hxxps://www[.]dropbox[.]com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=0

Resubmissions

29-03-2024 12:16

240329-pfrh3sgd9x 8

29-03-2024 12:11

240329-pcrdxagd5v 8

27-03-2024 19:52

240327-ylpfcaaf83 10

27-03-2024 19:06

240327-xsc58add5x 10

Analysis

max time kernel
260s
max time network
277s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=0

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
4528	$uckyLocker.exe
3448	$uckyLocker.exe
1720	$uckyLocker.exe
4192	$uckyLocker.exe
4832	$uckyLocker.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3320-1124-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/3320-1145-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/3320-1245-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/3320-1312-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2724-1332-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2724-1463-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2724-1492-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2724-1504-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2724-1519-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2724-1520-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	ClnShimg.com
File opened (read-only)	\??\B:	ClnShimg.com
File opened (read-only)	\??\A:	ClnShimg.com
File opened (read-only)	\??\B:	ClnShimg.com

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
44	dropbox.com
45	dropbox.com
310	raw.githubusercontent.com
311	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{A73A3869-42FB-4D98-A001-AC473BC38365}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{02DA2B6E-DDEB-4370-9537-1D59340C5995}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 456128.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 424743.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4292	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
4840	msedge.exe
4840	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
4244	msedge.exe
4244	msedge.exe
3456	msedge.exe
3456	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
3320	ClnShimg.com
3320	ClnShimg.com
3320	ClnShimg.com
3320	ClnShimg.com
2724	ClnShimg.com
2724	ClnShimg.com
2724	ClnShimg.com
2724	ClnShimg.com
3208	msedge.exe
3208	msedge.exe
760	msedge.exe
760	msedge.exe
1772	identity_helper.exe
1772	identity_helper.exe
3436	msedge.exe
3436	msedge.exe
5116	msedge.exe
5116	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	ClnShimg.com
Token: SeDebugPrivilege	2724	ClnShimg.com

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3880	4840	msedge.exe	84
PID 4840 wrote to memory of 3880	4840	msedge.exe	84
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2428	4840	msedge.exe	85
PID 4840 wrote to memory of 2280	4840	msedge.exe	86
PID 4840 wrote to memory of 2280	4840	msedge.exe	86
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88
PID 4840 wrote to memory of 4528	4840	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9153446f8,0x7ff915344708,0x7ff915344718
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7564264472981571951,1440162066714339108,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3916

C:\Users\Admin\Downloads\clnshimg\ClnShimg.com
"C:\Users\Admin\Downloads\clnshimg\ClnShimg.com"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320
- C:\Windows\SysWOW64\explorer.exe
  "explorer.exe"
  2⤵
  - Modifies registry class
  PID:4020

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\clnshimg\ReadMe.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4292

C:\Users\Admin\Downloads\clnshimg\ClnShimg.com
"C:\Users\Admin\Downloads\clnshimg\ClnShimg.com"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
- C:\Windows\SysWOW64\explorer.exe
  "explorer.exe"
  2⤵
  - Modifies registry class
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9153446f8,0x7ff915344708,0x7ff915344718
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2204,8086445628659366994,16816712104100411768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Users\Admin\Downloads\$uckyLocker.exe
"C:\Users\Admin\Downloads\$uckyLocker.exe"
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
45c45d903150e99bf5f7e0492c8ed96a

SHA1
82c647ff5492b5c66b1beef41fe738380b84c4f6

SHA256
73c267abeac4c2e6f36de5713bf22419442d4e9654d607280d116adad1c09664

SHA512
d290cf1e8ca9b2e36e5f5c13afd72a3796781d47c640dd567e159e2063681f258c324e6c57698b381e21be9f1e755e2d8d87465c13458fa00d0e9ca61d965955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
43a49be88303150efff87d53ac7536e1

SHA1
86f7be6b51d364963083561ad56e97688ff4ee5a

SHA256
d5d4960d58cca1f60eecbe9e214c12b73cf69f0efcc637081b4fa22d44b8bbbc

SHA512
f0a5b5a3fc431d5dc8d4d09d0c13ad3ed72ad6c32a80ff4fbf489ddc39d3ecdb82d596ff5905da34bc5a78ae094239f065a93a60b047010dfd17a7c516d09b6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
34KB

MD5
78f6deae01acd53503f7a24dd5e8687e

SHA1
42a22741284265b7c650854f96e87a329fdf4658

SHA256
44925db90095fea99c8c53907a211fd41a3030820b8715f17555c2f14e45b6c3

SHA512
901918cfafa64190843380a226ece2e47015cbf55831de8be92f70a8eab212cd0b0289379bc4f2ce1d048d0485bdace690ba9bbe0b570ce64f615c8b7f518564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
67KB

MD5
88a552e6be1ac3978c49143983276b3a

SHA1
dbf4f4dc62a3da564b1a87b5191dc9a72a9b9423

SHA256
927121d8118a41fa3460b9ad84daeae59ea60dc9607e462b7e1341bea60da8d5

SHA512
125b13be3d209ff5cc12d8f9f12d01d271cd50c2800059241ebb419167c21adfa9d979ff6b8d88052f5d302e98090b7c8ceff4894b397168d8ba6d8a6204fb9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
1.1MB

MD5
93feab00f76536d681c1b77eca2c7caf

SHA1
c48cbe893b3178a56357c132cae2fa63918d790f

SHA256
5da61564d6ae3fa4506522460d177f8b642b20bae63f81cee14b9ca71fd49226

SHA512
6276f945f1008c70bdc559a8d6a14c609a033af2fae6bd80c129da546e7df6cfb3fcdcc452508df8ee5be7a0a87a6f9930664b8b9726c4e52877802a9ceca5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
102KB

MD5
b1feb432a654df46fad22501cae703b8

SHA1
1466864d5146bb1e0812ec5d3ce7cf1d89bbabc9

SHA256
2369235ad4f78dd907ff2cf0f268d0be65be758f2061f6da0e379d4cc823d195

SHA512
44554174f38b50a4e7deb578a6f62f30212c042f0308a98f82f3c2a99e08c98b3045652b9f5a9623ed9b72abc7e4bc1e297903b23e3b31b4d97cfb4cc8559aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
32KB

MD5
90af67e8fd4d5ab0d104b28b82a5f9e3

SHA1
0172e38010ebd25ebcb3f0a4094be0e20f72ac48

SHA256
971b268c15450ab1dded5c1e8e7875660b086b2ca6c45a31ddfa82486b1d06d3

SHA512
ab10e3bd86abf1ae574133f34e7d5a8bff59f3bd003ba42da7e6b3b8744abc59df74b7b71b5c83537a2342adff2aa175caa0db5e5ba7f3a3e480820ef52b4672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
80339791644fe2909d3dd106ccf26cf7

SHA1
861eb7d1f486fc1c8a02bd3277054e486a026a70

SHA256
5c7ed1ae73bc836f09b9c2a83284ef4cd77792102ded0183fdfed64faa70ece8

SHA512
f8668feaf6156381ae911b1840277814898ea2814d467241aebd76844ac70bacc2b1579e4bedd0924f5b4bca87dc9a9cd5a372681225a63c59ab5addc8edcfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
36bab99f1c19b9cdde0d389a5f8c36ad

SHA1
4ceba2e422c62f5bd540e3474708a4f02566ea0e

SHA256
cfde51a9a0e6dccfd4d2e1d345c6af48ba9d404181fe5e262e4437ecdef3a343

SHA512
8c9e2d709589824fe776fc6db79d12c148b23e95b75732eeb6c0a286d48fd4d72c60069b9fca4517b136987c3ab8dcc6a637a76e7df5af4df4dabfb19a17ab82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
e124b4b92f73674566cc7f2e1cdb248b

SHA1
b44572b24c42ac2d185904d98945e05babdfb970

SHA256
45d7cd041a6f90e2683ddb35b869f5e81058d3bab8212927a8152f8c2c98fdd2

SHA512
3df7f2f5b0aba555fbb7b1e38cec62f1a6149642464118312cfad9fb702da1b53e89b781123f5ace3c7d93c75ffd74396e918e02b68f2265ce24034337af4670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
b42150ac2b12a66d2c705ee66c2fdf4d

SHA1
b7911c2d12b777e8118e334ee9f40b78c1de7083

SHA256
b386fcc9103f8bbdf9fe145fcebea95813899a3f4182f2dc7ba5d5d0bdddb2f6

SHA512
23dd442d3cb43f2ccd1c75793e9551ff7b12567f4c46f6217d312df502d917c057f589902c04c6a9fec061505622fcf1a7f2da85f20ebb77ad1debc0d7f20950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
32KB

MD5
9d943436fad2fdc3d14592a16afa1fcd

SHA1
c969a0f48562999ce5fa292cfac31a24056026a5

SHA256
f546b1bca4272223af1441eacdf094fb16b75a0931e5b5b41a581acb88eff7bb

SHA512
ed3653b5e91512ea251d55db5a1f2e3144f3834c631e2f239d5a88b8c263daf46c91e9a19e0304977d285823a2f61744c83e6946fb429397cd20d5711b403903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
ec9297ad88bf3837569360783e74832c

SHA1
a8ce4741d38018509cac849ced050c7407a42c13

SHA256
eb0c37e1b4b3831475dac9e93ab23c5b32ae3c7dffb62211dd9db1dcc2197e32

SHA512
e7e9d680406a7d97867a9d01b63b40688c65c08cc9a99a0c1eaeabb802797d4cd242ead69ed274c1aec464de312126d1693704c095f8f6a74c6dcd3a6fdb3225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
fab2e7bea508f71612b28460d2deab18

SHA1
f2101135a966a95f4ade602b28d4c3a1aaf0754d

SHA256
cb2dfd6de9c8f01d209f6976095e8c6040d6ed842cb099b885322eb666d34205

SHA512
c34fc6f3ad8ce46361ecdaf69de5cd6d15b7cac2040834d299e58c22005388275f350c79fafbd810c2114499a6decaccabb461518441f438a10d6fb4d22c6811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6KB

MD5
e1ef7cd6a8ea9ee51f5ea66bb922b19c

SHA1
f4acd69339a94c8e191534df145cdf1277f24122

SHA256
e494a5926a9a7ecb591db97c36fedc977b998f5106b721d1a5905805f2fbe00e

SHA512
a8d4df0a8e56391d5ffb9602ace693c769a2d35e6d69956476062e31a80c0f60df8cefda48e20574a133dd148e9b6c76845eb775df3b21d6c4b37cee5ef2a01f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
35KB

MD5
55da1ed95d512225c7479df3be3a2583

SHA1
1e4ffd73f53b1560f9aeb5882da8b838663ce63d

SHA256
e12a6a1b1e8cfbc3f35bd55b885efefd327fce717866ba56a022fbf3f509958d

SHA512
fce3ba30799b459e35c86ddd2a3630470cfc8d0983aaf69ecf06c210a4ccd585d842538b1c670cad2e44e41cca673210b351db0c515dad204c0da92fdbef4020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
bbfa738e7ca119976737782d7fbf1be1

SHA1
d726bff0ace807aa13bd2e405db556ab51f680cc

SHA256
1cbda54000fb04f07f0774dd1e347071eb65f73a94c1798210c9dee6b8066d72

SHA512
7ec7e13fc0b45bd943325557eca936659140a940f14848345c6b2057b9733deb75badc185dfad3447d34cbc3901585a88a8db436cb88b0756cccff64efd0b549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
9ce13f32b148b4cbd883e8f0d96e9e3a

SHA1
fe4c6130d121e997eb1dfef99d2c462dbc29c025

SHA256
2cf345d69b8595f5a408ecd74a519f5524145122b9ade527a5a80943f6ffd4b0

SHA512
ec966810d33bdb456d549b567123ca93beaca9a6e88d27cd079b83c9381880fc880b68a41874bbd4cc882b5575c5ab17bff927ab40123bf14cddaac228c5b3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
f9ff166d6c48f75024c88fd76ab1025b

SHA1
80b1e88cea9d2dbb53dc0abaf3c4717897e11840

SHA256
64a978bb7711dbac397b6822bf45a670b29fa8044911029cd5a8ed04b1037844

SHA512
741e09e0911cb007c7b8ed4c59b65c387d01bd88b304528ddb8ee4666f3ae8f2dc74297004250ef50e51ec19dd64205fabe8c6b3cd28d65bdd078d2a287f31c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5f13ed4fe55774212da50c47f2788f4b

SHA1
56d73f922be64ae85af15c3df269cf68b0cb5e50

SHA256
0fc58a6dbd955b16e34934a1b14191cab5c873316127bcc0557bc96727cab0cb

SHA512
1abe93c094bba8c327477800eeec877960e9aa4e2efbeadf6a8a95ab37ece70bb3a90f9ceb29ab410ee43e4d4668bce9014f4b7a81bb946ad98d5d295122236b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
a0bd552da0def672275cd792b3e805df

SHA1
21325fcd5173f675b30565cd98d2c77ff9edb173

SHA256
8080e7e8bcfd3321925adcea4d7a04e20a3998558807390634117b0642ae3d6b

SHA512
ca89c468627341bcb266e6888b076a28d1560f0a8d8ac7e17980141af27369a57928b788732e67041a4e86dcc64ff9cdbd7e67062e9d4f0943039e5cd1c946d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e095a5c9722ef8750fe0f1408127ffb2

SHA1
5104b751ea5e767938daa4606b5bb588b10c910e

SHA256
86cc483ce03b274d7b888f595f91d341ce60edde688eccb9394bbf45dd27499a

SHA512
906fd45c93ca32b37ee12962266d188d9a1d43c5e500d2d0d75660404f63a918e9702b0907654591599036539b0b14b0177e8e1437052e8f9dbf9baa851cb405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
31f44fc41fcdd899f1cba17af133769c

SHA1
100de0e7748eccb413b7be25a66a1f1603bd5d48

SHA256
e570402f239f5227757d0e95ef0e213420de79830e55e0d9d13bdffa605e1600

SHA512
8019c6a4b3692a23ecf8efccd8f7245b13bb9d259f05502911ed890f939739976cd3cc33337380027d8a57ec9ca632226d88c540139c0d5c40f0acac4b230f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
f676b0aa76067ac89605d2f24243e032

SHA1
c56abe52899dddc16ea908fc358cb615a59ee037

SHA256
b48cb6a399cedf41afaa179e4c2cc0b932783c04bc7418684a7573a82aab67c3

SHA512
ca10d5d585dce4f01d1c273e95ca20ab3bdffb1dfc9d2f66a1eb8d469312083c5054077321bb073eccc97937389eea92c8c72509354bd7bff90032629f1989c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dde217b0f1862b1076738933fb45c3ca

SHA1
324f749f08f706e4ee0dfc8eea254c57c652c137

SHA256
2bdf85bc28afcb6dad802a62dd479dfd432e4cefb3afe1905ddc2ce42f139ec2

SHA512
740be823e126f1f2a78c40e097157740bc4c3bcd9ee46399c53cd378912131f32b4433ba5514ecdbabb4dd49bfd2453dc6a9542bb32792ebc8d0e2ce7f8674f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8cbb26a414e39d9b2f008bdd91e1801

SHA1
6ea2b9db397ed742955567eee0b76870b6610995

SHA256
3ef9a791a35e36130c13350e42941ba53d7650059bcf03dd5f8f5d192eed0cf1

SHA512
ebca4f5cc9dcc77abdf24482717a77a0364334c0a58b517a9cc476841d6f67ee45d068e14abf1c4190251023c4cf05cb0c1c4ac88dbeeb8993bf90275b83b567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f20e1de739ae055785f926a34763501

SHA1
332cc1a6162537d86d872b1ab3ff0cfc39dff296

SHA256
07afce8ffad4b82341dea4676c1ccc474b3966ef4f39638ccd22262219845579

SHA512
b0e1e717cc1beafde283261986ba7e8cc58165099fb6113fd8c19f2a6f9b456add07ccd7309ceb162dc5c53aa2970a53e909b8959bdfa26f1a9d9af93615b659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f2b5e0b041b4f260649ae10934279d8a

SHA1
a937ef538bc56a9429304d798c4e5b3cbacc6b16

SHA256
3840af3560b4f1bf8373f4f46d3b4fb9f38ba1993db6cd601132ad714ee2f3ef

SHA512
35c96e1b19e1fdf8c70a3fdf0b1336a9c5052014c6bd7399c2e6d78dbcf2e6031dc84e63ea5d1ee61417b97cfba5e6a5fcc5c7e75c3f50c622aeb74713ff445a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a849a65d694a0acf4c8c17707ad751e7

SHA1
43a2310361eac6799cfed16b1b2d413741e46a5a

SHA256
996e8365c9921d951939b8213354ce8d25b6d7f9db3808d5199c1e0ac994823d

SHA512
b491d6fa14be1d8ac65e3daebdbf17c05ebfee194dd2dcfd53c76221ebf2855d132cc00393e8e1504596eb708bc86727343d14c700ab883b4897b3a5632b49c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5c6e5d8b7b087cd7ddd29424e73b43e

SHA1
2668cd24160177d63fef2db0a0d268a0643b07de

SHA256
477e7e084228806d048d09323136bc25895a3db997f6ee8ffc3ed4fbc3455fd3

SHA512
32dc4417aab0b3cadd8d58a20c00c5f36fb6d0e8b3f6a402c8fc36c699cffbf402df3ad814d20bb1573f83ca7c5816c21124ea8b3cdba2fa09f08b391f723c0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
0ad3446ceb7cd86dd9f58ef250dcf099

SHA1
f21d6e9ad07368e2b9a0e5eab9619a401ee99c7b

SHA256
b88dd8d25ec17bdfd8b68f67fb20cbc215389a2d9c6d7c225d16e4ce2c02fd1f

SHA512
8ce8e77c4ad4f2a7ecfb65f448440055378612b8149b9d66cd5950ee63523cac44426645b812f24891d9fa9bc14049af78b6d82bdac292fd303d1778b0888457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
f1c47616066e3d3ef4d793409c4f28c7

SHA1
6d5cbb954332157627b1a23d0cc6b32b127756b7

SHA256
bf769b3593c1613fac467cc5c6575f515f266e7affe1ddbafc1900d9f0155c83

SHA512
8101308e8d06f0d3c6a7d71e47ad4b3506b7f474e7bfeef849e18d272f09692b4a584bb1ffb9c3656086bc1c6cc8d6e5d596b61deb9e160fe44ea8b7817a44f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13356187896337566

Filesize
59KB

MD5
08f2cd05693b3dfc4b791dbe281bacfa

SHA1
859df8379dbae23773ea598ebcec9539f203bb50

SHA256
a4bca1c753442d1e22bf074890947eb2361e5eec37a5593d8a4a80ab647e1012

SHA512
91021d61ecff15d12d6dc895e7065c364d1d5e9be8cd18ad7878227e97f64a12e948eac463442cb7129c76e59074b19125ed3ea80a88a3bfb2c34fe52b6b5991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
328B

MD5
110bafa51cb76cff9216247819aec5ef

SHA1
b303c3f266715a373630d3a8bfa81e54adc6676c

SHA256
e62800dde2baab24de0b1fd004df4bc95bff264b77ba28de475e7589bfa80373

SHA512
c131e640e1c66049fb46868d32680301984897ef7d2e488d4207246d74e3299b542e47534b63d19d21b3a1abd7d1ca0219740c04cf71b64af200dded18696160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
344B

MD5
c09f5b517f324c80ab4db4f13316e99c

SHA1
b8b10a886689c815be6bf0e7db9bbafa7d56d85d

SHA256
ff59a1d22cbb644819f26bcb1f4ec2852bd2b6b631b8f19e9d1d38697938e8e5

SHA512
7fe75b3dbba9a5975431a9fdf8b71069336a0be67c30488b5426265c3d916e0b28ad1d69743025cfa75908cbb2b95916dbb92eb9ab42761e9b63be7bcfa6ee0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
fd243c7641c5d57bebfe1ce0c98bcab6

SHA1
790d6d74400e045755807fbf8960b86e3f43b27f

SHA256
34cf00c05ee7a7d23d0a63dae8b0ff897492ee5d21e9b1573c7c19528ebaba50

SHA512
2d7048ad93ebed60fcc14326cbe982da31ad48dac56e8423149f4270a145478a2a8b60adc3517adc95216a67b19fee52c7592f8e6407413f5727a1034f5f8e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b7cf3ff55ecb7d96e282f66f639f295b

SHA1
bc087ff026f5780f8bd89eafe27b0d768425ac22

SHA256
e9887e8bff5e903f5625abc0853d27628b8a25180a6826064068549c69a7158a

SHA512
873ac1eebca240131dc4dd27f86257a73c4adb977a15c456f4effb114436b054a59225639c692fc8c661f8f2c85b44c0c7e2e33383d9afca9ea96814ebdc7194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4532b39b3ec6335e3156883565110c91

SHA1
aaa5be110549c6ec44736a662d2f817e870d6e4b

SHA256
ec7d0bbb9c2506bd11bb125bbd43a97d4852879eece28d87dc7f3b6308b283bc

SHA512
319446f588af622f2df3cb74f398ca473b67ea8efd3666aa2b347150da96ebd8fca5ea626291b5d9683e82cc1f8466d1f1e614fcb4586d611fd1c9c2d301ce27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a63df44137d1093fc88e9882be6af496

SHA1
77d670bf5f7419c82b82e246c6d16877959bddd8

SHA256
7e598b0c62cb32a19efb24adbd39ae64b85f1337be29097bce13919c659a6791

SHA512
2bafa8e361f098eac857dd08f90ddc0f8ddc730cc02c9172f23b032c12a3f550a97d9d28468b2fa0806464b1f3151f7763fd45eee7f463318ea151dc848c3125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
11a288441a36c85b2c63ad947e956279

SHA1
189e5de2965ebe71c784ce81212e02d914665741

SHA256
1ce536d5ffa4bd629c5c85dcb0425c878bb4cec13f1b867060ba689947abb626

SHA512
f6921c8b78d5b81196f7b6d0138cf8f63c4e7b72b368a96d993cf467fbc814a4cfad042d8230d33cd44cc6316b9f8e441ceba73cf499b3972d994e7078e88f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f7dfee09ceb42e416da2e5c81bf28d54

SHA1
793d297f4219059a68e294f34a30e8b3cdd38ed2

SHA256
df5dc15d9291ff35ccd584215b19720db62a4d093a1fc010de39c5c7837d2c87

SHA512
ce51f6857291a9869d3a765d094727669b20a60db88dde2f0e6d988ea133d8af8d9fea366becb7865140a1f2899276d61ce0489429a94897ab3614e9781503eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4224a59de527ed49f8ec90cbf5f90956

SHA1
f12980de08a1fb08d81cafd6ae163979e0eb8635

SHA256
82dac5c0d8964bd1c5790bd81b2f777b1842dc2e9dd8ba5b74789379674121ef

SHA512
419292773d3d2068d2d61843ead169de5cb141c138e61fc00587c14bb595bc8940ffd2f5bcc0688178437db70db472d607b6ce63c2b215b4a4034ad97e6901c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e43c988144cc9d40d6e63729ac28c09c

SHA1
9b4681c00e205b8fd46e96ecd44696e3ad593b49

SHA256
e39896f248734ae355e15e61cd9a6e77bf615ff86cdbda6ae26cff1179fc45b2

SHA512
877158711f9a3df86f5de882fed2697dae89fd8ada7e7af77c4659abbfa64529d7a5a9b6aa36ee7e3e031a63406ecfc8e59ba6aa47271951d0a631fb50e75fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab05d4ba96294a1bff887e7797476629

SHA1
e4727f8bd828b1654be5ee90b0f01b5ff838d839

SHA256
4060e4672fd48394afbcfd1a760a3ae1d6d5e3cc3e61f1ab22c13d456cd1209e

SHA512
dfbe4706cd965e8dae404ded74553a2e5fe285d350b4d22fabaa30ddccd89c99d2eafba1fd503cc369f229b864c28ffab15cdc064438157977c780c9056846af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
19a426443d054e0b2e476650eb2788b9

SHA1
4a1678e022b2d58675fe3e3b80f4bf23059b3899

SHA256
edbc12afde9c15f171ce28422962d5463fd66f4e3199afef9d9dea90123f6f8a

SHA512
4d9765478398ce8681723fef562659bfbc22ba566c0bea8de0f6a66e4289416b834845f3f06ad29fcf1f1d9f9cd0877780eee3c82fa0834d569d7ff4fb360150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f0f0a7c0f12a1bb0c337b5e82d9ba890

SHA1
c0622a13e9541ed97558004948868b61c1828d88

SHA256
e6f142e8807c88dbf23fc8cac7d06ca3a0126fae22e4761cf804d2ac743c670f

SHA512
bbca25dba98a3359a2888c4cfbdf38f1db62d5f9c3cc4e5bfcdb39b577b15989f9ee64af3ac2a7a2737db495068570ad76d4a4498c95e9e194c8225a8d9ce947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0932f12a088f5386bbb4a6a5aa4c4ddb

SHA1
09da6740f9168ffc173ee6bdc5bc8511d1e5dfa3

SHA256
0d018cf579f60a608251f96f132f25109234e989461c04d94b392116c2b7f72f

SHA512
f02d1410096f624c51b232618b29c28cc9bd2e294bb9f11348d029f3bccc11e1be01ccd41c74f83c63348844e80ad7c6bbe5c2def8253f4a55705ea87bb4e770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ad613b4ebfa48e64314c9ef789f80010

SHA1
f649f1c7d512a102ee690c299836d45d8f9ca8cd

SHA256
902950a7c8f57285bc5e04a8367a89dc10a3dde049f2d35f0d94468381e70366

SHA512
e0f5c82dcb7eefa8b73b270ca76f8f8b256f4402a619d3e803dbb2b138c5570869874ec9b3945b2bff5b48ec3967d46cc6e920e2dde4aafb6ed4995cc659263d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57effd.TMP

Filesize
538B

MD5
b30d8c3da333cb4dc630844e59090c0f

SHA1
1619e2c07be07f0e7c6f81d1b93afb30b8260e7d

SHA256
094124d43f2fbcb659a57d8ed4bc6cb1ee76d32944c52c3f99e0dd8987a4b15b

SHA512
23670bb02eb54d638c1c23b1efdda0e9e7862e69cda657c70e5f9aee2f63426b65b99f98c5fc9a09c8d74f210ba76b59add3999af947f017e8d34cd9752ea524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
6a5a39f1d58539b50269c8ae9d97dad2

SHA1
07f61d673115ac42b94fe98b9e83a320d7842096

SHA256
fc8525538e31edad77897b19981ac72b0efb4569e59514124cda131fed1d8659

SHA512
9b0321581066b83c2c5b8dfb04797824db3fb74df60d61d24748ed2f4e2a259216b3b6fe3e5e1e76f7e74fd7782fd8cb7566fdbbb13cd6a794da032451bd7d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
e4236959be07d1a2e2d03c0493a1d71c

SHA1
2657b4dad9f186b198a2bba7c5df826245094e4a

SHA256
74a665cb721698ce7d189d599ea28b57c7acebe68b325d986a2eac73c234dd00

SHA512
8baadd6ae25b857e1342b3310ea6b76f2b4c47ff7849a15374649e9935e9dd5c9428ef64c23975211cdd74b6c006f003f75d9e21e414badc957106177ff0c78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa6bcc75-361f-4249-a262-7e7c7a33310b.tmp

Filesize
11KB

MD5
49a8ba4f7d015910564b7f77d4ecb18a

SHA1
6ef51de24ca4f72de5bbb941a6bb3176011070d7

SHA256
1e08ff3033a790e07c13a79327ac5d2df14e8ab96bd144edeb4c2ade25319a5e

SHA512
b93e1779a71902c534ba0ba864f4acdbd17a963b1632bc4459740eaa828089615a1cd9d57ac125d030a97b80cdb6ade9e7d0b3af40f635808a7595a007441562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
140KB

MD5
ae068dacac7686d27ee15390d4296673

SHA1
6c897d423631f2662f2700b7bfcac4ce0b923527

SHA256
8965235dd33bededde7b16b79bc82110a31546134ae53c753e31e7c154fe8799

SHA512
cffd5da74b72b082b9171ebeb12961bb6eb7f51584dc95b33657e5485b205c3d124ab93c305417397387450f44539b921c1f2832653ad1985aa84029a7ffa395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
3.9MB

MD5
ecafae4d2e96625be4b796c4251b6d79

SHA1
8c4baba7263751995de57913b1263fdeb7a896aa

SHA256
17ca9ec1633341125d6bf8e6d2d9c3af0c3adca966ad8ee410f01ca183ca45df

SHA512
7320936504127aacd76a574d67ccc263f672938a867b338b37243dadec206ff3c6153c1744dd6d2f674184ebfbc68966cf98fd30b2ba1690b55a68d435ef191e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
ff37fb6e2ae79b35d4bcc7943014d70c

SHA1
006f0b00dbde71ced19f6f41ffb8d1d37f794d3b

SHA256
9c9204ee7c2a355be07403454f05b34fc1f5aabd2e25cf8309b46b28fbfbd14e

SHA512
fb0022fce8f7676c40310f8a13f5d91dfacb920196f33104b69bc8a1d1577a138499be6e5fb5bc21f6e2673c803750b285eda597207a226489cc6de509c6b82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
04688827049ff0d1284d8b90b654b771

SHA1
11036de43d2a99717b0fb404c27e6e20e95242d3

SHA256
c192f193ada5a407612d65a8f3437fc128c9f204747710468e17c2197a550ac0

SHA512
8e5fc8090b0921d028ec7c509b19185f4a3b2f72315e99d81759cd74889e3816b2863a69755161934162738bdd179beb44070a497cb9c428a353ec8be9c6a290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
63e93d2ae931178c898d139c3f417746

SHA1
913d739d1d436112605d4d1640800e44bca8da8b

SHA256
22f7268b25e7e5cc5299a977cb3e7658d7820b1d6c00aa05efb249131c51fe50

SHA512
071726ef16e844983e0f379b9b444f97652596a78d9a66aa865e5828ab39e4bb136d073932fa3f6d888d2997507fe02b0f1ed9bbcba54e17187572d92aafd79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ef213735cca2d3d88f030a64fc01bf42

SHA1
1de8c4ec69c8559e923701b918f9fe0f54b8a52b

SHA256
c95bcb334410c5a52cba1525942bdf8e7623cc497b696db2abc3294e7bad656b

SHA512
d0fc83f953343cc4fe78f245bdb3e35bae04aaefe50300c8bf34cd54725159c433e20e9390d829bf55f991fb5ab3e23f64d386c94a7bbd11a06c9d5e1e28bbb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2b56e969ca7c85d90cfaa1eaa73d5adb

SHA1
2dc46fbc8878156e97e4bcec12adc06dbf112dd0

SHA256
d5401949ee2bb98c6a62e4a23fabb1231deda1bf6c5c1d524c987c96480bdc5b

SHA512
7d41ccfc21af9bef32fb9bb0c5cbe98bfb223dd78d68023312d40823dd2d486c35d885c2476c41591b0f9c10018ef916b889d6bc0e5f242ba1857ad4388ebf0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
023317fc55f6e36d15f1fc5616d288ef

SHA1
eb75b62ba1a38522a6b8a6961cd44e41f4469d84

SHA256
8581d596c9d1a139f2d42bb2474caf0bb132b73352596ed289cbe7b3307b3a74

SHA512
db450436f3463d81904b938d2505c187bcbf5cb62556c9591da6abab024496df72e7cf97b45ec0ad022a94961ba3180d1f660d4b11e6bcc56db0e987662d0bc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fdeca45e004b94219f1b05478e4f2cee

SHA1
5373c3ca3b55d254fda291d11f64e8f76c3c6830

SHA256
67c884fbc6df803b5f698a5fb5b44d90f3ccaa6d2ed8c8410aeaed1ae6d26721

SHA512
e4460cf38b7093a70f7185373e0ef4400c612c25392e3efde0dace1b0ea39927506fd5d51738e1ac4ec6fda174baf15a517743ff36dd3e3638977cb059c7914b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
216a51e9c2107ab7fb80cc10741d53a6

SHA1
c6f9c93d9984831670cd2d0ba8fe12f0e9d2a736

SHA256
e7ab0f66e0096b3521b7db44249a60e9760654b793490f3b47720806f2a4d8d8

SHA512
ea8ab7c95e17ef59fb0e2298b10dcc8873dc5ea2a163bd9d795b2d6350e5fd7e123e8520de854cb202a9a07dd9b2eced3e3b485ea7cd8f2e2129b86fb40beb47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
c6764fd60b9f8218b57cfc5f544b415b

SHA1
d9947991e05cd197fd72b94c60fb09b49003daca

SHA256
145508170ff7fa611cd6797210be45548d702f75feba394ae29ede8f13001798

SHA512
81791810f95c70db1429c91d0343e6ccace3a5d8f93861854454b05d22a5fe0b56ee89f2d7493a831dc4004cf31e5d04ddebe522915f89339c188959eb06e1bd

Download Submit
C:\Users\Admin\DOWNLO~1\clnshimg\sigBCA.dat

Filesize
12KB

MD5
d25fb0f6ad64fa3b3b2cb6da54009b68

SHA1
483686f5d85cb362aac090c4aaaf1e5d87a62459

SHA256
736b1570a7f8b49d3b1d0fef266cd94e3d65cfed68a16bca5c482ab0abdcfe10

SHA512
367068125c6ffc5fef0d916617bfeddf35e5737e6133587f7a5a9a19d503c8aeae424684e4b3c5d1458e11542edc1a0bafc70a307e96bb30ed333179b7e38fd6

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip

Filesize
32.0MB

MD5
70fce706125bda4ca4293bbaa412a93d

SHA1
f4bf58d57814f5d8f5b40fd1055c325e9803165c

SHA256
09d58607e9f8bd358bcd7b5ba8c0279607da4de1f5965d43d8983b7582f961ff

SHA512
ea35caf851a505b65ff9ac9763ad519e50740d01769f78d19ea4597181d7fe78619f87e32ecab94a48e60c2b03e12c5fe4ad812533233d0ae66d9637aa9e8be6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 456128.crdownload

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\clnshimg.zip

Filesize
333KB

MD5
7a6ead4bf07e8e3c06e55d55032dceb3

SHA1
88932777d8e3e0c3e28006959f70d74da9cf6728

SHA256
f55d152a839e2097c82d30dd8a832d7d14bb0436e210abd7aa8474910c79cfcc

SHA512
3cc6ee9be909713336c1e340cb5fe46c451f80361cdc6802eeb049df79e313aa08c0e611d592bdbba4d5f30837df0b1350e5ac3d219c233ee8c6074662dc6b56

Download Submit
memory/1720-1698-0x0000000004A20000-0x0000000004A2A000-memory.dmp

Filesize
40KB

Download
memory/1720-1685-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/1720-1706-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1720-1682-0x0000000000050000-0x00000000000BE000-memory.dmp

Filesize
440KB

Download
memory/2328-1724-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2328-1703-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/2724-1504-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2724-1492-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2724-1332-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2724-1519-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2724-1520-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2724-1463-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3320-1312-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3320-1245-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3320-1145-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3320-1124-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3448-1701-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/3448-1702-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3448-1695-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/3448-1684-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/3448-1713-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/4192-1699-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download
memory/4192-1696-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-1709-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download
memory/4528-1712-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/4528-1683-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-1697-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-1700-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4832-1707-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download