afcae
- TLSH T134219EF3C3D5856EC90517F06A14AE2BCE2D0519426D3C2A89D4EF6BE7E3072E101A4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 4192d23406808c1dc3b823809b15f56fac89bf6b76207b4f22eae75df6d51716
- MD5 e2b1544c4b5de3198a04ba8de50196c5
- SHA1 b0d7f8905cfeaec72e83e4823a8011d885b4e133
- SHA512 5479294d01b86d25e71a3e5dc35d36ec7a03c6b358d4095f4ab9dda055683b81b69af0a0ee770c052760e18c22d515593185c50639a12de00ab6a8dc53b1ab0a
- SSDEEP 192:sxZhRtyM/jK1Ml8Mo1/fEsnAOIdpM/W6+WNGY0Y/X7+oIgrJ:sxZhdQ1/fEsnAfM/bG5y/9
- TLSH T1A842F801AA346977CCDBD20DF955BF53D6F91432A2900E58A9FCDA1C04E6AED2217C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 ddef62a91ac8f28e6e3986de04f97276ca766ce46a1b6b1dd0b26e180b23383f
- MD5 81718adaafe28ac518d3988b8a764994
- SHA1 66b3d823d01fba3ea9d8b4a0ecd74dd44a3c79ef
- SHA512 ba328e27729ba7796a778a1dcd8b56d264c5a5d924038f188ab2f255a444dda896f232ca1db1483dec21178d3d7a5ad275e4c0d4da81d0cb624847760a0e4ead
- SSDEEP 192:sxZhRtyM/jK1Ml8UQ/o1/fEs1hOIdpW/W6+WNGY0Y5Mr+oIg5jJ:sxZhdqw1/fEs1hfW/bG57/r
- TLSH T14952F701AA346977CCDBD20DF951BF53D6F91473A2900E58A9FCDA1C01E6AED221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 cd44e37dca1c8f8eea7b32f26dfac1b360e03f13b1dcac6a3defbc67d4ddfc58
- MD5 ecf2346d2a0687629b09af8be9987ae8
- SHA1 195c1c72cb40c891a257a4b0bd8d53f8d1c5e1f7
- SHA512 c13aa89e19f494c737ac230c364e346e0fba361603d8bb8739d0dda43fa686295aa7a6ab1344e6b29769604987c43f9a3141c975f237f7868f64a56015342c7f
- SSDEEP 192:sxZhRtyM/jK1Ml8UQ/H1/fEs1hOIdpW/W6+WNGY0Y5Mr+gIg5jJ:sxZhdqf1/fEs1hfW/bG57vr
- TLSH T16352F715AA346977CCDBD20DF951BF53D2F80473A6900E58A9FCDA1C01E6AED221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 31KB
- SHA256 70a81354b17b1e3713bd7793268be3fed8749aa6b70d14e01bb5d80218784948
- MD5 dff231f7fcf0b1c90fa33aa6ddcfb668
- SHA1 6b26b24f9eb2fa8dfdd31c342002bb2aa3204c1f
- SHA512 67660070d243d50329aad97f48163d3b5157297e46a0747619f4251b3f8b51191d15902adb4f4577b8ea816fad89691e7a8e5241d42122f1dc990c6ffbee7c3d
- SSDEEP 768:gxl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/djroc3:gxl1j83r2pmWRmeKQBCu1jaK3ALpCN/v
- TLSH T189E22B3B680CC77E4F844D9CEC26AF976ED801CBAA684D5447FA494C03C73EB552A49B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 4bf5b4c63514e3320a54c40aff29d51161dd1bc9cbc725e7e0b0457c930c0fc8
- MD5 07602322636447a3d2638cb19a669bb0
- SHA1 4656ba0547e95f12a892f9dde842ba955a3450c7
- SHA512 32c4de910d63b8a07abda9f2f29c5881bcdb47e940c4a77e6c1d41f87648eb7c9bec9aafc829b48163fd2616599085b28656cf6097ee37e031663aaf8d2c3129
- SSDEEP 24:KdYIfYfYMY9aYidYqYaY24YqYm+Y9IjYgY2KiYVhaY+Y21EYIYmSmY8MYF8YAYnY:KkUIHKtecXyw9I9Kmo43ydbIpKQ4Mv
- TLSH T135A1650231BB13813C3F650CE294975B1742B6637054AAAB3BB950718E6BE341DFD9EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2bd5ad41-935c-43f0-94ff-4b62a3319040.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 a3f42329cdd1ed74e5de7e8f4d25a0f9bc4821240cd8009fc934aaf155fa2b2a
- MD5 c5556f7cd6292f0badf05400e15f2031
- SHA1 cc43afd3116c9d2aa70061debde31f473d726dae
- SHA512 f088c15cabb3391a3f991872909582ed96f73fe998a4e45fe97b968cc6885527610d212ac93ede9e934039fa4ec1a0ff95e69105f445a823cac9a0df1865cb4a
- SSDEEP 192:uFy8NIUGQIBynDz5RkgQmiU15Lq4gX5zPr2POA7Z+4VISJrsgNtHwqbU8:r8NIUG+DlRpX1gX532POs+4V/Jr9H1U8
- TLSH T15D420A31A8649C375DE39295F4973613AFA8102BDA886F94D2EC6F1C05CB7AC130ED27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 e6aa2c0c20ea94ca2223e2f474d18342b7df180082592e66e345c05a2b531323
- MD5 982aeb6df710b024d2a8998ef2a521f7
- SHA1 83f7dd6cfad0a1054f32fa174c10704196992912
- SHA512 5195ee24010d675c2d07735bc26a3cdcf66ca31689a508a94cae2d2d633082cfd3d28347219e33b563a20f362a48b625e86f0c7f8bb9e0034bc1c932e609a64b
- SSDEEP 384:SiFp8N38TUNTUlIRCpDlRJX1gX532POs+4V/JrLH1nTKwBODNZOC6WV:ZFpiwgi7ayOsR1hLH1newBKZOXWV
- TLSH T1F6923B369868DC379DE79B89F55B32039FB84067D9846EA4E3DD6E1C018B2DC130BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 8308f1e1cb8b892fa8883a146f4f82026ca104b20bd4c3b0417581da8c38b135
- MD5 9114d8b27074a5e24a63c5873ad7ff0f
- SHA1 0cda3dd4f9d101af43ab1740b9c5f059909b9cbe
- SHA512 9024bd1b1538331d4ceb0cc8f6930f9328d72cd1d7d9e60b7ce589482e3561419c8a931edac07aef595d0686633f26c8ae6616ac86aedfbfd61987e3402d9af1
- SSDEEP 384:SiFp8NJ8TUNTUlIlC+DlRJX1gX532POs+4V/Jr5H1nTKwBODNZOC6WV:ZFp4wg17ayOsR1h5H1newBKZOXWV
- TLSH T16E924B329C68DC379DE79B89F55A32139FB440A7D9846EA4E3DD6E1C018B2DC130BD22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 26cb6f6e21edfebafd1c409df1838cae7741b597c4a6b6918924b7cb27704bc7
- MD5 a096862e778fa56b9aaa24745747d2d9
- SHA1 75884f3665084fc6ed72a0afa0db2c3ddd94ba59
- SHA512 28bd7fb3fc55851dd2eb276b19dc9dd37a21fcb59d6d6b83e5eb50ffac8a050205560b0bd53188e26cc22357822549a9c359e17537e1bf33a63584ef8aaf9adf
- SSDEEP 384:SiFL8N38TUNTUlIRCpDlRfX1gX532POs+4V/JrWH1nTKwBODNZOC6WV:ZFLiwgi5ayOsR1hWH1newBKZOXWV
- TLSH T13D924B769868DC379DE79B89F55B32039FB440A7D9846EA4E3DC6E1C018B2DC130BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 23KB
- SHA256 19833b3d9159f07ebbefe8c57455ccafee31b1650c42f71984986f7bbad627e9
- MD5 ccfba676b2b914ce5cdb6aa2cd9d3272
- SHA1 3e6f06922dd374323c190b0f70a43d793856caf9
- SHA512 d10034cee3bdff76f0e85013947a6c6fa7b38a28eafb9d4aabd76952e79ead814d467f7fbf2233abd6898276dd9ded1f3294fb5eeea2aa60d47efe7d7df471b0
- SSDEEP 384:SiFZZcIw8N38TUNTUlIRcpDlRfX1gX532POs+4V/JrWH1nTKwBODNZOC6WA:ZFxwiwg45ayOsR1hWH1newBKZOXWA
- TLSH T139B27D729C68D837ADE79B45F99A32039FF84077E9C46EA4E2DCAF1C009659C130BD25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 18KB
- SHA256 3a25dc29e00a124b6105487d80c418492bb0c7abf4b6272ddcde7e62fbcba5ae
- MD5 5e0ed8f948059d7344b24e037fdf1909
- SHA1 bcef08a74abb531e936edfde36ab3a6034f4e0df
- SHA512 77468c702ceaae57e17e24698f0df441dc33ef437874eda6ae794a4912ea060712157c2fc0573be647d92ff844e41dc0a6245e201705a976c2196ca994d9eb92
- SSDEEP 384:SiFp8NC8TUNTUlIlC+DlRJX1gX532POs+4V/JrLH1nTKwBODNZOC6WV:ZFphwg17ayOsR1hLH1newBKZOXWV
- TLSH T19A924B329868DC379DE79B89F55A32139FB440A7D9946EA4E3DD6E1C018B2DC130BD22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 e4c5b926e8c4ac06bc7ac3fc3917e6c14ba5d04aed0d7c2b61f4c51a28088545
- MD5 0f1df183b723ebf9980f2b1a8b152c31
- SHA1 8b9939f263a57980ec3cadf4a05daf8202244656
- SHA512 8e6d6e771bc9cf74747bbb5a0e38c4660037fa21cf6c2d43691be4ad2cab374286551787571519eec9c1fdaa2e351ed6f406391ce7bf3b67f8b2931bd91067ac
- SSDEEP 192:uFi8NIUYDQIBynDz5RkMQmiU15Lq4gX5zPr2POA7Z+4VISJrsLNtHwqbU8:t8NIU6+DlRJX1gX532POs+4V/JrwH1U8
- TLSH T103420931A8649C375DE39295F4973613AFB8102BDA886F94D2EC6F1C05CB7AC530AD27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 16KB
- SHA256 51981c8be34876b44287d1ff0c8272b8ee21f18f0fe79ccb72b3c4cfe2b5bf4b
- MD5 24090db72be29e711d81a6ff4740f976
- SHA1 726c1af09ea97ee55a22fb24978c665265da23d8
- SHA512 c53219c8eec7976ac5c96479062c588a5954dbd45ffa7259969b17363a3d52b5080da0d8e304f8dce36c4b2ec45320a328b33e0e1aa399bc7d6ee53c40a796e1
- SSDEEP 384:+8NIUC+DlRJX1gX532POs+4V/JrwH1nTKwBODNZOC6WV:+S7ayOsR1hwH1newBKZOXWV
- TLSH T1AE724C35AC389C375DD3A289F55732139FB85067E9882FA4D6ED6F1C01CA79C530AD22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 2f1d096694b4e98b1d0de125eb0e4a97f3e56c8f18ef98c2dbd1a354cdb2a084
- MD5 d0f5520ca646681189194e6a908421fa
- SHA1 9db4337c92789d35345b9d5b9665f4b860b5cf83
- SHA512 4198953482a9b2d683ee8d76067ab6dc3a3d123b5b96345d001bc7fba2bf251c8b8da0ca2edc6405054a1b0583d4ee7f58456f8e473a5528e9b0fe40d9307d99
- SSDEEP 192:6GNA6i5fQmiUyydeO7X5zPr2POA7Z+XajHMA7U6:6GNA62hJUO7X532POs+AHl7U6
- TLSH T1FB02D735B8686C778EE3AE55B58737235FA4103BE9946F80D6E81B1C008779C2306C37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 079f94b0fee5e33a30fcbdde6140c1ba30b516698492661c1a586aa745328420
- MD5 55ba9ddbda8a28fca8ec691c237e7294
- SHA1 1eff86cd077351550ebff1e50c59071c422a6005
- SHA512 c75272e3e78cc91130268506828a864bfe3dce0674a8f7f932872e989af0390edd17be10b8c343c21b7997a1b18a515349822df434ea2f57d4bf1d80ea5a90ae
- SSDEEP 192:nGNK6i5VQmiUy3eH7X5zPr2POA7Z+4VISJrs1GQHwqbU6:nGNK62zrH7X532POs+4V/JrcH1U6
- TLSH T14012E835A864AC375EE3A595F48331139FA9512BEA886F90D1EC2E1C05CF6AC130ED23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9cd2aa72-d100-4a7c-ad63-22edaa64161f.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 333B
- SHA256 3d3cc7c3c92e154852b8565de4b2b4835738cc48b1a9f6b1c5f6fa1b5add921e
- MD5 c746d13d0e93d92f5f55d825ea398cc5
- SHA1 d5ba773f0803b289dca6407a26d6b9cbdf1bbe60
- SHA512 24a5a7ede903dfee64b5216eb68ba950e24dbef4da6b6eaa181e00a2c8a77129a514579649b96d2127f04deda301fed4c548b5a06bfe770605dfdc99ede4f7f9
- TLSH T14FE0924B7369D7F5937C90E8BA388CE957F19958D5BA222415CD1CA10CA168370AB544
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100.rar.crdownload
- Size 5.7MB
- SHA256 841d09a5efc799f92eb49f5b1cb626583dba01c02f7ff9ac884cbb6ab062bb95
- MD5 8990f8fdd3396f6c2215f7fce15110a9
- SHA1 bc2e99f0420dd514b35a476d76e3f80d70ad5d49
- SHA512 de175a7fa721058e57d584a0a4d54d20538fdd3eb2c7e6f53c349321808904ea77d8d62eeec3dd3237eb66fc91a57414380f0d7aad418bb0689c99498b830f8d
- SSDEEP 98304:zLYbUZlyn9cljAGBB69nOVcjZYe7aJ61pFdZF0jlu63fdHaXRl2qOV:zLYbBSljPrynOcy3o6uM1Al2qOV
- TLSH T1935633789397F4B6033D07A748AADFB01F86DC69DCC95C53BB099A882901CE5B1732D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100.rar:Zone.Identifier
- Size 223B
- SHA256 361a258abfedf9fa36b3bd47fa8911cd0f7d4bda0270a37ae77db39c9ac354c6
- MD5 18f14d85122ac833b594498b1305dea4
- SHA1 d89c1b64778929725075b5b9e1548dffd108291b
- SHA512 3ac57253f13ae134aec49a54a13580fe5adde2da2e88c68f00c3951f2071b593e1154490abb9f690ebc7193fe5b08c49108268e4c733d1b645d84562ec344beb
- TLSH T1FED0A792520A4400568E37AE278CD455A01D3B504BD7D944C90048F2A94D89CA5A6C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\Carbon.exe
- Size 72KB
- SHA256 98044dfb00ebcdcefafbdc7fd1d0a2fa8f8ba5707d31309f4289dda1c384c55b
- MD5 0c91bb764bc687cf3d9d4369764bae15
- SHA1 8c5a728c5dc7cb2cd28af98336059fa14530a25f
- SHA512 94e48e12fd76189346ec5fc310f148e4d6828916270ba0d50b8aad54f94825b1eeb33551df4dc18e81f0d89aac1e5713f6dfb6770dd9572b756d74fcb7f63c81
- SSDEEP 1536:Qrdc/zhHKTGkvwDZxAp7mD5IbHTqix27s5j65rO3F9ITXpjq69tSnhRk:odEhtZxAp8IbHTH27s5jgrO3TITcvh2
- TLSH T123737D4132AC9A33DA9ECAFD402116116BF2D9526053E7ED5DDD70DE20FBB800D46BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\Carbon.exe.config
- Size 187B
- SHA256 f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15
- MD5 15c8c4ba1aa574c0c00fd45bb9cce1ab
- SHA1 0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8
- SHA512 52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4
- TLSH T1B4C08C4940A8BD278E334B235752C52AEFB073A3A424140CF02FBA660F3128D865737B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\Intermediate\Integrity\vc145.pdb
- Size 1.1MB
- SHA256 b272eb7038820fa6e015540958e39f4fd853aaaf6c6b41e68ea02c2321cc2590
- MD5 4e0e88066c1a87b4338e67ded45f6b0f
- SHA1 b07ad30d093075e97d6ef034feae2bbe171be609
- SHA512 04d55f6a98516632256227416af0d1fcc0e8822214541ac749f5d8bfdb31df87670bfea7a9a462d831df80b6e9435c03fe7927f178bf835230a199e452fe273c
- SSDEEP 24576:7hm9lz8KvGATXvaBPj+Srf1gAHAsr8w/LzKc+OmU9FG6hdxiUuocMW+8/L5+KVrz:6vGATXvaBPj+Srf1gAHAsr8w/LT9Moct
- TLSH T16945F8A2E5528D23D4AE273A905613A423245F4AD3CD3BCF114BF0255FEF358AF2EA51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\Microsoft.Web.WebView2.Core.dll
- Size 681KB
- SHA256 24b1a6be3a7956e00d0509d4eaebf08e418fc219e964b6c269d2e04439333685
- MD5 ae915341870f891f090228905277064c
- SHA1 749ebcdf4be274d7777124bd081f093403941cce
- SHA512 aa3f2efed0a7e91dbfae414f344f41ca8a5ea5ab05d93436526c6360676e962969e1f29c3e05d428de07571bc5e774cd091af05d5fd3826f564ffcdb4f56f0bb
- SSDEEP 12288:GJ4dCXzRKX4EcJupbSRi461R1VDrP3224c+iKmDRkRFNBMUFeA+imQ269pRFZNI/:GJ4dCXzRKX4EcJAD1RvQy
- TLSH T1F9E4301223FD8619F5F27FB9997412609BBABC97BD78C34D0698642D0D72B819DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 c6221acfe974e74d2bcc629116301c8cfba9c2041ad5d81187b0036a0b45e278
- MD5 4186b8c7af685f4d0bc110adf6c021d6
- SHA1 fe1bfbd9a1c2e6d836b447a5e65c7d079f387d38
- SHA512 e5722258003aaf7c35d9ba9e9c05191f72502a5a82011c589ab07b46590f40d95816ab32f70ea3a80e694492932427ac900e012b263afa4cb9e7560c1236f9f4
- SSDEEP 768:rZQNb2vIYymJ22Mss+5dQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxb:rSb2vLbdQ+ZDgcEST3p4JjrjaeFSUyaf
- TLSH T1B4034C4083ECC517E6EB2FB8A874916107BABEC37DA1D7A91C88B1DA0C737D055153AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\ace.html
- Size 1KB
- SHA256 edb617b8499efdbf9b26737163989a56d63ac78f4d4eac2bda29a49a3091e940
- MD5 7c4fa6a2535317dfd63f74b0be542107
- SHA1 772a0994e87e4fabfb3e741dab9d311bb952829a
- SHA512 790a5093eea83e06b1aa20d0af08d8da96fb2ac07d1497f2973ede3c78cda0b2de82dc32741a24883b5a71cc2568f28c601c23903ce5579e145e9d9f6171519b
- TLSH T1D5311F4F18B751306423E65BDBE7B30829546987E161DC1476FC86E09FC36848BA3BF8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\azeret.ttf
- Size 51KB
- SHA256 48e1e9c0daea105bbd080336b9bcecdde229fb7f7cb52b02a3d5f586f17d8280
- MD5 d4a3a214f90c1b1bd811b4654da6f4d6
- SHA1 774ec8898b73224b910ceba1e9ed7fa4091de33c
- SHA512 bf1cd4d47bfdd77326c28d17313a05243875de3c1868f882b14a71be4dca4ee2a12b6c34653de94779e2c05a9b3c0a9622165534750d5de5167322544b5c0be2
- SSDEEP 768:Eg+CI7vAQzAylmu8LutGPuFfgBMPiMgElaDoFaNAUW36IR1H5Yqa2rxrU19HgAC/:Eg+CrDtLutRouiMgyZv1s2r619k84
- TLSH T1B1332911B7478B4BD3251EFED03607956F38FC65FE8AD34B9A81BA19ECB60A50D01389
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\src-noconflict\ace.js
- Size 703KB
- SHA256 1d0b55cdd0483f32404056006ca93d60b4161e44a5f159152ba36f933ad68a1f
- MD5 ad24758821a7f71e884d5f7639052d38
- SHA1 b5b15ac79ab30196147065687ccf7cec5521c55c
- SHA512 e1b840648daf7d01f1da097c5b561405dc0563d07b12e7ca8d7fe6eb60815b84023731d5a4af0d185eebcb179a068c1d342fecaea1694c7709e2bf2b735bde5e
- SSDEEP 6144:oA4Z0JtNfG1ghjZmOIsAdUblJiujPIBELeq/SFEbXbZV8dxcQgnmx8x7B9z/n685:o5stNfGsf/jIB67qeR94WkyM5QByR+
- TLSH T141E4734E7AEB2022DA5B7039AFEF51066675404F680AD9087E7C96D41F9043846FEFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\src-noconflict\ext-language_tools.js
- Size 75KB
- SHA256 f73703a1fdd8b7d6c57412ef41d3895631accff5d1d2c9acc34ebbdb6b4e3999
- MD5 23dde641ff42490cd93cd4a80235e1ef
- SHA1 143c7c5b12b33e27fb2ddcdf61b73af7d4986fda
- SHA512 7a07c3b7bc1a108c021598fea1cda516cb92614cae95cabaf299cb8a2b7bfbdb094eda773a4e8913cc52a6f0f5e30e7dabdb6c2ffbcd5fc48fcf52b994c065be
- SSDEEP 1536:8z5x5p5gfW3oq1D183CPjvpJyYKpZ7CWa7kg/ImCDrpN8msdFKVYYf4cLNt5AqQc:8z5x5p5gfW3oq1D183CPjvpsYKpZ7CWf
- TLSH T1A773634E9AEB2026A613307E9FEF41097A7A4047650DC9187EAC96D05F5193843FEFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\src-noconflict\mode-lua.js
- Size 17KB
- SHA256 c90a58fed8a6a9e9df3984223ce8c58d3479ee4c1a864f4f573f36e526f47bf1
- MD5 d10ef0f4f800d4570a9701508e3f9c12
- SHA1 bc92d74c08a78bfffbc580e713832c93a14c53b8
- SHA512 1703d7547bbbc1384015dc5a55d4b9e040e214395bb97b602ba5ba58e94fd7624c466b34c7136397378759468a630b2804699cd2e7931f07c49d0c3682800d70
- SSDEEP 192:4VhxgKikA+rHLEYzLzJ1GxYdNC3de620+5PVy8LMsYPNggR4ST33ciyWuwvge7wI:0hxg7G4Y/91vPenL/vgUawVWgN7
- TLSH T103827759ADF23C718917B0756FEF820576B680571C0CE804BE6C9AE41F5482A42FEBED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\src-noconflict\theme-monokai.js
- Size 3KB
- SHA256 4e72648b501f9828c3abf5a20aca693143e651ae0213f3b3c1815cad1599b4bc
- MD5 ed853a4c8553f63ab54433d1a9447054
- SHA1 b1f113a91711473bbfbb25f959f9ce288055ab03
- SHA512 d2cd06bcd21d7d9115d014f784a7cbc501d9bb60c17c8d8cf084ddd3a6c378033cbb66449fad9b01dbb6bfbf0f197dbc3aeff0a6651f9c1a1ea6846853e63f9a
- TLSH T13471885E93A69966A07F474C926AB2253F6C19430008BBFFBA1CF3544F490F0E77458B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\src-noconflict\worker-css.js
- Size 306KB
- SHA256 9bd84ad6e4df96148f97e4763dccdba3787f78d14cfb784366b3dc4b0dd72f54
- MD5 219db9db1df39ce8cf197c72cb643801
- SHA1 d32946e9818af21c6e9bd581526f428872e54681
- SHA512 94ef0a82e9cb8b52d52b134474d50cf2a3308b58cc6680a203ddea7056b3ad4138712fcc41b3e9dac16b3cd3f6af296b4f25df365972084250437acd17aece04
- SSDEEP 3072:PrqUABTozfOgvVkfakkNuXTETi42p72Acxsz6JLBDF0ARt:DqUABTMDkSXTi42p72Ac2z6JX0AD
- TLSH T13A645059EEFA181286537039AE9F9205B63485070C08E9047F8C97D82F5C87E56F7FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\bin\Monaco\src-noconflict\worker-lua.js
- Size 101KB
- SHA256 88a26a45ef35b82137b0bf2cd813e4961961987eab12544a8e9633e5aab8a50b
- MD5 6ddf5e6270865af626321055852c6cb5
- SHA1 cdb05817452220e49d97167cfa9461162454c46d
- SHA512 bb629a8da91bea92acad0665568731c0561cd98ba4867031c2881c63ae0d74ef499c71829a20938883c73bd3a5feb72ccd47454ea70bfa10ed0d45496e915c8e
- SSDEEP 3072:PGuCncHhkHQXkf0Al1V3+1bON7nHRo5flD0:De
- TLSH T1EDA32E5D29E320529A23713D6FAF5506B6394443140CDD65BE9C92D0AFD083A8AFEFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Carbon-v100\build\runtimes\win-x86\native\WebView2Loader.dll
- Size 121KB
- SHA256 5388b73b5ca00f1faf2a569cd923fdff00e316a254ef6df9fba240e3839a2c45
- MD5 b99ee8dbcfee7b2c17211c8be731e608
- SHA1 50eac72d43f0251bc89b24cdcf8411063b8c02b1
- SHA512 d34873575b32aa2a1745ef7f87cc266c534d169bec87a523d777af53722d07bc8aedb7591334b8be2012a4e18a0e012ea818176af8a59964d00943d0950cc9fc
- SSDEEP 3072:KyCDCc+IrkrCn0y/smK5dRMt2LILt4CVbA5ThnjuEtJZIJDI7vHNNSp:lUCWrkWdoduIELwnSEtJe2fNg
- TLSH T16CC36C00B5E08031E8BF15791878DA759B3F79A1DF608DEF2B9815A94E347D09F34B2A
- MD5 SHA1 SHA512 SSDEEP TLSH