hxxp://google[.]com

Analysis

max time kernel
773s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6028	dismhost.exe

Loads dropped DLL 5 IoCs

pid	Process
6028	dismhost.exe
6028	dismhost.exe
6028	dismhost.exe
6028	dismhost.exe
6028	dismhost.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4472	takeown.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setuperr.log	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagerr.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagwrn.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setupact.log	cleanmgr.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	cleanmgr.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	cleanmgr.exe

Checks SCSI registry key(s) 3 TTPs 40 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	cleanmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015	cleanmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 20 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "6"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6112	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
2508	msedge.exe
2508	msedge.exe
4628	identity_helper.exe
4628	identity_helper.exe
2384	msedge.exe
2384	msedge.exe
1332	msedge.exe
1332	msedge.exe
2612	msedge.exe
2612	msedge.exe
2476	identity_helper.exe
2476	identity_helper.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
1168	msedge.exe
1168	msedge.exe
2396	msedge.exe
2396	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6000	cleanmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTcbPrivilege	5288	svchost.exe
Token: SeRestorePrivilege	5288	svchost.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeManageVolumePrivilege	6000	cleanmgr.exe
Token: SeBackupPrivilege	6000	cleanmgr.exe
Token: SeRestorePrivilege	6000	cleanmgr.exe
Token: SeTakeOwnershipPrivilege	4472	takeown.exe
Token: SeManageVolumePrivilege	4708	svchost.exe
Token: SeDebugPrivilege	5668	SearchApp.exe
Token: SeDebugPrivilege	5668	SearchApp.exe
Token: SeDebugPrivilege	5668	SearchApp.exe
Token: SeDebugPrivilege	5668	SearchApp.exe
Token: SeDebugPrivilege	3048	SearchApp.exe
Token: SeDebugPrivilege	3048	SearchApp.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
6000	cleanmgr.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
2612	msedge.exe
2612	msedge.exe
1332	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
2612	msedge.exe
2612	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
6112	EXCEL.EXE
6112	EXCEL.EXE
6112	EXCEL.EXE
6112	EXCEL.EXE
6112	EXCEL.EXE
6112	EXCEL.EXE
6112	EXCEL.EXE
6112	EXCEL.EXE
6112	EXCEL.EXE
2612	msedge.exe
2612	msedge.exe
4480	SearchApp.exe
5668	SearchApp.exe
5192	SearchApp.exe
3048	SearchApp.exe
4440	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4936	2508	msedge.exe	41
PID 2508 wrote to memory of 4936	2508	msedge.exe	41
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 2800	2508	msedge.exe	89
PID 2508 wrote to memory of 752	2508	msedge.exe	88
PID 2508 wrote to memory of 752	2508	msedge.exe	88
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90
PID 2508 wrote to memory of 2088	2508	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fefd46f8,0x7ff8fefd4708,0x7ff8fefd4718
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8236 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9056 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:5168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x510
1⤵
PID:5632

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ResetBackup.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5288
- C:\Windows\system32\dashost.exe
  dashost.exe {6cbb54fa-a3ec-4eea-a9b157211cd384e3}
  2⤵
  PID:2096

C:\Windows\System32\cleanmgr.exe
"C:\Windows\System32\cleanmgr.exe" /D C
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6000
- C:\Users\Admin\AppData\Local\Temp\62FA08EA-7B58-4147-8E3E-1CEC78ACE5C6\dismhost.exe
  C:\Users\Admin\AppData\Local\Temp\62FA08EA-7B58-4147-8E3E-1CEC78ACE5C6\dismhost.exe {EDC726D9-AEB6-400F-85CD-68E5188143A6}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:6028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8fefd46f8,0x7ff8fefd4708,0x7ff8fefd4718
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5772

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4560
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\System32
  2⤵
  PID:3352
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\System32
  2⤵
  PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8fefd46f8,0x7ff8fefd4708,0x7ff8fefd4718
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7392 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4480

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5668

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5192

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3048

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d52f5c8-d9f9-4eb6-91db-1313d80b67e8.tmp

Filesize
11KB

MD5
7d7cde2e6a73113616ceeb70e3dbda74

SHA1
a433566af44f6be9a040b93fb5f10dc4d8da479b

SHA256
10666d55e585f4b4c975a43ef1b549b92d3d0af16d4e82d769fc5c77105bf867

SHA512
3a70cd69b95763cc8121e6c0d822e77abd202e2105576625d1b63c39527e40b2982a68fc930c7d671f59c34a5b61d9a64c92bdd084e5781301bc4e34a9507b94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23b6b1c4e66d52a1ca79bb725ec02063

SHA1
3e51313184ad63ae75a65ab4d94d314849192db4

SHA256
8d5bad84b874bf8b3bade9718f6b9c4a1a54d87edd53b347081d98b4a135f7bd

SHA512
9a2cb19930edde1fbdb0954c0c0048b6b007457126dd72cd684930ad3f12664418817b80d59c0a0201010ab8d583ba2cab5a1a37135e2d34bc4d7c64c8a7020c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
68629c91994bb2aa412aac50066174b5

SHA1
c1cfa8bdde3012ccd3f253cb2ae08cb9938263bb

SHA256
5cee89c220f168d58a9667e5308a956598dea74c85ed679e491b8b90fc7b2298

SHA512
27566abdb6954fdbce5e8b49430bd0a2df431fc98fdecfaa0021b9d037d8de1a2783ce5a346c0627c44932277c75ca4ec1681f146aab788b3c55ff57e737718f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f6d41bf10dc1ec1ca4e14d350bbc0b1

SHA1
7a62b23dc3c19e16930b5108d209c4ec937d7dfb

SHA256
35947f71e9cd4bda79e78d028d025dff5fe99c07ea9c767e487ca45d33a5c770

SHA512
046d6c2193a89f4b1b7f932730a0fc72e9fc95fbdb5514435a3e2a73415a105e4f6fa7d536ae6b24638a6aa97beb5c8777e03f597bb4bc928fa8b364b7192a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4254f7a8438af12de575e00b22651d6c

SHA1
a3c7bde09221129451a7bb42c1707f64b178e573

SHA256
7f55f63c6b77511999eee973415c1f313f81bc0533a36b041820dd4e84f9879b

SHA512
e6a3244139cd6e09cef7dab531bff674847c7ca77218bd1f971aa9bf733a253ac311571b8d6a3fe13e13da4f506fec413f3b345a3429e09d7ceb821a7017ec70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\490ce825-b103-4620-9b47-c103b7b300a7.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
40KB

MD5
cdfa622961c59f12e6fae8a10859c247

SHA1
9bbb49f8097e6352c5aa0eaa23d357fff13a43b4

SHA256
ac5c09f244edd3eb82ea33e256367f6d0687843d123635d4bde336fdb8a5e8bc

SHA512
668ae2725cc0f4a152059c940f33d4a090b622410dc5964793fa2f18b01c560d20751d9bc80769b21439d44d9d52835fcb3545a7dbab67d7da865316505efa40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
126KB

MD5
c74036976f355462580c618bde1972ce

SHA1
5cf7350afd17a4646583a01bda48cc7db9f3ab11

SHA256
468e3b79344f5192fd5244e1122d92aa9ba318cd666a4a23f56cafff7137bdbe

SHA512
019f77674e710dbc2247dcb21db92834e62bd348243bdb516e44bb8fb84fe4dd6ca8a77270259a1dbc92831874a35cd6e2f4e73da16f510cc9dbece1b38ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
35KB

MD5
a4d33b403041d8a0c339b7d3071d6bfb

SHA1
530fd360c02999a12dddd466b5df02a3e32ac201

SHA256
f114c3f3b5398edf770f85e6c1d38d6176d9649ebc9507f5f2d7c3ce030537b0

SHA512
8c6b8efafc56bcc7b9253f741a5f916d17655d175481e8dfa5c104da4c77e7318aaf023a7626f52c2e0b1577cd53584963ca29125bffd7a1a85792ba158928c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
26KB

MD5
2acfb73fd2df022a7dad5595adef5bda

SHA1
939b803ea641bd427b7599f92a816262e7a5bf48

SHA256
3d4610a2ab69d08e54685d0d3cfcf03ec663bacff8cc89a1e0a2904a7769e641

SHA512
5978a8866bbb30d409f728c4cc1081af19e3dcaedf2e4f0e1d9e40b75c0e80ecd6474cff4204114716f30ac832bfdb6787726caf504d2305332f151664d3e15d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
78KB

MD5
f3e6697902773ca97e32a62ab8b8b3e8

SHA1
d1fd8ba462ca2689c042180c312208616b630c32

SHA256
38f727f0f31d62c93d482ca209551103df8a842709d1b31c8332f08fdf22a186

SHA512
355be915fa1b5b4aaf8bd5754cff21a560df19c3a1a8325151244d004f793f0bb853fe858db7e382926fad32ad3061a347fff1f40fc305a26a43482cac7e083d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
156KB

MD5
e92470512b8d45e106f6c687c2e557c9

SHA1
ca0612202ba01609400c0c0f17a285019296e667

SHA256
bf252ddb0322282cf6f93762ecbae5495b634fd00120e9f5f562c17ba2e1a725

SHA512
fcf3ed691bb5aee1978ff22499d6adad49a4fd4e78c73899614db7185dff739202e5d8bd92f1638dbbd888a61a578cde382184664c74667d937d20ee05539f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
79KB

MD5
036e0d798c6f86b77f62b3239f3fec5b

SHA1
77a9ba491feab285c4ee92b76ffc97801dc23052

SHA256
0f9052572b70ba126b59110dc44e8e4f85cbc1cbeafa266c2798490eb5ae8d86

SHA512
9b8e53f38e112a8d149dde731d08dde05fd6c0708d40797fe134221454c14272c2e907a6f05691ffe9d0fddf68c273bdff7d2831313b42ca0edcbe04910c5c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
21KB

MD5
68d6c2571b31b2aec684df15d90a7d12

SHA1
81b540636375d8648d30839a810f73907923d1db

SHA256
33e3503ef3a7dc205b9a36025f8ec534daad28ae8773c930c245d463d250f472

SHA512
80ec5de9098f1d76afa04810a081730c2794c981114f9d750be0faa6c50869d451996b5f62bbbea1e4aa7b369c0a9c3cf652d1a84a1681ddba0797a8f71fd00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
19KB

MD5
2a39f133a8af87dc3b845832ff6d30cb

SHA1
e67bba16969705430f54e65ad0a241ff987aa273

SHA256
0d4451ade7ff63c59585c3637be283849dedd52d49886c6a7e73ec1364337ad4

SHA512
45d828b3a0f890c5da32765549f5133ef074a5be630ffd0b24f712cccd6677f76ea134aeafb3d5a59fcd405cec3c36eca5dbf6ddd15c712cd2ed70c2d4882d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
87KB

MD5
27ebb57ca80d9efd1d7b2bb174af090f

SHA1
527a35fa8eb34124d8bdc9bee973de676977637d

SHA256
866c21d6cada368ff5a8049cb94a899b547fc763068036aacf94be7b24a2a40e

SHA512
230f0a48bcfe8c8552291b9fe4ff3f0a26da2903959478095b906b727ac97f6ee8105403671e58cc323d74ef7208d2cbb6d3f60185d952a0b3565cd1ce3fdd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
84KB

MD5
19b6efdb34844d71cb2e125bc9bcec35

SHA1
0fb5e692af73f3a8ce4d2f1fb33831af776d6710

SHA256
7964908ee857726946b361277588a35c5d454130ecd840e40d781f5b5e62a34d

SHA512
ad640b3c5e6e4804c230a3ab8445a43eb14c6c91caf461fbfc04b8d82caf7c1d31be434402793e2b2e2726e4c80f8443d6806eff7e855950066cfa747e9174a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
41KB

MD5
a571047206b4f87ae95ffb8cf806d547

SHA1
0e3b92e284a0646a49c9a478c72872b976dbf193

SHA256
c3e8ec43c6d4ac1f7ac9ef25f14cfbddcb3815ab1aaf01a4a01064f9ac2835e4

SHA512
c25f61e321f1b0d739310535d497bb445f2161b93d8180e2f7d33831da617d9aef33aaca438c9bcca48f5884511ef8785ec95e9aa1457c062928f9d34c7870d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
55KB

MD5
6c8c6a48353d4681a1128dd769b8057b

SHA1
6b04966adb45735b73c4c8f4f4cb9b495e7d2528

SHA256
9afe9e34e17652b942296114b037437f57a343edab8dfa054fb0253f49b2a10c

SHA512
d09646cb6a23e538a1b8603af8baff6c32dd615eef40d41d8485f25751887f37182670711f6740bfd3136f93710a0abeb5e8268735b3bb46517b34d04d07ecd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
1024KB

MD5
771cf1946c8fa50333342d02f357379d

SHA1
b19f3aaf757411a2a23362eddac20b359f94c56f

SHA256
ecbb91c4a9012cc004bb4f30a40612c2e6f8128028ccdbdce54f6e081c6258a7

SHA512
04633317a546997192364dd2d21f675d9a35a3ad2d6040cf1fd30c895f8c408ee4de1abe50ba7f1c5c09eff0244f13b3d5623ecb0b13b34c4ecef9b31eedf472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\08cc782c4752db7a_0

Filesize
253B

MD5
5350ffc6a99017bc7120bdeba2def510

SHA1
1557cca4405b49bf769477cfbfbe363f51b76f9a

SHA256
ddd5d34ec5bc03ea4f3033225e81d215a87abfc5517bf68c18beee1d438b29c6

SHA512
cc770c90adaff027251bd35fbdf39536bf76e13f20922017b63191d1267e4cc230f443bc7485baf876eec66b577093880ff6451cd5d14926e420eb060bc91fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d868f894f5e7886a_0

Filesize
7KB

MD5
fe2e8c62f7eea71f22469d30166b9aa2

SHA1
068cb0e57a68333b1b675cd928b3a83e1260df46

SHA256
095ddb4e04a5c1b6a90bdbad656e996ac3b0e8b2b0d54cf2bc1ec58a8caf3a90

SHA512
834678e6a031289bc400766e8b60b0fb01eeaf8b8b5f899b77c414dd57fa4a4795916d04653b7bbec201003a00f8c68dc06e8c17de682053552d37be359beef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9bb5a169dab09216e4828e9b92fb44b5

SHA1
3c2c6048cb6a230b2ef245c137df394d6583e42f

SHA256
5f14d05ce94c6837f57525bb777d0988ec1c035f812007907a3ef9cbfddc6244

SHA512
53e60c8e92e8aaf2cc1dd96c6c70ebdaf13a05375bf22c7b9fcba7ba40311e800f6535008b8fc98fd9c736167af6eb95a951f84032e05c811885d19a23a18a6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
87f704b8470fc3435032461e0163e502

SHA1
e5c825e5228ff0a248e1a4b04b51e7887eb6df97

SHA256
0771f1e269f23e77bdccbe5e759582e605188d6c63ae3983f386a8c92bd1421e

SHA512
6c836a425be457a5e61738988bbedf577de8bd7a79d0b582aed61caf47b0443d240043f503d7c9dd8ad22141933c9bf6484b881e37fb5f764c6d9d0dbe6814c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
92644297f2fb1e736820a8c26fbb883b

SHA1
a5b94c967ca3f9b44e949ee13060dca2deda2d8b

SHA256
f93250c87bfff7ff117e1329cfa960f222284a1c0fc547e74c919dca221166f1

SHA512
f219fbf61ea46055167c15b19287ce218299d16d3d5f03e12a9c860344acf73549400f0d1424eac27d2bcba1c9e3cf548955da263bce3848d9eb4160111d31ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
0e83e588171f0d6b7b3f177cdf691a26

SHA1
cd37e9f0510f68c96b25663560ca3e5ef194a7f8

SHA256
713da4df5937eaf48824f4f90213539d9cb7675978f452674bdccf708283967e

SHA512
069942c955ab406409d61ee8de25d75dee5a1e395eb7bbf82cc6d2f5bbe0f9d84f4fb0655ddbd7ccb90def1c8c5613b1eccc5af668a57fde715bf65cb15681ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a07469f96a8c8c533bc41829f5016261

SHA1
f2d413d114edd8e2e1c34c59f91818661e0d35cc

SHA256
055385bdb917994159bb9b9305cf10c8004033f4ee5e56011075c40afa7ecdf5

SHA512
253dd15225594e0b0b58c0ce8ea23fac5aff084b84945aa43b205c51fc34df37fb0884454fe471867ca6a9714e727888c838251e2bbfac82e1eb97ad35c83643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9ada94acbedc89ed2f1a2984ad3d7d53

SHA1
d7ec279bdde6cb8305fa0aac577dede9f21bc010

SHA256
244563478c86e87f86afa2da42d0af73834af26694dc6d7ca2d4cb8312209daf

SHA512
e3c3da45ff0b5ac5bb1374b37d880e34a4f91df44e7bbd04a02d9fb811bb0997b7369f8e68e44235b701d49e8ec0f73ac205414573e23ae35f9900da8f01776f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
48a8cb144ef10dbb15cc1a5cb2032032

SHA1
a9c87a3a0eb95c972a75ef51aa38dfed5e898f43

SHA256
5e7e0e47687c07172f7f21823ad84a6292f9dd298bc5b01d74d56a0c98c21548

SHA512
36f22083e939f1c29b32663f7d5e4ca11332a8e4173265e2faf641f6a5f14f830680c514fa438eb27cec01179072e3cf43d9452c4f546999623557e7cb3033c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
10c777e05c4480c15a6c7db6ebb16f10

SHA1
82ebdde570a83f9d10836af72709203962040666

SHA256
cf087a29e885f59072c5442afe59b47d2832c605bb016400c80f872f85e2266f

SHA512
3ff06702312529b36941f5bf5f0cd3b62b9b8f5d361e002496026c08ab6b8e20ec22f9ab60c9c02bd76447bf6e2fa48315f009b17a18b582977f60680158588e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
0bc1fcfea288faa47f35432138e05fff

SHA1
547f2eb8617b2f09d211dff78e7141914a993055

SHA256
4873719d1c51da8e7b3a41eeb12c042390348792c11cf362745c014bf9592e83

SHA512
610b662672e65e8a30dc2f4663db66e9a1520df399becf34e0e2b6c4bead579d2918460771e07b66a7b543f79418cec5cb32607cf69f6a47b65374c07d646783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e2c1175c39f6d93697ddb72cbb525164

SHA1
69f9ad4c615d90c948371f5d084115d359311722

SHA256
3a6d411296e08d10576340693934856b8f54c18e029643449744ce403fa68927

SHA512
d5214083c46f4c3a1fce26dfa6af1eb4ba8d37bbce5dfa94d139f7c7c9df8b3a7a5a9dab29f90daf43d7b6746696bda0a06e651a00086cd8773601dc32712811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6db1c8303b4fc6b1e71a1f52079a31be

SHA1
89f2c28be0b9bf4ce4b34a6035c8c4d1929cb6d0

SHA256
d3b7a03bb07277cf3d5e47dc1a3f360efba16099ec22ac6793d72f59e10c1601

SHA512
abb856abd5e93fff999448d006aac36432c565e49756b88b6e13570861a54b2cd862bc4c493e9004132cd56bf5576684e798b05875a2cdb42c1672a38d88f9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9dbf4cb03439656ea88310f3515b8631

SHA1
23ae0232980cde6769b5bd5494674eb13d11a05b

SHA256
003bb6cbe81cc27b263a7bcad4c518105a069ea1fac47e00cf01f13b1bf0cd30

SHA512
b3e9d11cb777ee6a89e03bdf0e15941080b3cf57be4d7941b1222c404be8635829bc4b3fdb0d9c5c161e2a44724e0add6e6278cf98c3d55a5adffb52175c8c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
4705dc82ec891cc4f1a6e3e54156d8a1

SHA1
8756e50f0711984ae89393c906e5924b7fcd305c

SHA256
ca955e30a64904b90081fb3a1e8a4516180b028db72130ea3895e29addb0e2cb

SHA512
f3b0dff8e3c65483089d233e2b75c1b520500169bd7a32afc0617c43c48eb54e8780ef2b083eb29a04c79906c6c312521a9f77a3419d75f8c4e4dd698af39bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfea2af77b2061e12441541f906d779b

SHA1
5842cc67dc5a313158ba1e774ff71b3c114c2954

SHA256
55a89ea02a675bd46dc1dfda162f8958db07bc49d21f42c8d535765fd7882863

SHA512
5015a1c1a0bf845433e7dd8cdcf47a16297f8487a32673d30a8dfb57db125d35cda2fbd07442f765a6e5aac0b3904dca3129535c09563bb6603c708dff3f141f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
00919fc3c1e10d06965241d3ca57da93

SHA1
e9273aa7c2f51317b23f82d1d743bdc1c8204207

SHA256
f1e48eb007e25f006d33dbe0273fd1b2190d1b59f95ac6a7ba734631717241fe

SHA512
a646f2fb922e241b12b8f750de064941dc89aaa5ec0f8aeb0cf91926869032522863e09d7475944751f0da9a12f1ed97dda2899db9b5efbc42685bf9a9e8205e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
94d83590ad12c948efa0f2710982e815

SHA1
b6c091162b746f39d76f6532b0391b3a2ed4306e

SHA256
24fb83df8835658a25c2ef04b7b7ebb20b11224dc686b218bc7b46ad6ee6edd0

SHA512
381b62b04d536be73a00af6788525f7ea28664c863d35b02b1c1574faa1ff52915e900b9718d7d879443f34d8717c197ba7fe42542de8fac4be63dadba3ff7d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6837556978a472b4221865302117d2af

SHA1
6a29f3d5db382937ab49b58a5e9292c0c226690e

SHA256
3433fe94f5705f623fecfc4d2b576a9ba8d11471ac0d7807cb4d303553d3cbee

SHA512
875efd4dc1ec5c60ac9bcd6bd852c9e01320b34768d980e9f316e1100d61302c64777e306c57c60845e8ad0bd09bcceee3a4d3835fde42b9c30830e7b6d1189b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2c7d78b2c1512c1e35d52cddf029fa24

SHA1
fc46e5ac30dd54a5bebc24ce91a3c031b03c20f2

SHA256
de409fa52be1b410e0569bb153032fbf287bcb243a8746cfe8bc9baa4775ae39

SHA512
03595d2508c82919fcfc8e5be4cb0e9dd0316d2fc444bd3ecd190de361ae41d5e7709c7c5e584ef20d0077b0907035a41b81debaad96613046d95976e168db25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d0b0991314a30801903eaa065ebbcc42

SHA1
bdc8d34dd9295ba9ef6972ebd5b34624481e050b

SHA256
ab6abd9ab1596b4998d5fe6496ba2f26b0c9b95b3b9fefcc682454ed79e9f64a

SHA512
9f5f7865578cbd88150e3496cd911fef994e96ae211d4f6426e20b1fa7d758fd4c9327cd28cad7c6f5c97c15885477f305dd06353e9f57d8ee7d7bd62995f9f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
beb3bb5ed9a260b971da3d8d17035560

SHA1
8a4cb93bbfecdfb7a8e37e1971a989c9c53f53ca

SHA256
e1879778c7cf4e9e2855d5b4208446298d83d22613dc1c01c7314bff524c630e

SHA512
7a03a2d22a0673e750c05f19fbb78d2ca3107c9f753480a0ab3c4a4ce39954108d7e8f0cb80316661797ba107dd1c4224429f4f59c0ad471f453659a273ced96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
a700a9e9aba288cc8cbbd74400d94ee6

SHA1
21d1df8bcf6d301d98912145ebee959afed44e2c

SHA256
08ba43ba30ba0f5eeaa6458de6a11a623f2f6e03738ddbb2cd6c5cfcd3f097a6

SHA512
12ca16f5d0d316401580a52f35278e5c32bec1cabf473ca5b01d0d1750190353ba37eb3da266450eb2c9f8fa21d336b4fbaeb3e740f3456ede96a83d8d13aedb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e251.TMP

Filesize
371B

MD5
392f904a90182aef083d65e92710be00

SHA1
749e905a8c27eacb301a765ed4f2a527ca60a5d4

SHA256
df91ab8931fc15987f4348bfa27494f1666e2ed8c8972125032d27a77eec56de

SHA512
b48047fe5c399e1155ee2079b3882bc64f32f20b718c9040b4d05d01eda53afdef1b1a497df5f60bb5ae532113a048b57d23c292e6ae9de90b906aee7be0a3cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aab9992c-58e0-4bc2-a13f-ee09807130f8.tmp

Filesize
7KB

MD5
18cce856e16371220cbb9092ad478fdd

SHA1
1c12f78540112956fbc237620cc9884779dc3dea

SHA256
4a24c5e5b1ad50198caa6919b69b3e10edeaef51148563325ff262bdf7c11e23

SHA512
1c081a858989c0c242136473e21e1e75054a21d398058b674bbf16cc59d1cc8d757fe0a81e6c6224bcaa61c9bfd9f0e32e0aa51934548275df67eab931a9b2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
61df6d117b1300a56250e8e523924684

SHA1
f25972fed751fb86749d7ed21e2f3d42d6e95149

SHA256
16a75553fb14f52ea7ddcbbbdc7c69cda43e868f651b32aed114d107b8d1b52d

SHA512
ba621ab270d660de893b98a0ac213b114be3087aec75b29262f99e149a38c8d0b0c4378591a636d7e367f2dee2018e337daef4bfd4dabdc355ab702b6dc8d98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
633b6b32de625e222f1e21c7e9abfc4c

SHA1
a4b75058a3b1ebc665e0b7f05fb10479b41663c7

SHA256
4a3e8e1438c24a1e0b92ddcb6f9bacd609ee3bb2142995aed32980c6d5ceef64

SHA512
11c77ee136abf01cf1df775d0a3b25365711f3c8ed249adceb052fdefe1dad60a63af46b9afad20168d05582b0cd4a653edbeaa216f52226e7a85028c2c1f9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
91c1dc347632d55911c4e05a0db84c80

SHA1
4bec01101c8822951ae83c02274b61796ecf66b0

SHA256
c8f9ca75bb8517e8b5138682a8713f77272540ba2166125095661f4c66061b0a

SHA512
4dbe380d0f59ad5af714bdb6910368983e527ab3b94140ae236a63787a73bdc30f05be57e9adba595a073d4054fef3599326c558cb8edd40a7520924be628c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f834b4f6f6e912306b8afd50e2fb7f3

SHA1
08333a8e6b95d15ac2e987fef7fdac53953585cc

SHA256
bed19e64c1f353be9e4f66f5d681bb48f5cf40aead2e40d770d698834b3689df

SHA512
c27024025ffbe2837103f164f9a33899fcd114357879050a97a4cd16fd0ff0f27d049923be718186a404940b036a27f13a3d2c9f630bd2229239cc999442621f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
aac379cdb385dfe637a3c2bcec19d953

SHA1
a6831ad3e62ec37342e29852f0e45017802a5c74

SHA256
1a4f28bb8b32f2bd5d27588731031f76387b31da4b743df83727bed08857ff77

SHA512
ca0550c3716d83a3017128dc5ea585993fde772fea5dbb5116666a41bcf7d01fd04fd98a90b5e683a7eb1358d32414a64b7a942023e84e07f40fe81f58109ec8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2M5VOT43\microsoft.windows[1].xml

Filesize
96B

MD5
b1d4dd85bcb76dc7b13463a25a2900d5

SHA1
675df565ddc2196754f277062c95ffbd452216bd

SHA256
2d9a44fed6347e8f05ce85d54c0dc2d9f91bd1fa8fa7598ed443603a17d537bf

SHA512
0070e5a2327e1e07a1843a8dc05791a8cc55c6ae0589c0ae192d56c56f7c600ab1c1a8f5072e8895af5a4d088199960bf39e71cc6a1d9022709e2947fe692155

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\apps.csg

Filesize
444B

MD5
5475132f1c603298967f332dc9ffb864

SHA1
4749174f29f34c7d75979c25f31d79774a49ea46

SHA256
0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

SHA512
54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\apps.schema

Filesize
150B

MD5
1659677c45c49a78f33551da43494005

SHA1
ae588ef3c9ea7839be032ab4323e04bc260d9387

SHA256
5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

SHA512
740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\appsconversions.txt

Filesize
1.4MB

MD5
2bef0e21ceb249ffb5f123c1e5bd0292

SHA1
86877a464a0739114e45242b9d427e368ebcc02c

SHA256
8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

SHA512
f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settings.csg

Filesize
454B

MD5
411d53fc8e09fb59163f038ee9257141

SHA1
cb67574c7872f684e586b438d55cab7144b5303d

SHA256
1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48

SHA512
67b342c434d8f3a8b9e9ac8a4cbd4c3ef83ddfc450fe7e6ad6f375dba9c8a4977a15a08b49f5ad7644fbde092396e6da08865aa54d399836e5444cb177a33444

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settings.schema

Filesize
162B

MD5
ac68ac6bffd26dbea6b7dbd00a19a3dd

SHA1
a3d70e56249db0b4cc92ba0d1fc46feb540bc83f

SHA256
d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031

SHA512
6c3fcce2f73e9a5fc6094f16707109d03171d4a7252cf3cb63618243dbb25adb40045de9be27cad7932fd98205bdaf0f557d282b2ba92118bba26efcf1cd2a02

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settingsconversions.txt

Filesize
520KB

MD5
721134982ff8900b0e68a9c5f6f71668

SHA1
fca3e3eb8f49dd8376954b499c20a7b7cad6b0f1

SHA256
2541db95c321472c4cb91864cdfa2f1ed0f0069ac7f9cec86e10822283985c13

SHA512
5d1c305b938e52a82216b3d0cee0eead2dc793fac35da288061942b2bd281fb48c7bd18f5fdaa93a88aa42c88b2a0cce1f0513effb193782670d46164d277a59

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settingsglobals.txt

Filesize
43KB

MD5
bbeadc734ad391f67be0c31d5b9cbf7b

SHA1
8fd5391c482bfbca429aec17da69b2ca00ed81ae

SHA256
218042bc243a1426dd018d484f9122662dba2c44a0594c37ffb3b3d1d0fb454a

SHA512
a046600c7ad6c30b003a1ac33841913d7d316606f636c747a0989425697457b4bc78da6607edd4b8510bd4e9b86011b5bd108a5590a2ba722d44e51633ed784f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settingssynonyms.txt

Filesize
101KB

MD5
003ece80b3820c43eb83878928b8469d

SHA1
790af92ff0eb53a926412e16113c5d35421c0f42

SHA256
12d00eee26e5f261931e51cfa56e04c54405eb32d1c4b440e35bd2b48d5fcf07

SHA512
b2d6d9b843124f5e8e06a35a89e34228af9e05cbfa2ae1fe3d9bc4ddbebda4d279ce52a99066f2148817a498950e37a7f0b73fe477c0c6c39c7016aa647079a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c4f3b4e5-baa4-491f-a6f7-26ac271034c5}\appsglobals.txt

Filesize
343KB

MD5
931b27b3ec2c5e9f29439fba87ec0dc9

SHA1
dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

SHA256
541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

SHA512
4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c4f3b4e5-baa4-491f-a6f7-26ac271034c5}\appssynonyms.txt

Filesize
237KB

MD5
06a69ad411292eca66697dc17898e653

SHA1
fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

SHA256
2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

SHA512
ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133531216590569586.txt

Filesize
72KB

MD5
5b4b9d0df8b6dfd821c5d714018057d2

SHA1
737572ed9a2e31b9c70be6b89a69c1cef3b9fa5a

SHA256
c8fe9454e3257e33e2aa62872f4e7686f19e5ef84f161fdafb59e364e764e069

SHA512
dc55427a58a5a84f3daed54eec79f47ad6278ca640ddb39d1c346006b2455347a94d41b7184afda1e9f34c9d848f478a1b55a70594afb5f500458bac4ed1ec29

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Filesize
177KB

MD5
b98363a1b78e81e1ead8494728373478

SHA1
638fcc8b23950e73e77cadb422867db6a0f147f8

SHA256
8536a44a83336238c8d38b0a00d340d68bfd3faf3aa1d1af9c51924d3610c835

SHA512
48ade59f986a6e2582d69cd75a02783fecea882336382cd7a446ea27e2c3b59fb50d200e2504cfe79f0cab4596b35c41f92fe6f56fbf2ea6144b6106595633ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Filesize
179KB

MD5
0cff4aa944251db08f4de5a86c92af0f

SHA1
6cfafdc59a9f51328b87a285b5cced23efc22c2a

SHA256
df81c8b7fe84013f202780630931abbb990af58fb2c1b3732ff3c37a230e1357

SHA512
5c04c9bf44453cf5b08ddaf695263514da57e69e1654112532e5b3705deba03ed151c6a36ff4ee8c98431ab97a1ce571676a5c9453e983acc107295dcdd81af9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
9KB

MD5
3a10b2b86c69f001a1f66f099cc07300

SHA1
253d04ac8526ad1b56e63395776784bb7a25b184

SHA256
5f0cbe59e762ea7af522f7dd4f942097dff5ae7f386ad6b7dc10b6da620910cb

SHA512
b712018a5164b867a8b8c0cf9aab69491733e0277375a7aa60f922b7ddd67fd2c8673e8f73d97cc289077070ef6c8cdf8bbe06b060495b08ac59942968856503

Download Submit
C:\Users\Admin\Desktop\ConvertHide.zip

Filesize
1000KB

MD5
40e3e432cc5e3c107df8dfe04761d169

SHA1
4abcfd84cb3566630bf747400bb79b7336bbac10

SHA256
b6d6a496d45cc5f68055a92740b1b272f484f53d5ac7474840f0d3808f50e514

SHA512
951aca8e307ed1c69f9a89cc11f4fec3525364dbe6db2ae36b179cd762c407c057479dba46f5bdd48694a2a0b44d811564e56b7a331cec4d8079d4a8959b6656

Download Submit
C:\Users\Admin\Desktop\ConvertTest.M2TS

Filesize
558KB

MD5
008fe77f76e52b0832fc4123424d47e7

SHA1
8cd8cc57727367510c4bed9c712cde88ecb3e51a

SHA256
5bc0e0ac694840d86d8ba99185fefbd7d4a7dd12e5249d8a14fdd3da9f916cf5

SHA512
5a260e406554aa550c8351e7f8c5afeb00eeb8c8772d29e77bd36545d2ed71256c1ffbe396bced5577ebe5e6d49ca074fe7d7094d3df4c4a35385a8d5fdecb75

Download Submit
C:\Users\Admin\Desktop\ConvertToStop.MOD

Filesize
279KB

MD5
849d56dd790562a66c6c577d6a811008

SHA1
0946cba2adcc979bc5fbbb46ff630f4b641c651b

SHA256
695030ea25ec8366e607fd8c6477077c449467f77700682bc8accae30c67482d

SHA512
e074c5be456aae47fed0552efa869d96956a6026de8794de187b253ce571699fc1e205faeaa618078d63eae27c2faf2f136a7b5f0f6c1b93d9825c68667013e2

Download Submit
C:\Users\Admin\Desktop\CopyRequest.TTS

Filesize
442KB

MD5
f2dbe0507dbde341111d26d2ec9ad8c2

SHA1
2a87e2f340715f21ad370344c7e8683349020981

SHA256
535417c8545f2d2450140573fd73d7a525a1300d7c4663dcbab511b987ec18b9

SHA512
fc550e2a70c4c59331f7f0545c06d5604dbb8e84f9d85d36cbac1b7949f977dadcb0b4765f0fe9fb16c37273f9f7ee5eb3e54e1a639b8fe09bbbd28b50c75d50

Download Submit
C:\Users\Admin\Desktop\HideRead.3gpp

Filesize
698KB

MD5
ec150e36b0ecac85dd17c5f0ce471e9c

SHA1
81eba091b5c94d46758bb7bea9e6d385347d618b

SHA256
0efa523959c5d24a66d84bee0d64a575d34bf4fb7a267931491e88428f5de7ca

SHA512
88ab6d505f3f7b3e5742fe6d25ec53f9d0c242455dc090f9c89ce118fce30b5036b8e3937fd47066bdaf0135401104652fb5341daa065ba1b501cf1481a28cf2

Download Submit
C:\Users\Admin\Desktop\MeasureInitialize.vbe

Filesize
255KB

MD5
9e9ba2a0ca3679f2caabd82e9583babb

SHA1
4018f243def36237e29a7631dbd69111bbc0db30

SHA256
8167ad76f9af81d838106b26e02a8b1390c1cf03af61854b9361761c64612038

SHA512
232dece6220e5be1a4b1cb2842a24286dfa40a8de8b4ff52e6603abcc2932fb174fc9868999f4cd773ff1d9021046893692527885311eb845af6dfac2231939a

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
294e090988f7b03d345b8a242cb55108

SHA1
aa0849866f634f8eee649effc37f1f9c2e78ef74

SHA256
28218100203ccb313e04b2375ad1e99565a7baccda15679f5c6b551dcd402c3d

SHA512
6f330e411da775f86f0ddc01db767f2f14ce0714552a13244e38e1d1575f23c20fce7155662205c7b2da761dcbedad6f985598bd1da35255f89390e513233940

Download Submit
C:\Users\Admin\Desktop\MountOptimize.jpeg

Filesize
651KB

MD5
333c49017d81942b3f8212b8b78a4e9d

SHA1
a997cb5198dc88b108fd8a2c41d146510f2aebad

SHA256
2c449656e094e84c8973b3d13ab0b0e424643079bfddecc95a2b7e3dc41780cd

SHA512
6b1bc72e50eb8006a653d5fb1db5c167ad8ca382de1666d24b24851d362116cb61571ff41bc6373a6f3149f9e63181b8f1ca5f6db77a4afad3625a16e502b065

Download Submit
C:\Users\Admin\Desktop\OpenUninstall.mp3

Filesize
535KB

MD5
fa126b0af8cb79fd5f5859400276a739

SHA1
6db61a3ba9f848af2c4df3bfbb730488f768a0da

SHA256
2462dde1d0bc111ee57ee8f63ccc3c95b9244e05004e76532ce1ed11cdcda3f0

SHA512
599e8faa07937c818d5a86b87b057579e3bb28cd446d5533ec62ab007e570ad14097395ea01e5fd47b8fd87e3a9e353245435857abb25aebaefd1d992b3d8eee

Download Submit
C:\Users\Admin\Desktop\RemoveSkip.mp2v

Filesize
674KB

MD5
843b81061eb898feb3688f2253b52362

SHA1
2bf251d80c3e53b6e8dc2e01bf509751c5fded7b

SHA256
8842209c6fdb91ed1f015ac77ceae163a3dc6cb75cb366b5f925d3fa809a6e94

SHA512
a6a98eeaa07b168a3a2427267ed230050bb8bc25e6ef6bd15d72370a5b985809dd705104cc411f7061b0febb3474580fea98385c894f826c68658cd202db09ec

Download Submit
C:\Users\Admin\Desktop\ResetBackup.xlsm

Filesize
488KB

MD5
014a76a64c34d4c56319537e1c606cf0

SHA1
78c33b6037809816ec267c3e84d77f39140c91ab

SHA256
4d937d4f10f2a5f7346d39a8edd00fd82dba3105fa1bbb31faac72bb17e1b7e2

SHA512
dbee354832af53b0dc1f96cba6dd2c7084193e1272619886035808609ee8930f690bb9df4fffd8f9352a2368ecc513a03e89c3ec08255bc09097f41be5dbb1ca

Download Submit
C:\Users\Admin\Desktop\SplitExit.xht

Filesize
418KB

MD5
ff5831df9705de8eea2e0bb57df34e81

SHA1
f7433f694bdd4fc99f21d5c66b7ba48c16f639ae

SHA256
2aa2bf141bc0703a225b7f4b01a17105b84fee0010e2625c83ab028892d201be

SHA512
dbe71ad5e262bb4e3dc335f7fc4b1e5670894c29e3177888bb94f7b0ca6618309875c0c953e3df0eb604b63dec5dcb670b89bb3f448a2ec538f4a88a5a0f0b4d

Download Submit
C:\Users\Admin\Desktop\SuspendReceive.iso

Filesize
325KB

MD5
b8b31f6c463d0b11d90ac456bf9d2384

SHA1
a0687581a9c6132f336e9ca07d3fd639f9f12985

SHA256
2bd8f8b5e5a8eee1f60ea53e777439592a26b67ec7e7c077d4855280758837e6

SHA512
53859a4d5b9cf6824ed4a5e4d2983508110f37e56ee694601f2fa80d08ac6dc92e77bb57847a04fa484751c3048ba82f3030f96df3d6dab60d1f9f14f283aead

Download Submit
C:\Users\Admin\Desktop\UnregisterDeny.mp3

Filesize
721KB

MD5
365e88300778f9b1a74eeba916cd7969

SHA1
2520d4843ee8347af6fb4297b9cb09cc3f6f1856

SHA256
5ebc235a5a71140b117dc5338d3f25f4c497e87e7135516771ddac38b8908ef8

SHA512
46f83f25234e5efef718c02f34dec86d9bdf25d40e9a675effce5ee8d5f9b94d99b57d99cc9895497897c7d749ae56ddcf52214d967379c0c2f06784c88d2ba2

Download Submit
C:\Users\Admin\Desktop\UpdateUse.mht

Filesize
581KB

MD5
df14310f1471f6b5e1db1d137e1e33cd

SHA1
64de2b88c68572df85b1f7e9eff65fb46d7755d3

SHA256
1b0bf5d69758e4b2c60e0a378be5003374a21fc5877ac6eb08c4475803b90969

SHA512
28ad96fda8fd390a03360049210d349150ec73f13c57f2645771b6c1fa6a7c3b29d5de5d482d74554dcfc930077423faec9ba05c0127019b38b78c252743e81a

Download Submit
C:\Users\Admin\Desktop\UseOut.jpe

Filesize
511KB

MD5
11a81cb8dc66b395d918c48c8d98c862

SHA1
30eb2d27e28a026ceeec1b118e8884296d1616b3

SHA256
e46acf61b50f4d221678947fcc80fc9f171a91bb74ea345529aa75065b4fab1d

SHA512
654cc2f4dbe2d51b4dbb4efe863926c979676bcd586f4106612b76e45e10217d9fb674472c833f4340c80e3423dadcd2036c66c0dc497e26a5250ea95712efcb

Download Submit
C:\Users\Admin\Desktop\WaitReceive.wma

Filesize
628KB

MD5
9649ffe3f275893bafa1f56eca1b1372

SHA1
5427630856f5a33f5e74abe23471f8d587d21f56

SHA256
629c0ff4624380366752255427344b284d63b397a7f92c388af58b02a5b999e3

SHA512
b7f8abca85ee97b302be24b0718e3cef0f6e0ce7fe5c87fd9dfb5e8f65648cc0b51116f23d3f9a29796db2074c66ed582afba79d2ec154183b5ea36b00efc27b

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
48b4930fbd965dd3256a1375078676d4

SHA1
6dffc680225dd3eb1b1de02177024f940f836607

SHA256
a22488a54111b5bdcc13f7505c33dc06da7ad7dcada4c94df9fbe297598d8ab2

SHA512
bfce3001e53d630b2e40b73c3a3b1624364c13bc0e14ba432a63a1d3362fffc11c5a2cff2a16a667146f13195aacd749bc547f6d3139534656da5146b14c2ac7

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
fd4c2f08983c59e3b590cda4b3ed39ac

SHA1
9f3022b150fd2b68f3552f07b5c21576e4ac3dbe

SHA256
6fe6679732397cea6cbb444f9f74cf8419d2513610b78c09fa97240df4b8e920

SHA512
a63068eba73fb8bc7b5772fe844c66f8b4f4ccf3e126db62cd2124023b35530116b804385b6e6dff268febc934a0034702c5cbeab5697ac46900b3edac848960

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
200KB

MD5
4d5160d36ec2a4ef7f7c06b484c9e193

SHA1
683a6cb41e64104cfdba912230010f1a5cc7c974

SHA256
a5a7f50789e27d713b2d78ca65c3b8aaec6cb073a3212131101bf6007684faa8

SHA512
b889be1b62d6d37b70b230becf587689b01e52333c14de5414128bc9536e59ef8b58edfb285d04fcfdf73db37d3cb7fbc4ef0f40cd977d4d39da297dd9623f7b

Download Submit
memory/4480-1649-0x0000018BD8BF0000-0x0000018BD8C10000-memory.dmp

Filesize
128KB

Download
memory/4480-1644-0x0000018BD8780000-0x0000018BD87A0000-memory.dmp

Filesize
128KB

Download
memory/4480-1647-0x0000018BD8740000-0x0000018BD8760000-memory.dmp

Filesize
128KB

Download
memory/4708-1707-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1703-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1708-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1702-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1706-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1705-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1704-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1710-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1711-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1709-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/4708-1658-0x0000020F6DC50000-0x0000020F6DC60000-memory.dmp

Filesize
64KB

Download
memory/4708-1674-0x0000020F6DD50000-0x0000020F6DD60000-memory.dmp

Filesize
64KB

Download
memory/4708-1693-0x0000020F75F80000-0x0000020F75F81000-memory.dmp

Filesize
4KB

Download
memory/4708-1695-0x0000020F760C0000-0x0000020F760C1000-memory.dmp

Filesize
4KB

Download
memory/4708-1697-0x0000020F760C0000-0x0000020F760C1000-memory.dmp

Filesize
4KB

Download
memory/4708-1698-0x0000020F760D0000-0x0000020F760D1000-memory.dmp

Filesize
4KB

Download
memory/4708-1699-0x0000020F760D0000-0x0000020F760D1000-memory.dmp

Filesize
4KB

Download
memory/4708-1700-0x0000020F760D0000-0x0000020F760D1000-memory.dmp

Filesize
4KB

Download
memory/4708-1701-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

Filesize
4KB

Download
memory/6112-700-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-696-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-701-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-702-0x00007FF8CBAF0000-0x00007FF8CBB00000-memory.dmp

Filesize
64KB

Download
memory/6112-722-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-723-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-724-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-725-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-726-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-727-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-699-0x00007FF8CBAF0000-0x00007FF8CBB00000-memory.dmp

Filesize
64KB

Download
memory/6112-698-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-697-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-728-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-695-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-694-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-693-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-692-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-690-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-691-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-689-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download
memory/6112-688-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-685-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-686-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

Filesize
64KB

Download
memory/6112-687-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

Filesize
2.0MB

Download