798d4aecc203b9bc284e5e031b5678d6f89311e5b9da8ff735e41d8eb3ab07f0

Analysis

max time kernel
1048s
max time network
1051s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dasgasdom3 - Not Like Us (Gay Remix).mp3
Size 6.1MB
Sample240716-t811fa1flk
SHA256 798d4aecc203b9bc284e5e031b5678d6f89311e5b9da8ff735e41d8eb3ab07f0
MD5 261f093309ad46b871b831684a9d1df1
SHA1 9a01424cd4cb1f5b6d6ce4ee0ab75361224943e3
SHA512 ad969991a0b1eceea00e8db17707cecd41a0573774e95db30b111b88e208d80fb3a827354addf07723ea792548b53232a9d4cd34648594ce07268d5f11985ca2
SSDEEP 98304:VWjn0b05KgpKcWd/BKwUTp+orNz9gITrPl0JemfGK6kdWC1a4WQVM:V6AypKcWVUl+o5iITT+nHbdWN0M
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

microsoft phishing

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
44	discord.com
45	discord.com
46	discord.com

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	4824	WerFault.exe	82

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-701583114-2636601053-947405450-1000\{911A733D-F1B7-45EC-BFDB-5429794F8072}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-701583114-2636601053-947405450-1000\{93444080-2833-4296-926F-141A52EB581F}	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
2492	msedge.exe
2492	msedge.exe
2292	msedge.exe
2292	msedge.exe
4420	identity_helper.exe
4420	identity_helper.exe
6132	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4824	wmplayer.exe
Token: SeCreatePagefilePrivilege	4824	wmplayer.exe
Token: SeShutdownPrivilege	3352	unregmp2.exe
Token: SeCreatePagefilePrivilege	3352	unregmp2.exe
Token: 33	3404	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3404	AUDIODG.EXE
Token: SeShutdownPrivilege	4824	wmplayer.exe
Token: SeCreatePagefilePrivilege	4824	wmplayer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4824	wmplayer.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4616	4824	wmplayer.exe	84
PID 4824 wrote to memory of 4616	4824	wmplayer.exe	84
PID 4824 wrote to memory of 4616	4824	wmplayer.exe	84
PID 4616 wrote to memory of 3352	4616	unregmp2.exe	85
PID 4616 wrote to memory of 3352	4616	unregmp2.exe	85
PID 2492 wrote to memory of 5068	2492	msedge.exe	96
PID 2492 wrote to memory of 5068	2492	msedge.exe	96
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1792	2492	msedge.exe	97
PID 2492 wrote to memory of 1936	2492	msedge.exe	98
PID 2492 wrote to memory of 1936	2492	msedge.exe	98
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99
PID 2492 wrote to memory of 2600	2492	msedge.exe	99

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Dasgasdom3 - Not Like Us (Gay Remix).mp3"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 2348
  2⤵
  - Program crash
  PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x54c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 4824
1⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x108,0x128,0x7ffbe23b46f8,0x7ffbe23b4708,0x7ffbe23b4718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4117744310031586206,5787449905220539079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:1648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027
MD5 7f37f119665df6beaa925337bbff0e84
SHA1 c2601d11f8aa77e12ab3508479cbf20c27cbd865
SHA512 8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4
MD5 d406f3135e11b0a0829109c1090a41dc
SHA1 810f00e803c17274f9af074fc6c47849ad6e873e
SHA512 2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 62KB
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
SSDEEP 1536:6+yyTwrwGtdPDZMlQcadLSHdqyjTxJMJwh09KWWXDManYPHc:6byTwrXL7ZoM28wPIawHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 67KB
SHA256 33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf
MD5 9e3f75f0eac6a6d237054f7b98301754
SHA1 80a6cb454163c3c11449e3988ad04d6ad6d2b432
SHA512 5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236
SSDEEP 1536:fEi8zXSHK4iUHJJeQUzFPM2q/fvK6kqPy4Y1RZzQMPGmrrelJlHTNd:fEqH0U/LUJ8fvRkq64Y1/zzOMrelJJv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 41KB
SHA256 147e0558bde7300e6fadc9284009077a4cd6794ef77d909e502510b23e69f7bc
MD5 9d3881d3c9400536a0b3d78c867ab8be
SHA1 8544210a4e0bb56e91b98a7615e0144432fa4a06
SHA512 2c5a1665e3c3c459b9917944009b1c9027912e7876618cf584eaf9e72040494cc547aa232c925032e7d9a461e95590d1c2cce9f8b1560fcfb714bd69f731b5c9
SSDEEP 768:kl0IOhN+0admzgZVSe82exHGfb019Ull4HEOUDi9JBVBwbrCs3vcFV:k+IOz+0omzP3HGz0UllaEZDi9J7B6rCv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 19KB
SHA256 381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
MD5 76a3f1e9a452564e0f8dce6c0ee111e8
SHA1 11c3d925cbc1a52d53584fd8606f8f713aa59114
SHA512 a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
SSDEEP 384:OdEDMO3OT070pXDaeGj7ZDghRm9nyj4uIttWEDh2dvFBbUDfgAU:OiDM8OTE0pTal3Bg+9n2pItt7d2dLbgy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 63KB
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
SSDEEP 1536:ZNIPgrq59wJU9Czk2BFfKoUwOGeoDfEge1gS+UYSdU6D+sNZnwbo2Fa:TI4S67kEfU11yqlYS1/NZyo2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 1.2MB
SHA256 ba4913f000f60e3762611198396ef0bf07204cb4381a74d83328e6369eaf39b5
MD5 c71e53854f68266b9b7f2151cfcc5c32
SHA1 356fa2aa7d9a8c7585d846fadde297d33166ecd6
SHA512 d261f7efb5490d0e9e11517d1e96d8d090bb0a64584565afe335ab9becb54f399e5eea088156c999004b771f4cabaa107256822bc1c4085194a35744d7915270
SSDEEP 24576:NgbFE8r3zrCLswy29hqaJh/rQZG35WLZz99nbXCcIX6MVuMUUf5C2PT:Ni68HrCLrNhq0/rQqYLZp9nbycIXZVYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b
Size 43KB
SHA256 ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403
MD5 209af4da7e0c3b2a6471a968ba1fc992
SHA1 2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f
SHA512 09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35
SSDEEP 768:7xfuPSX2nNYAD9454MExjs8isUaXTFolW4BJwnlAWkp0AyBiPXK54nDUardRZ:tfB2nX454MeiJaXxCBJwlAWkjyeKEUux
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c
Size 74KB
SHA256 d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496
MD5 b07f576446fc2d6b9923828d656cadff
SHA1 35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103
SHA512 7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df
SSDEEP 1536:m7QOAA9lzzC1CUzr0CvwpW9njABbuJueqby24:XAvfC1Nr70W92uJueP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058
Size 40KB
SHA256 992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
MD5 3051c1e179d84292d3f84a1a0a112c80
SHA1 c11a63236373abfe574f2935a0e7024688b71ccb
SHA512 df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff
SSDEEP 768:FlDXLaMHUbra8omv3ZYL2ZlcB1xSXcqObja/dUUbe8k:rXHH+Goa2Zlc1Obk
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059
Size 53KB
SHA256 f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
MD5 68f0a51fa86985999964ee43de12cdd5
SHA1 bbfc7666be00c560b7394fa0b82b864237a99d8c
SHA512 3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7
SSDEEP 1536:/R7tyU83PW2NChq7BJHJDaslYZ+PKAfDY6+Ian2x:p7tV83PW2NCuBtNaslE+SAfDOVS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b3
Size 198KB
SHA256 dc9de9e44006d0690f5b789a84ce16f558d906d22c3b1647ce72e57bac6c56f1
MD5 6361c5ef86da263bd835f8e1297f9b1f
SHA1 4375c4b574860a75bfb78aca1390ac32c97922b2
SHA512 62fd9c9e0159cf0fb74c223801d7b5b1a76093dda5bc05ac12ee7d45d400e25072149cab951d98161b6718043dbcc420bdc9fb2d496c1ca1d67bdfc7f7575436
SSDEEP 3072:HVRdTByY3iWhjpe52v2Wongeb8OpMNb4dDOY04IOoTQg3Vf+IrNnUoXtrOSynsIY:HVUY3iWe52bob9M14dDONtOolNFdySn
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 25065977932328ea03578050c22c6c8c0738201209df04fccc7a869b71cb6ce0
MD5 d9d546fb977c67585af1394a1266a49a
SHA1 f9a13467814dde0711750323ab12ff4572d88c46
SHA512 2b74de3888b0075f3156af3f0e8a44b7a9ae25b5b7c82aabe7c4e214b19213bfd6cd6bf2d327d722c087a39bd63fad2e63703568672f7c39e25fb5a4df9cf021
SSDEEP 96:cFUGLkJYZyoRWqnV9Qda3onyv6WeKsvBg1W:cFUGIrgOySFvBP
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4ff7a5b98f22166e889409037b1a713f244e9a99a58c923f2bc274fca72cba3b
MD5 2876a5b45bd9d48f442b8d6f2e6f7eed
SHA1 ed42cb83539ea9930acf5a42fba28eac5043f69c
SHA512 7bdaa14c9b2a123386eb654a9076c9397bacab7f348034e7811acffd4e852e960b23bbe4be49e34a9ed295b3c0acece4e102e5445cb419ffa434f5c48f7c01ed
SSDEEP 96:j/Xr08Z97NFFUGLt+JYLwLKSiEWqn39MpcHeMR0tvo0a6JKsr/M5e:DXr08Z97NFFUG5+hLHNUXg8r/b
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 15e6ea6d19c79023157bc952479bf195faaa695216bc806c1b918d9b38542a73
MD5 3272a422c2b761b119e6c53cfa85dddd
SHA1 9deb5c0fa9c11287d9f1cbf6dc4dc63fa6257aa2
SHA512 6b2877412e1541dd94f72a8c622ad6d320109418f81be2a80cd50a7e509b3c0a6758e722b99de0ed9eae5dccf879a3034c0f22b42067af95ea4c9559f142d4c6
SSDEEP 96:QFUGLkJYLO73WqnV9MpcHCJfUdv16KsrS0tC8:QFUGI93iiorSx8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 5b89caec5a6f5bdb0365435c152ff7ece64f83b6c2b87d0db3c8746839ad4284
MD5 6347e12c579d9b2259bfa6f2247bbcc6
SHA1 7accbd938a25ec049582eabc5ab740f576a7850e
SHA512 4f7ecf3bc4d8504caf75dd839f3bd1cd9860432c7f0fa6de98df9a0b5876d6e0eaf1b4f73ec56cf976a935058966fa6a971088c620fea229e9228ee334fc3ccc
SSDEEP 96:pHrI6I5976O0XQAo4Pi+sFV6NVxags9aeqCXYDVbcGC1qSVwh+FSFiyG+Gz:pHrI6I5976O0AxYTs36fxa5aJCXYJgn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 677e00d5ccb60e8d0e2d972d0311ca8ad85eaded8de2bd896bc4b9c685565c1d
MD5 dd7a645ade620e53c8315e06f443323f
SHA1 3967a02aa804270a46d0d9530b6a9dd2296c5172
SHA512 16e705c22c61e3c1f493e191ec9e3cd2879b905c4b38ec5b26e0c33f98d1e983a2b98a444c97b783cc906c451a607f90c6c5e9710597d1ab9520c818f3f54ea3
SSDEEP 96:pHrI6I5976O0XQAMPi+sFV6NVxags9aeqCXYDVbcGC1qSVw+rGYGDYhcFSikiNM9:pHrI6I5976O0A3Ts36fxa5aJCXYJgn1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 8d7a727bd72e4d3c52f77b45ec78ffb50a972b6ef23bc7f04e193aa462890a82
MD5 585cc91a6a407a5772aa59a88c945ec1
SHA1 dc7f0b886dffddcfee54d9d1acd18678903d2bca
SHA512 3da4728b0705d651bebffbbfeb03ec977504a37e48941210f8ea82aa9890e913b766cfad037ae140f2b1072f2b59f52c6003354129ebea170358164dad1ab12e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 24206cb6b84bbdb50c7a01443d86761ce5ca9536ea1c41ce433b2a3d349c0bb9
MD5 4710010ca564529f6127d8cd61e4baa6
SHA1 a0cae6c848d6a654fa1197b9620d4de43949e11d
SHA512 abcfe164b1dee454cca8683ace9231c64b106da957141b2e73010a1a7655f0b8a2d57613671ad56027508fa95b8235268deba3be95b48a1a470dbfc74f5c8fdc
SSDEEP 96:9HrI6I5976O0XQAMPi+sFV6NVxags9aeVCXYDVbd1qSVw+FhcFSikiNMH0GxGHGm:9HrI6I5976O0A3Ts36fxa5aQCXYJx1qv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 f5779f207dada83aeba3e24b728f4b0c73145c5036598e2ed754472758d1bf38
MD5 3e6ba07a9a52dcefba6c0ddeecd0e343
SHA1 ef941ca1ba578b5bf681448a7dc6a1e53edad98e
SHA512 87e5de874c12cae3fab739cb9e3dbf0818985d11828d5e2903680ab6a8296e8c9faee2949f579210b26da59a9e8c54cbc8c36a3e25cb9188a56c28e4ace6a73e
SSDEEP 96:pHrI6I5976O0XQAMPi+sFV6NVxags9aeqCXYDVbcGC1qSVw+FhcFSikiNMH0GxGi:pHrI6I5976O0A3Ts36fxa5aJCXYJgn1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c56b836e57afe4382ae17f7a850f76f6a1cb342f5d0ed2fce43f2f731603239b
MD5 9857da7643322e00fd099af5a53febc6
SHA1 b8c5eb07fc4224dd711db62c596c5f79b0f3d844
SHA512 9fec5d08747a3f6a745b93d5d121521cc56233f6b62921d89e3121fe209282654895722d5d487d87a6ee308d0d88d7b0198cff0a1ab64d61bd3ddc2d8c07342a
SSDEEP 96:nwkpxm/vQYmqY5D1uYzvwpvWMoiVmdeHXDcUWQyV+VDCziEwb:nwkykB5DgmvGWMXIro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ea66cfb84d735f8ddf034a164cad6b781bd731d86629811783fe4deebc58f7cc
MD5 028b3392d3dedc82e7fdc19c6985e63e
SHA1 504a426d7d2451b5840739c2a5090acd8464c731
SHA512 2f5d6db782036045817d8dbc112d81f995c098d970a17300861c61a17ec04b19178c3f0820bb57dbeef87302aa564b12992133f1bc391b5f49f4e7c1ea71d3f0
SSDEEP 96:nwkDxm/vBrmqY5D1upzvwpTgWMoiVmde3ue1/T9XLcUWQyV+VDCAiEwb:nwkwx6B5DgNvggWMnueR9QrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 829d996573425a4101726090ffd1817950ba5e78d2cc330c65ae2d8b92d61d79
MD5 094912fa3a505226ea15245e19859eb3
SHA1 6a66d4279d116a1b038e72a7a762e2a15cf0895d
SHA512 ee72bd61248948456d35214b747870077f652bd36b844c31f76251b383c9959786081e70f45dda4d4daf1f153caa210441d671552bd880ebd0341faedb1a62c6
SSDEEP 96:nwkDxm/vSmqY5D1W+zvwpDmWMoiVmdeOYRMkBT9fwtGcUWQyV+VD7AiEwb:nwkwJB5DUkvUmWM+YRx9Ihrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 c2f7bee4006c97823cb17ebbed7b659643fc2a92be31febdf3c1799562aa4205
MD5 3f6c7d8bc75da46335a30d77e3450d93
SHA1 a9e3c3d75cf6db7a5b7d014165174b1ca9065c95
SHA512 05b33a657d7a719cb164b3a01fa91f248589af36867c822e1837de63a3d9adfffa4e9b6c0776fdf485b6b0daffdeb3e9bc85fae86b8b953724c7da59dd9345fa
SSDEEP 192:nMHkxMB5DURvlsgWMZ8Yid2corSj9IGrg:nMtURtWYum
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8b7e479a82a56d507c5deae77f0912e3691d51665b7b4c4754343de6a3760e02
MD5 976440dafc9b64f3e67f8dfcb7c352a6
SHA1 755e3984e848330cc646c7a6fcab7e94a5186e9f
SHA512 e2f884b345a01f7d003008a5d513186ff741e3775c4dba5b540c3fcc1c7320b1e1c33db18ff9215d85bad8d8e2406efb8d5889fdc548104b5ff7ef6b08d9845a
SSDEEP 96:nwk8sQVxm/vSmqY5D1WfzvwpRKggWMoiVR5mdeOYRMkBT9fwtGcUWQyV+VD7AiEc:nwkxJB5DUbv+5gWMVEYRx9Ihrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 853fb7fb38c9004a64c33fb4c2a3c73155d741a25ac1ec4cb98adbc2e1b0ccf2
MD5 6ac2713e2c8d3217bb322911c6af4dda
SHA1 a010bb6015e9466d2f1fd243fe7c484bec6a9e00
SHA512 109ae4d8ab165d347004b4765dd862d626374475b6af044568a06753a23adcbb33fe39649201e092f6817a2ffb12cf3c058b889564ef66251fb15e8a433ec386
SSDEEP 192:nuHkxEB5DUIvw/j+gWMS78Y1svUd2c6LIj9IdVE:nS5UIeWutaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 c3eb89350cad045c99ea77a22d6624d9c266c44a8e82800315463559650c7293
MD5 7154fd89c01cb37192fc8d5e9baaf9f4
SHA1 a19496c22af0620b86d4620f071a6bc1ddbf86ee
SHA512 fc493c0863d7e4e773bde3db684ba1ac0c2e67cbc074fc316de46892f5f70c3d27244698fc5fcb1f80e53ab53f6119588e59d55c814875e8ead392777e427e09
SSDEEP 96:nwk8sQVxm/vwmqY5D1WfzvwpRKggWMoiZRZR4WR5mdepcBXAYRMkBT9fwtKcUWQX:nwkxTB5DUbv+5gWMZvLjcBQYRx9Iprg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 921b632a6c003596048abe97028e36588343ee6f0beee83c2d5893ca2501d57c
MD5 99e05b070f0ae6ad6535525a3702e5a1
SHA1 5e390827f79c6fac86e5bec76af01093fdac3355
SHA512 19e3bb807bb05773649bd55395ae2625cae2ae05f762c3e38d350e105d6a2ddbda11e07587a3007b31deaa0544d25d6a8cf3007d51e6c25f6868597eed8bb141
SSDEEP 96:n1SHk8sQVxm/vwmqY5D1WfzvwpRKggWMoiZRZR4WR5mdeqsMd4YRMkBT9fwtFcUn:nMHkxTB5DUbv+5gWMZvLwsMqYRx9IErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 f4ceb2fdd0cac3be9df24f4bd3b101133c5643a225635d4612b0bb1a4b960742
MD5 55811219bf1baee76bc112a1069d1b60
SHA1 7d63503b9eba301af207077e4d0b1c9df3f44afd
SHA512 b17715d8e4a65507cb8fbdd4333e64a604a983b13da4b8a200f17e895c7ad3ac4f112b50ba5b086f70016f4d95a75dd4caffe82dc03690b44d983d1a2bc4ee75
SSDEEP 192:nuHkxMB5DURvlsgWMZ8YlcnWd2corSj9IzVg:nStURtW77uz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a6785b46c9c04b18b0d15f8461c6fb04c7a5b7372ab763949ad474d701d51c8f
MD5 01af30f49e593b13882a41802540e4ef
SHA1 cc2c6d989f65395ca58119d1bb30b84d835370cf
SHA512 ff805a3cecc9c2146df2a65f3107f8584ac801a4e8a776c0965a5c0a81d6ba583659fb16aeee587fff06edc1b650fee4957dd6d2bcd1b927af226c80ce7523d1
SSDEEP 192:nuHkxEB5DUIvI6j+gWMS78Y1svUd2c3yqvLIj9IYVE:nS5UItWutM0W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 f713348c20f2062ad976f0c0802389f1f86ac7c4fc4858500f4ac876ff81969e
MD5 47fecfc65adc9f0e889b23d945a64818
SHA1 f1d7614b7e3e301ffd415f1c5a0ad770328c0404
SHA512 4080ebba1e868a231d18c4810e737bc446212e1b056868a1c26e9214735221f4cb90a452ec0f06aa5c33d0cfc0817a3995d94927755117d5d234157397952b83
SSDEEP 192:nuHkxwB5DUIvsj+gWMS78Y1svUd2c6LIj9IdVg:nSvUI6Wutat
MD5 SHA1 SHA512 SSDEEP

Submit Download

a689360cec7c5af0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\5eb2fb6e-6b90-44fb-8edb-5ee4bfab0af4\a689360cec7c5af0_0
Size 1KB
SHA256 77edca8098dbf1c6f21fdd2a0621e2608843e54e1e9c95d74af079de95f7e380
MD5 f7594dd06056cfdf8b14a67c06fdfb68
SHA1 3fbcb84d1185dec94f13f5fb0e74b882cb55e214
SHA512 74b1557aa24504b37a8f8552a1871d1afe8196a2749c3c54b6c1242f683b95d23516359604aeeefafefcd55eb06d37274b8d2774b88710e2c21375175b4a00f9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\5eb2fb6e-6b90-44fb-8edb-5ee4bfab0af4\index-dir\the-real-index
Size 120B
SHA256 fe36c436a70f7502bc5640969eea0c41994e88d0f7aa31eed990ff1ffa34f153
MD5 9b9d1b2b1d8decd8e99c35a26e992c68
SHA1 a3c77fe7bf647031cfd6e6256086d01888bab8cf
SHA512 a3e9f1418f22e19ac191f4da52dddb0c2efdd4bd3cde040273f3b8c23609b4a6d82a6c798e9f61b888f24b402aff5eecd2b561f684c5ab79f0c065738658fbdf
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5b436e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\5eb2fb6e-6b90-44fb-8edb-5ee4bfab0af4\index-dir\the-real-index~RFe5b436e.TMP
Size 48B
SHA256 959d0a6be4652badc0cb71a34e6d09e5c55f21b4957a2f0a3ccaa4595cf88192
MD5 44badb829408722d184bc4c96570bb9e
SHA1 ace716ebdc44b105c96d27a018636d66ceef1f39
SHA512 46d7681407783dcf2708758e584942cdf9fb19fcf8b681cdbee78ce9fe116177f97062c739c73f5d0a4357e0ca0463d83676d19ac0812ac1da44338f70922a0f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 159B
SHA256 2f0a75cc88a56a4d80787ac401c4dd3e0de68e1a3ff23d336a8f0c7e350b3389
MD5 7b27d47ba741120e4d7c0323ca3117ee
SHA1 86e6f52fe3dafe026392b051ee2b82e344b01106
SHA512 391efc371a8612ae4b48a10606e9f4e14ad70ed6f2e42e1da906f01ef076d12c42f4d4be235fa146cf0dae2a23e885d4475ecfa998c58a632a41e3f3e9add72b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 219B
SHA256 02b5b97aeff3e45c42e464616be92874c902f6fd722f500bc600dc4ae9605d52
MD5 7f6dc6d776cf9dc73b60c465c204b5de
SHA1 5c05e14231cf73be0109edfe280e804bf3a75bd6
SHA512 cde0afb0c09f06e9d6c7e495fb14c646cd6fa80a261455a98578a66f9f58813df270d0f4ef12557acc034d209593c768d61d159057c8a40c98b7e4e534b3e99c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt
Size 214B
SHA256 0da2b1b662fb4f6e2cd5c4fce9025d7a1477bcee9038fd2b93698d394c6f595c
MD5 64a7295a09e1bfc749887ad7069906d2
SHA1 e82f147d11b57c441601c9d08cd11a05a3c0f4e2
SHA512 4d1569427d645e340c772e2b9d57fbd12e8a2738d276020d76f12d35dca1bbce2eb96076dedb753fda0ac8256785918ca01d630fc6b201178fbc5be131131282
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5aed01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ba00623a413aef1be0c65618db85f0b8176e803d\index.txt~RFe5aed01.TMP
Size 93B
SHA256 31690a0abcebf3bfc9b9c0e4253613d5314b9f9921d7d47bdf34fbc9d323beed
MD5 a50e4de3f981ed7bc7bdf21145ab5e8e
SHA1 bbbb56bdb2daa8782d43ea23ff5b88f3c590143f
SHA512 3ffb449bea88ed88109505ca027c6ad305e9d7caaef0769614aa5c9ba22544a6bb4b5091617d779eaa7730652d4e548e006a44a227dab416e51a6b9fc9b14f62
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4e8a5c2f3bd5e048eeea07c10547d35b719015052964aa5bae4bb483880cecd1
MD5 079b478d06ae4707c7393e0e7723faa6
SHA1 83f4e8e1cfcaa8d3af90c76fa15203122efbf2b3
SHA512 9ada073160255357bc8464bffcfee04489914c1f202a2a43e1ca87ad7de6294c2f154602f64a53b69af35678ba5252c036c4f8a0568b21c0435c2702c3a9b0f7
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5b3b02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b3b02.TMP
Size 48B
SHA256 751093b28ce089011cff5a0bbaae13320753858ffaa057c9476321cb7f50664f
MD5 6bba9a21b1f52dfdab561194f3769381
SHA1 6b04444309c608a13022e344d8d9b1a08c590f8d
SHA512 682f97a13e548247fba9dfd93c2e3fb7f2838efaab7f32da728b5efa2c80ef6e18a5b709a91ad5a95bd803f33590821d6276624e563f012ea642c136074ffe82
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 436eb70f9ab114f42900d36ed390252a7264eaad396435659e5c8bdc81362ad5
MD5 37e0d0b191bb8bc6b59501ab2a401ab7
SHA1 956979f6b23766a0d7b438fb65716458adabdbf7
SHA512 9db1578dfa5cf51e76bcf952e8531d4e5c032a994b2df1288263c590573023728426bdc6438cf6dcaff62a1e6c9fa33b9462dd463428555b657b2792b82c330f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 afc718125dda1b701296b99ae508c55c7f20ab7a4b2a98252e0220f3676cb439
MD5 b66a2e55c052671b19d0abe0fd311bcc
SHA1 9c419c2469c7b5131e44c04dba8d7fed467824ed
SHA512 6cb80d1bb4da94d2c1e1a9108e52e96512da406e50408b16d999bd5063f8c27eb3db5b3ffea676992b8d20b2223c0f8634737f3a43b1f9930ed485d5b280c1e7
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 b393f7e37f88d1ef25c9a60dd1c5ca2bdbed8e60a79e75483a92f87c2fff4c12
MD5 4927ba966309e3f11630956323e96d73
SHA1 3a3273e29d806f242dea6c1095d8454c70467ac5
SHA512 bcff884c49ae6bc61845f0b50b44a64d9e9f3d1c01d2bfcb47779c36bb4781040a4360d8ca2b95bec3e132a089f4a615a89b59c364bb5577717c2d86db52b733
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 aa39df3a651670b376a6b7a0fcb611f930d49491a7f30e0b6538d5d3889ab46e
MD5 ad7d08a59c1d30aad292a49dec7b60c1
SHA1 1937056c2dddaf6ff4fd8b6fd19137d73c192204
SHA512 092d82b1dba918c19ae9b9c2a8ef9587dc2de67ac97336dbd25aacb4832ae2ad44298fea141ca3ca25f2cb0e9726729f64d9917914022d9df381b1474e38c3d4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 b810d0996f1a34eb5cce262702b39bad204d24fc6a8ec3fa41b30f543524aec3
MD5 46f3fda786557bf37147d45049e0bd3f
SHA1 8029cb43e2c2ab1693d321eccc12895a4526dbee
SHA512 638720c8ed0a9bf9da87f39043f03d036d85c164eef8ae284c9ecd22e65acc23986733d48e75f683b1014a9ccecd52951a20c8a715200f073d34bf0a8d24e9ee
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 bd0316636c76a390aedf9dcf4505e12e28af6b649bfe21aaf8af0dafdf654521
MD5 b217b7976cd5e8f68106cb4b508500c6
SHA1 873fb32cc78a6554560582a09fe130432db04554
SHA512 c222ad2724e25c4f10aa69ac4b98c98800369a285a24f2cd114848b82e54b76abbd0e21a5f5bdf6daa0ef49a1dc50fb528b54f7a766a72b4316dbb908eb276f4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 ddcae210a7f71f319237a2388b5eccf548d56ac07d39f480fe1114d0d0abb149
MD5 025149aef86a80c7c9b4bf2372783a64
SHA1 76020d8a11600c7dde71f4bad019f146e3022e24
SHA512 5deed4af9666214de65eb9c2d05018087606870a25790342ff85f5c6390e7a158a8ccbd14396713cf1a836bb8c70870d379c9562a55e97caa04b190e5df9c7a3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 8fc91e98d8232d5e907a486aa39e5b21dc9981127ed027da2fb32d0f510384ec
MD5 7be185403b583f892f3b0fb00747d07f
SHA1 a911164f0e68b489db950f7f5d2e7faae724386a
SHA512 b64a490eb9e46b7425892be18a9bf4a35df1c3433c4973a3268799759896c81c5617a9b5382da3b44f766b4be7bf4a5fd885b1081361ab978c7eeab0be1cf1ee
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 e26f20e37a686c3447414f5c70db7c57d7f04e4d3a1a5bc30bae46d60d6723c6
MD5 bfb4df2d03f3b508ae53d4531cdc0ba2
SHA1 7556838e7611b5a86f03fc7cab9041bb3bccc964
SHA512 eec9b6ac9eef7311a480e5dee368dc4edb2ae420ff8f242104de33274ab4fc3b9667cbee4784a330d5ee243787492af91015c47d76e4c2a03f82ef74187523c0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 4968ae03f59bb3c2f58f5322d82c58ba7168195d36f5248ccea17f1843136d0d
MD5 ad38da2fbaf728d985b7cd5d34d33941
SHA1 590d5714ae5b579df990ddb34202bc2b77d8de8c
SHA512 d26073f46d90dc63d5e8a0d1a9553d87082ed80a9ba42633cd13601c96aec56cef0d601b5265ab6c1206384b5992e07fbd9e87c8cd5557c56d0f1b7bf8ba13f7
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 70cdb991a6916ed9ecc4abdeab9e3067592b6edbfea5909989802de9608b0b68
MD5 b7ce22f487b1cc7b2e529c7f5734e0df
SHA1 61cb86cd13a7818fce9994ef18000d8fb843bcc4
SHA512 a40a4f7fdc714dd97c6e703a0c8d280e02b02a219e9532907038a80362f1a90c76198301c08c094ab01cfdbb9b0a5da0eb3ccbbb29a52e17c9f7e7ad31747607
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584f54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584f54.TMP
Size 1KB
SHA256 54e061b82d93c7d8a2c54e4875633ff25ab21ca79e263a01f997b681166e7104
MD5 a4cf7dc1280e2876a75dbd89f56b0c24
SHA1 47a597a35bcb5fcda91677a051e7702f58968bb2
SHA512 7101283e0d62112bc9e6e8689ec7539a597e7e797468b586e36db9f7ee88629f304a4337ae06207ed35c7f509f39596fcf5d858525e7c26a71d6778f6da56055
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7437329f8a29ef1118e27e3dc9c57d48d91a0dd943a35d52311a80eb28db2c38
MD5 07cac6a52a867f4f1c2f21d90815cbe2
SHA1 2d9dca1300fb7bff082d6712b5d734659f447085
SHA512 cf20c1e27ab9e9d49f066df78f631c00e403d89c5ce8a6ca0bb68441a15f7003c09d8822b298b94c10e821990e2e0d2e055633bd74236d7d4f49e2a607f3d2a5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmkX4jbG2RUwyeSMrnxTKGZ:A9iIxuERzA83h09RZxY54Hce7pKze+Ju
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 05d47b87b577841cc40db176ea634ec49b0b97066e192e1d48d84bb977e696b6
MD5 c374c25875887db7d072033f817b6ce1
SHA1 3a6d10268f30e42f973dadf044dba7497e05cdaf
SHA512 6a14f81a300695c09cb335c13155144e562c86bb0ddfdcab641eb3a168877ad3fcc0579ad86162622998928378ea2ffe5a244b3ddbe6c11a959dbb34af374a7d
SSDEEP 3:yBOXZallkltlsl7pl+e/lls4XplsMlZI1Xlldl0lcNklltlwzl4hR/mll:ykXA+1E3+e9XplskZI10cAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 545161c06c6cbed6c39dc77ae698bc9f15d355007d5866b9baae84c64c652535
MD5 54ca410d9712823911c1719c141c0e69
SHA1 3a9f93a94e87cc0a08677f98740e787c8813b1bb
SHA512 395487485335fcce03b63bc598b6b4839df63fa3e9dad0cbef9a4e08d283c3a9619b1e794f50742a86ba509e9323aed3f442d9441417274f176ef494a6f5cc57
SSDEEP 768:K0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaG:kZP2tFP3vqY8gqEMDGTaBacg
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
MD5 SHA1 SHA512

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 15555a8a91e62b45983595ad7c9b16871f65e9d7dc02f2ca16d4dcf048bfe3fc
MD5 b542d3fc87155a7f3f875bebb92bfe91
SHA1 a572cda92ccb2452f271fe32922eb9108dff1c63
SHA512 ee20291af208bee417eedda99fbe241f63111fa35e8812e369de9a3c206408c5a34e09fbabedd555a973ba30edc47d34770671ec3885b8fb46b9a9663ff47171
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4824-32-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Download

memory/4824-34-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Download

memory/4824-39-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Download

memory/4824-31-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Download

memory/4824-33-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Download

memory/4824-36-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Download

memory/4824-35-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Download