chimera | hxxp://googel[.]com

Resubmissions

16-07-2024 16:05

240716-tjx79azgjn 10

16-07-2024 15:51

240716-takksszcqp 10

Analysis

max time kernel
769s
max time network
766s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://googel.com

Score

10^/10

chimera discovery persistence ransomware spyware stealer

Malware Config

Signatures

Chimera 64 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Butterfly on Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

resource	yara_rule
behavioral1/memory/4804-2094-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Renames multiple (3249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	AdwereCleaner.exe

Executes dropped EXE 10 IoCs

pid	Process
4748	SpySheriff.exe
4604	AdwereCleaner.exe
3316	6AdwCleaner.exe
1212	butterflyondesktop.exe
1068	butterflyondesktop.tmp
3100	ButterflyOnDesktop.exe
4804	HawkEye.exe
1344	HawkEye.exe
1344	HawkEye.exe
396	HawkEye.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 27 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ButterflyOnDesktop.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	ButterflyOnDesktop.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
163	raw.githubusercontent.com
164	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
310	bot.whatismyipaddress.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\ui-strings.js	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ui-strings.js	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-125_contrast-black.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-125.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-125_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-72_altform-colorize.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\MedTile.scale-200.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_StoreLogo.scale-200.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FlagToastQuickAction.scale-80.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\BuildInfo.xml	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\wdt.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-150_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-16_altform-unplated.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\PlayStore_icon.svg	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\ui-strings.js	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-200_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-64_altform-unplated_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_contrast-black.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-125.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-256_altform-unplated.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-16_contrast-black.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-100.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png	ButterflyOnDesktop.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\3DViewerProductDescription-universal.xml	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\meBoot.min.js	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-150.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-unplated_contrast-black.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-80_altform-lightunplated.png	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-32.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200_contrast-white.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_contrast-high.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml	ButterflyOnDesktop.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\plugin.js	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-100.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\SmartSelect\RemoveStroke_Illustration.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-lightunplated.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\MoveToFolderToastQuickAction.scale-80.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\AppSplashScreen.png	ButterflyOnDesktop.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\mobile_reader_logo.svg	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-125.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LargeTile.scale-125.png	ButterflyOnDesktop.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-24_altform-unplated_contrast-white.png	ButterflyOnDesktop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000023664-1512.dat	nsis_installer_1
behavioral1/files/0x0009000000023664-1512.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2114224963"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427910663"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A97E2DB6-438C-11EF-A174-46B829C4B6D8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2112028228"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2112183876"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\International\CNum_CpCache = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31119257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31119257"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000910d3a7c1e28bd46a564221e06ecd81800000000020000000000106600000001000020000000733c28ed68b4cdfb4c7dd63ef7d269de884240d3dc48398fa9cc258065023a02000000000e800000000200002000000064aa1c6df514e173ffda8f611226824bcaf19eca4869b97482d041e54754de662000000006ba22d92fc673c36d6cc636aaf3e16ad193d2ed5835c5871572ea3b40ba99be40000000d6e6c6ca951be2edb275113023b561cf9a05f6c47bc3434e6cc45e153406eee037fda1b2ea608f7dc5b5150cec3b0a4188c639e1b74a7f7d2b1af9df21ba5188	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000910d3a7c1e28bd46a564221e06ecd81800000000020000000000106600000001000020000000c5b6813491e826492590d867f368462a1781eecb7415f38b4db4187abb26db89000000000e800000000200002000000017bc06a713a1f8294ccc6733aed22ea46b4dd432bf89e471c5bb65aea2fa5b1920000000c8a2edbb6538be5c5fddfd6a6f22b25dd43f0e2f97dd8efae22141016726457e40000000f74038761bd6c3480c3f0188eb51aac5ecb26cdd85615157e0c1d52baac204c919c1742b21a86b5ebe02b182c25b4b396ddfae5b8faa214ee19238207f22b888	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01c207f99d7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31119257"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a066227f99d7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpCache = e9fd0000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\International	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2636447293-1148739154-93880854-1000\{7C3F994C-C35E-46ED-BE3E-22B8A09E38E6}	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	6AdwCleaner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 411150.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 653441.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 233789.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 405751.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 409820.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
1932	msedge.exe
1932	msedge.exe
4780	identity_helper.exe
4780	identity_helper.exe
4616	msedge.exe
4616	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
4780	msedge.exe
4780	msedge.exe
1508	msedge.exe
1508	msedge.exe
1088	msedge.exe
1088	msedge.exe
728	msedge.exe
728	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	3828	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3828	AUDIODG.EXE
Token: SeDebugPrivilege	3316	6AdwCleaner.exe
Token: SeDebugPrivilege	4804	HawkEye.exe
Token: SeDebugPrivilege	1344	HawkEye.exe
Token: SeDebugPrivilege	1344	HawkEye.exe
Token: SeDebugPrivilege	396	HawkEye.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
3316	6AdwCleaner.exe
4748	SpySheriff.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1068	butterflyondesktop.tmp
3100	ButterflyOnDesktop.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
3100	ButterflyOnDesktop.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3316	6AdwCleaner.exe
3316	6AdwCleaner.exe
4080	iexplore.exe
4080	iexplore.exe
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE
64	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2328	1932	msedge.exe	83
PID 1932 wrote to memory of 2328	1932	msedge.exe	83
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 1776	1932	msedge.exe	84
PID 1932 wrote to memory of 4416	1932	msedge.exe	85
PID 1932 wrote to memory of 4416	1932	msedge.exe	85
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86
PID 1932 wrote to memory of 884	1932	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://googel.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba97546f8,0x7ffba9754708,0x7ffba9754718
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7948 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7528 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Users\Admin\Downloads\SpySheriff.exe
  "C:\Users\Admin\Downloads\SpySheriff.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:4748
- C:\Users\Admin\Downloads\AdwereCleaner.exe
  "C:\Users\Admin\Downloads\AdwereCleaner.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4604
- - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1476 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Users\Admin\Downloads\butterflyondesktop.exe
  "C:\Users\Admin\Downloads\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\is-8FOBQ.tmp\butterflyondesktop.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-8FOBQ.tmp\butterflyondesktop.tmp" /SL5="$70276,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of FindShellTrayWindow
    PID:1068
  - - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
      "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
      4⤵
      Chimera
      Executes dropped EXE
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3100
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4080
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html
      4⤵
      PID:1468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xd4,0x128,0x7ffba97546f8,0x7ffba9754708,0x7ffba9754718
        5⤵
        
        PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8452 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,134989123307730083,4087286779766399055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Users\Admin\Downloads\HawkEye.exe
  "C:\Users\Admin\Downloads\HawkEye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\310b4f85c50d416c9129161657202094 /t 704 /p 3316
1⤵
PID:3584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

Filesize
3.0MB

MD5
81aab57e0ef37ddff02d0106ced6b91e

SHA1
6e3895b350ef1545902bd23e7162dfce4c64e029

SHA256
a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

SHA512
a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML

Filesize
4KB

MD5
d0ae5affc5a8b8f7d960deab3efe7c30

SHA1
9016b83c34b7ec3282324bc5e6ad68b00680ea2c

SHA256
099cd6ce287bc597bebdc8a63c03a1763d157eb4543b7f21b941b2f2fb6223b8

SHA512
b02b808ec668b0e9fadae82666a0e4cc47a9abe757ea6a5607ef1857e92787b0121f2811e873026a38efa7de682700b7071fb0726778178ffa1bc48657143d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404

Filesize
79KB

MD5
2e1ec063e68a0b582b0c7235bf35cef6

SHA1
a12b8efb0cfeb89ada776adef385327fadc82fb1

SHA256
3b78c2bb31eef26317ee1c2556eeae14ee9b85dc4d7788222058b27dbc23807f

SHA512
36270ebd54acc45b5b056249162a897f9082b8a1a9a18f19680c60d5213c1f195ccb85f22f38d2403b392f7aa2def5f4b3efb25c97c16c8f5894a08d6b03478e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
1KB

MD5
a034bc652a991d72718f8f06f21d6df1

SHA1
f4cddd2c594f57568a5c53c75f3b34ed9fb423bb

SHA256
45fb2cbfbab6ec4e6a7965ae1d8ba8c295c0c54a694c04f12972d4b8c318c4cc

SHA512
c4b6eb16f99a80c7f26e015a9b8f93342aedae9214b34faae1aabd41a3234951852bbee01a49cf699380f71618e6da35417017bbaaa7ee01eb67768cdbe248d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
509B

MD5
c05c1c8aea06b71ed0621758fd842123

SHA1
2b28853e0dbb1aee84c315e077490fd4e3477bc8

SHA256
1d2941dbad3ee1e8c20fd3f6ae26e9a9e5c12343975126e325464b7daa22f1af

SHA512
400134ece50ab2e89674826a5bae103d3f5c9c4f28fdda9f17f00e1e69a0d217db20d556d1cecee709a7baa6ee5d3812bdee2acb038327181a504b3c7f459c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404

Filesize
300B

MD5
b2df595e0e67e036a44a3db95303bb2e

SHA1
739d2a796c501564067fdf1d1cc193c1eb3845bf

SHA256
3a5ece5fcd27a1a2bb83e73829a53f657a2cab909ef2ec178067d21d6406892b

SHA512
55c053d8b5cb15db1b40f4fdb41259b1836d6bf0d51515fd016bdc72391240f213aed14ad1290a3708b25fe46516a72687211a13f7870940cdc620093e3e0bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
398B

MD5
7d15357b63b560cfec2ac220f79f1298

SHA1
3fedf21caa1a20c1483a8ae1996569c8264f3a7a

SHA256
0bc4c792ac7fd38458d7d70db87862d9be690b94fe25bdb840c7b292b7c7ab97

SHA512
b8a13c4420ded21ea4f4cb3d7dba38e42a813cec7336bde1691479abd1e832fd3769b5da7c58625307f24788aa0d7451875211fcabd6fc2d568cb5b63e718595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
500B

MD5
51beb232089fdc3f4e2bf432c0d8e6d5

SHA1
b4c9186d3ea7f3bbb4624900d0a81e7b87c6623a

SHA256
aea1aedf37890989638b9e5a4d53e645e802340f4db3fc4c9f78f6b8aa50d7d9

SHA512
1f4c02305661745401c45625142edf6bf4a1becec7a2729535b67a70c9f0dfa2330804f49f26b51c10d161bc8d2eb36d9ec2d3908f6da0f9dde503b9b24cec28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
486B

MD5
7f0531b3aa8263238bba616623512dc1

SHA1
a3cbd4adbfd40165d231daa423222c96d0bcb035

SHA256
50893a93a7439db7f67711608d345666f09b70d6a9f643cd94e7b7f0d508259f

SHA512
99f034773bb63beabde5e2f53dae77e7e30b7fcd4e4a89f9d6c85f5fd55617c3d0a8a27073f8166d6993420a46a5f70df62b02afbc391b1635cc8bf54270662b

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
9e3f75f0eac6a6d237054f7b98301754

SHA1
80a6cb454163c3c11449e3988ad04d6ad6d2b432

SHA256
33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf

SHA512
5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
41KB

MD5
9d3881d3c9400536a0b3d78c867ab8be

SHA1
8544210a4e0bb56e91b98a7615e0144432fa4a06

SHA256
147e0558bde7300e6fadc9284009077a4cd6794ef77d909e502510b23e69f7bc

SHA512
2c5a1665e3c3c459b9917944009b1c9027912e7876618cf584eaf9e72040494cc547aa232c925032e7d9a461e95590d1c2cce9f8b1560fcfb714bd69f731b5c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.2MB

MD5
c71e53854f68266b9b7f2151cfcc5c32

SHA1
356fa2aa7d9a8c7585d846fadde297d33166ecd6

SHA256
ba4913f000f60e3762611198396ef0bf07204cb4381a74d83328e6369eaf39b5

SHA512
d261f7efb5490d0e9e11517d1e96d8d090bb0a64584565afe335ab9becb54f399e5eea088156c999004b771f4cabaa107256822bc1c4085194a35744d7915270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
43KB

MD5
d9b427d32109a7367b92e57dae471874

SHA1
ce04c8aeb6d89d0961f65b28a6f4a03381fc9c39

SHA256
9b02f8fe6810cacb76fbbcefdb708f590e22b1014dcae2732b43896a7ac060f3

SHA512
dcabc4223745b69039ea6a634b2c5922f0a603e5eeb339f42160adc41c33b74911bb5a3daa169cd01c197aeaca09c5e4a34e759b64f552d15f7a45816105fb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
18KB

MD5
20cf287c750a5e1375c6205e059a9598

SHA1
51a859f5ae68f1c117b0bdec15db8f4d67315df8

SHA256
28b11376abe5d36662fa7a2d6b30b418c021cfb188d35b7ccad291992e474488

SHA512
e64c8da66e33390087c52cf6f50d7a740a3e214c4e630ecb51f0e79b5463d064c42766b71f7098516dcc57cf85d75c12085094485026cd8c3614464b5866721d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000057

Filesize
20KB

MD5
7f8965bc4a6541189bb000b832b3ba4b

SHA1
2cfc6a12844c3ec89d571ec5d87cdd5a0cdc26ad

SHA256
57e9504e17918efff5f382ae00f64cf1203fbc3190adc3774f43f49a883a16da

SHA512
7763d57e238ff0cf43550cada4c6d941a673e0e9ce8020e0b6b1a99af54217c7180c2354edf9138cd50461c07de5e0ad09527e3fc7ef87a73003ac3847dbf306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02735674612cbc52_0

Filesize
1KB

MD5
da14662a13b7f0e1d4d5d7b4bdb3b998

SHA1
e9e69c3ce5296217195cea60dcc4d403a87a1f6e

SHA256
eaf002c97f8580b014c453d08e0230333290a510ed93a87c10cea3814182b9b5

SHA512
8bb5d6a23970a864bd97c8c0596eb820f9aa57aab8d2b9833de73c5cd2c951525c4d6fb01d4c0a6640d1caf52a1af1f920d1fc8067418b57b57ac6ff45bd9ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0

Filesize
2KB

MD5
cf4927d1fb1502d131f3cf7553017d6a

SHA1
da509dffd500e2f71fc80115e00c458164fe58c0

SHA256
ebc80d6a5ebcde3cc9ad00c8aa112ff564c70046eed756d3b0623ce8d42ab73c

SHA512
d07c0c8a6777746f02a29b1605382d137008533b11e4aebef3c8ac49dee3d66ce398a44591e2640beb42910d5229c88e92c7e509913eabac5db0df0b810c1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1927a26afb9a8b4a_0

Filesize
1KB

MD5
2f44f302b7fb29c389592934c8311153

SHA1
8a891579eb33f0fc11841a88bef498d062749198

SHA256
7349228f9b01c840e89fac9d3c2df218d711edfd322ac09c3a55c8f03939fce7

SHA512
c1d63e4f9437941754b414907ffd738fa3e5c0235a00520aa24e43cb89b6087c1ec7c37bde41059c5b0b674ce203fcceb9635da583024d23ea94da54178bf284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ac673f66e12ce14_0

Filesize
2KB

MD5
68cb1c20367b43fffb52db62e063d6bd

SHA1
67cf88d4b7f0d05badb5d55feb8605a2ae852a69

SHA256
1a5e924f29ec98e54cbcaf7a7d5ad4e9cb5a5e166485df39f39fe745cb2f6132

SHA512
b233fee6e4db06932d0bd56db985519086059538ee691644decfca3650c4b50513c66875dd4b0cd0121268ccd040abe1ae7ee1c5e00a018804d1a950db8399f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1acbc71653e61c35_0

Filesize
2KB

MD5
9d1294088d662898a50333c0c8a72f28

SHA1
80fc73099fa4bb1cb6f6ca3d6574bf77977c6230

SHA256
53d347e78194755e846796d137d596f20824fbe429f3548b2afa97866c8f4d56

SHA512
a285a572a8b5209eeebd7fb13b5ba6be67c48f2d3d08c3ec89c80e0488591404cd4a0c0b72766965c4a617f4aaec939c54787e4450afc26b2257740f9f2a8eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ba208775fb5fe09_0

Filesize
3KB

MD5
6d8e25bdf11c9bd75ae92f4e79bfdf86

SHA1
28221bb67852ed7129e69c4c76214637dc5294c0

SHA256
c5a265fb35895311dbc000fd07b8dbe76240b3b1900de6036b0b1d0cd4ca77bd

SHA512
d487985e757a749444e2a6ec1b479c2a202b12f6833e0b4a0f7958ad1bdf20ca1c73b9b62f98215631b604de1299865ba24a37e1a95442ceae2e255977e6fa33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
9facd1569de58a5063fa03d3ada1d921

SHA1
7f7d991c21a4d3fd5ce780fc3d1818283d7ef5a3

SHA256
37c134dbe5dd563ac9a12eeb696e469868548241b7ec4353a4bea768dbe54b8d

SHA512
f48adefbc11c22e73567f6eb58204d370a8d866168a61b7a28d0b13ec5f81975ac80bd8e6bd2224571a440b3eec140f975f406ca92f3b8a933ad66d664846c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26a7bae82638801c_0

Filesize
5KB

MD5
23a5630f1468a1e831dca23c1669ef38

SHA1
65a0819798481c4101f81235fc2c900a2e6bcba0

SHA256
45989e78047966e1c42decc2bd55ba93ce113168413b05dff2fe667ac3901742

SHA512
7bb0070521a8c63e1dd7a336d12b8de76c880555da9bb39140f9ee79c3e86c38acb51814c7e862c149ffcd62908a67204c11fabc3e7ad1e414f007b8d26cf037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b555d40cf72de82_0

Filesize
289KB

MD5
d0de4662cb489d60b062ef6cf73953af

SHA1
251ac8c9dfe9520f9a310a86873d217f5e0d1f7d

SHA256
5696928c3d5976cd0f8461ca5e41436507f7dce64937781dc7bc6a0097979191

SHA512
f909224c11169a72e3a6b464cf7bd7b806fba4d54b04c848e82c419b79bd983fadb4ad07f49ce53b9940669dcedfd1947754981ca39541a0d5fbc56fb842436a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f02c4494b1a18ff_0

Filesize
2KB

MD5
22ab137ea6b8c39a21ec3a345a2a2bc5

SHA1
df1312f8ebcd9a343d51eecc44e590c40e6f13bd

SHA256
4a203751676713d2d47bf78d9bbaa810c6c71afa22a13929c98429fd2d063fd4

SHA512
bed449fee3a31e2a4ac4293d9225c635fc2ae8909fd250e3eafac8fc0966c47f26f1c21db6d42006e6aa2144a484892ab475e09c442816f159e55a5f69305c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\43a97ace6a91d146_0

Filesize
22KB

MD5
df3582b037191cdf8b2bef9cccf1edcc

SHA1
80acc0a46352c0a1abe07baef32f1322a80fc807

SHA256
037f5abc57a295284976f81ea81c749a10b6ca9ad1be93271cef6fe073c0ff6f

SHA512
3c332332902d943a56516dd6f52c68612307327a652d41f54f2d193099e7caebd78a186d2c28719ef722481b1830f040c4858fd9bb9ea96ade056cb823917920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
06c913cde18a6cf16f6beaa5055c9356

SHA1
9a59518b8aa805bba15b736036ac97a48629d380

SHA256
eeb7b70ea51b568248ac19a5fec0db8d4af5e942505e167c852e385ed99ebc33

SHA512
7d40173055c1d96e61a8ef32167c2a54f6fff4ade227918acaaa70dcee2c856d42c04c34b1f984c913dd8ac0cb1408f461d1817ccb2490c86c03dd40deafc37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\46eaef5fa0e7d2dd_0

Filesize
4.8MB

MD5
57617595562bb267a856f8556af4c59d

SHA1
03fd4a4ef018e3afc83edd92f4f55ee6b9b5c4df

SHA256
c5682bf4741733136da38b2f75b74c10cb1807d5159ac4771c8132432baeff14

SHA512
7a09e4e596f80eb8c52f6114ad608d55a9e453937d4da3ca593d2fef3fc315b761452c1f979f5bb44f9e867ceccaca250c6e0b021c9fc1a6a4636fb7926cf56c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47d4e623e47f5bdd_0

Filesize
262B

MD5
e0e4cdd9fb3e3fd1e15d8b961dd6bf00

SHA1
8c4548ca1dc488b388199248e1a0506d79eecc41

SHA256
127e850b67dd36f2a1ab610f65a70e2e3a40685f88b2b0c750b61da96a199183

SHA512
9fd68436d5fb2e3fab256d1edf82391ad78f6f2cccc96c39b092e8689a6265092e1f90e99320cb2575876722f0cc89bc2385fc892a4e197474be0af23aebfe99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\48b1105b4c2874b5_0

Filesize
1KB

MD5
d50be18776099166b2ca20f6437490a4

SHA1
3b91ca2a82c7837d0a6b427ed1b7688a74d7dd9b

SHA256
6fbaf5d8a249e8f3580bc96e57beaa99ee2c6f04a0f2ba85bc7c5b9e33642519

SHA512
d1c2b4491d4ec2f71f8c500bb714140d829ee57a0f134ad42d38bf946c7c62dd54799ab0adf53dd63c3d9f6e4a36decfea68e2597bbb332be556e0a8d3137b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
2618ecd595e2d35f76438d0b22df0d3a

SHA1
a99741a4e113cc2c23c3a0c31a9ec8d65151bb7a

SHA256
c2c8d12cdaa2abff97fbf4046fbb6495c7c53690191a49db4c7b8c9a2f63303c

SHA512
a803658812f85bb553139fa1dc282fbc7b25161748b71257feff0a465f2dffbd11741e61f8ba2bf960f4d6202d88a54a4939fee0c28084ebceead46b247cb15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54621936eea23565_0

Filesize
7KB

MD5
3db8ef2754e7d5c91ea7cfd03b14ad8f

SHA1
afd61d001c2586bd60e62e980871133b0eaafc7d

SHA256
1dba42a80dccef85846f6cedbd3b9b523038c9b7ae07ef229103654c8b2933b6

SHA512
a287bdd48b7b1b153b13062975692b9cc311a726c3030bc014eb02fcfd7e6e86668f697030063ebbe0d689a41ff51cda03b0c48fff4f2f14e3f6733272f577fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\59fc8adf66a76ab9_0

Filesize
10KB

MD5
3dddd4b0f53fe9c382be08017d6e386b

SHA1
15a4d80e57b43b11b90d67a8e2ee6b20d8ece66d

SHA256
27da5b160b6cc2e8169f438c9433d2cfb49a0ca6e7350ca0bb37564004095cf9

SHA512
52ea2b84862309242ad6a6e233722f1daa8fa871cf35424f5c30c5551d12d31a4b972d4a40dee8eddeb9c7d694e7837abfb299507b406872780681024428e36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b2f11f3f15a5775_0

Filesize
3KB

MD5
cb53ee509c954e9eb436fd99f56ad694

SHA1
71f418476ef459f2aae58e067a706f5aedf54b72

SHA256
7ed15169c50dc33b2d07d6e462d82074fc2980ef647cd5c53578abcbac051d27

SHA512
18bb21878a52bb8120158cbadd55cdc9e47904a57eebb127395fd183b3b8caf7e05cb47bb44eede820e6d7bf980e83c9938998e355e5691e9a9c2bbc45ed3a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\603d2267d522446c_0

Filesize
2KB

MD5
9738e5b23c1b17b2a741d1a877ef4baf

SHA1
2f7df44eb8de81399a997b06c125f7edc423f383

SHA256
9dbe4d2b65c77d864c464c8258fcb3c817120821d4d295e1be516430b85171e2

SHA512
6ee6c6c6209ba8160f648ac3b5c602757722c52a442724fdc89bd41abdb629b710a298755a0857d01ee8c2393042e97d0b372f1b2297afcd76ead1cf7d3df67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\632e260441be7404_0

Filesize
4KB

MD5
17c18d3adc5baf85dd0b274e22ad1bd1

SHA1
4875fc3b6096cebaddad29f053173029a01b5a01

SHA256
a57fe2057e00ac4ff1c2f98324451d9d21a78ea41716c99f67d8458e00e647e4

SHA512
f447396f2ac3a2fe31b91a6bd3ba686281bd8b8702e4ede8b836c8b914165f87df0126c6956985c1adaad3e06823d3704d5067fc73a871defb6dc23002e46cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\68c7915356b38751_0

Filesize
29KB

MD5
bc1441950c1a4dbb537e726f86243a5c

SHA1
3c7ccda5bd14018277f75fd4afa499a30dc3228c

SHA256
bb6a57bf59d39e266a13750dbbcf41bdd366623c296f3a2cb8f11b0376aa6b35

SHA512
a5ba97da547a2d5f5f87f6d0337697f292b7308b5b5b80d5f90e7b74b0f7bee3162cf561176339dc0c87db633f50f84015669d83cd170f62b66066b0287dda32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\695c42f61090a800_0

Filesize
5KB

MD5
31fdeca9280b88ddb0e14be412325552

SHA1
3c0f476bda2de1bb516c73325034d624e75a0c48

SHA256
f88738d3841544cf010d42facb8ed517ae9a59ce8d04f0d0d2ccfa4a7cc53ea8

SHA512
47f23e529683c9834d68e9ec05de4824978162dba0dda263c6bb0824cd5f28e72a5c652614494057adc70fd2b76dd9e13f53101dfc44e74fcee56137b2ff5ea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0

Filesize
1KB

MD5
877c54404d7802c1a876d3e77496df23

SHA1
3fb4a3962ea71e73f91a4950ed777daff323b842

SHA256
dcd1996dbe25cf4bcbd7ce40ef5572a3c91478aa4e8c906dc60d1c7ab6e308fc

SHA512
77a7e8c9af314d84e671386469376e82960c2de4fdcb23799ecdbdb25856663086d8e9c6da65910bbc2c4532c0df35f4962afce13764720054d304bb74275449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\718aba49c9504085_0

Filesize
2KB

MD5
02c71292210b3b7dcd9574d0e0613adf

SHA1
84237184b48fc50082efeec4f551edb9ce1d5b46

SHA256
fc68107fc5d38d703cceb8e1f018596171215621d616f3f2be0743cbb684c0c4

SHA512
a87b0e1e86f74359ee3ce5f4d627561d73410d4c0c012d8c6d480e4915b7020eb5081c22a8dba4bb65b7dfe34a8c101fd2a5e10b752d06d7023a99bb882d111c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
68ba7b3975e7dd5d168cbfda78dd2619

SHA1
1e7c9b7ede5e4f9b6fdfcc30562138c98c34e61b

SHA256
1c3439db34449dd7b8e76151c066c336241de2e0f92889d678e431f4869eed4b

SHA512
5983e609da7eea0d3acb75906ad7070386a231a6b4e5d387bfcfc81dcc609bca3854392a3a0fa3d547ebe45b6851cba92af60c00e8b3616634beb1656ac41800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\775df2f7b061ac1f_0

Filesize
433KB

MD5
64608161c84da8e7928c339f07948712

SHA1
5e8bccdc5fd05e075822fc05d1efaddc946174b6

SHA256
8e9819e4e506679ca26eade866d15b0c96ae6967567f2d8255227a18df1a0f40

SHA512
3effdf422a4bed28224e4b66033570e20afe6283fe8e27eddfb11a66ddbb7e88ac1900efbe02c402272ed5c9c5c621c1565f96a495c34f60e43811589877b292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\787cf695466d80e8_0

Filesize
68KB

MD5
9afa8f0b7cc84c130ba27b55dcc5bb61

SHA1
6d8643631c70c410c2df2dcb51b89704aea82f34

SHA256
8b92b30b94c85d65bb336ce4ef3600564ecf61cee19219f084f575cea53c9a67

SHA512
028d11be382ce3c50b3f1dac2e02dc5e5f46162aeaeb790f92dd05b873f4d8388d6e0779ca3834a6d922f7960662cc1c7f56bdd84ab036cff1406f4a09f0d1e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0

Filesize
9KB

MD5
e811069e9dcccabe6f3d91a4b7da8a36

SHA1
7e1bd9ec5b3eca6453c46ce3fb16cf9821eb96b8

SHA256
7c1683a73b763be900fd56691f2a1ca292743917bae338b04b269f6bd40444bb

SHA512
030113f9980d49f88f1fd2b7ee6013e8a089acd32453472c50c4b7b42dbf2903e0dde04ae68edc99cb64b403ffceecae67493ad74a76124586320e07e381e985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e23bcf4dbf5c221_0

Filesize
14KB

MD5
a851d7934b249e0fe02cb540dcbb3a95

SHA1
cc7b4364f84b5ef7b80d57fdc987335d8b39d16a

SHA256
84bdd928f2982bd423c3d62ab09c69035888b04511c19bc2b82daabc0267b734

SHA512
d7acda1bee7de52ed4dd5adada83c9ffd824ba58d5154501195c340badfca5d073ff5f3ad82eab8afa2f86a5bbaf4d3934815acbee1701c3d006f792471a1c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81764cdb356c9506_0

Filesize
6KB

MD5
671c593714b23a431e04e0c1cd1670ea

SHA1
bc4f9e48ec0384a53c5709d43a3dd2ab18b96e45

SHA256
62bdfc6b3d90ab4e524ca358da35573094b5e50f2445eb533daade30030877c8

SHA512
aa30af8121bacdc14558e015a9ce212f390f123e3519095f4718d7182ad7f64325b8e58152664b1023caddb4d55f2e92bd4e4f143b7de185971a2639fd883b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81ed46553792e7e4_0

Filesize
175KB

MD5
da529a630fac2b857b456866076922af

SHA1
f7be8cc1309c1f6071de24e6b1cee1a18644846d

SHA256
ab9f41cb937e6cfd0ca37b73c4c221ba55e4429deb790611b7a97fb515c5fd41

SHA512
5219f81ac7129fd03321f4ead52457daf0cb4324d537649358bb3a4df3edf0fd481487bd3ff525be3af401d211332ddfed75da5aee1d15b3f0658cc68ecbaf20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\87bfea9426cb2ef3_0

Filesize
2KB

MD5
e69122fb077be1894711c96c43c761cd

SHA1
04d5a6eb9b6e24a8d9b37bb9411b1932561fd63c

SHA256
a991b829b335fc107c29bb1979ee8f63ee82e288cca1d12e942724cb7dfea4f3

SHA512
f0406b32baeee8605d5908831dc1275286c77e3b9ad65b1e134f2eea0ded68535a85d4ad85e2fc9f615a2676e0f214956ff6c2d79fdbcdca8b03f24f264fe437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
acdb6bc21b7c3884c12a823ba21836f5

SHA1
75bf6f858992fdf98c4837342fee542b391ebd83

SHA256
7de1e22c5836187c30a0387771c0460d3bc507d008c216425a66f70fcaa32b8a

SHA512
32afcf31f9c693e7707f9546109aa62aa7850a501c61d7774e066fa0de35db1354206d0fb81dc5595fd50bece964c88235dde3dfce42818247a33ce60f549ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ec60ee481b735aa_0

Filesize
262B

MD5
540f4bcf0e4beb1f1d1ebc54371347c9

SHA1
be6e0d5df82986ca73e0895e13fa27cc8e24397d

SHA256
4ee32ed836d655be23a821019e06d7976d747da306ba90dc0ec7b1f38046f379

SHA512
82875f22a2b2ccf353a04cc786447889d321659bae8e21d316c83a4899e6dbff930aa4b09f0a44c48ba5a3ee9fbebbf04e0526efa3f0b570014c04e59cc6958f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ee73a31bd0cce7d_0

Filesize
6KB

MD5
bc033fbe2acab2f656ff579e1d675c2b

SHA1
53c7c2f3660f2fc986579bac546c2454868d41e5

SHA256
2be1dab51cf8989bda61f8f02adc7728ab016aea695afb052ff02adec156a913

SHA512
39fd350927498a375cb5f5e5db9992685076f6d0e1be27f941317fa1f9a1d386cf7fe68290916058f829c63db475fced97997cb33f4c2b394b80ac8c9e404195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
1KB

MD5
917be402c8b11c56aa4e6a80636771e8

SHA1
161b095ce0cf5e4e3ed0e9562f70f8f725915c8e

SHA256
33f14c7d054a850e10717a6c068c178104294f4a0cd2463f07ae41b0b37dbe17

SHA512
780ef52e0547eea02c1fe6928ea96283c04fe35dd441983981cbaf0e7956cfeb3e0e0289854916afe86e9abce613f370c17056efb96733faf76888bf43ec6143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9aee5cd509922cea_0

Filesize
1KB

MD5
8e686cce779a6211fc46a3feb58ed560

SHA1
752537b109c9fd0da5e833095ce5078e4ef5e382

SHA256
0ad93959a0ba7e6656328f81b8a777f53cbefce233306adf431a2dcf8f3e161e

SHA512
231306a467a46c885f412f4d8c1380a0eabf1c31762df766a85c810b999a3c5546071d080301c571f18671700207adcac2e560a29caa1423029cfb3f5d15ad2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c0109f54c03223c_0

Filesize
262B

MD5
a11078f99c993b6029b8256dd8420c69

SHA1
f13bdc7d1da324998d88478302af10afda059df9

SHA256
7eceee75ae4a913d385f97aaa7ef7044b12c451741864554e73ab53d1e60110f

SHA512
c35e869b6358f2a678cd4fed886d0a7eb32427157d9741977c49c6be150c22822d88b4c738710441fcc27bc59042580d7a1536c174128810efb2ccc82588a516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0

Filesize
47KB

MD5
d0cfb02050f882929ec4c2bdb6fde7c0

SHA1
a6837a9d73cca4f7e2ea1fdc5cd8af2244c72cce

SHA256
2ca7d40a17dee80a84a18fa66126894916671da991c2c5de82d3142affbacedf

SHA512
4d06d758857f88006d947b1a26223e157121ab83cd29eb10c8692ed428f28f3be0b726efe317805702717a7ea457adace9d5082191bb0bcfac90509667b3dcb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a267b7c21d8b8c9c_0

Filesize
9KB

MD5
11e68ffc2aa95f0364a13b8a72b3293d

SHA1
f343d0e9e7588633ab73b7d044f9b9cf3406bead

SHA256
f36f44a5536a14992544aaf477f1893b1688572635adb49997e720f6abd7e1ea

SHA512
44399acfc148fe7ff4b5d65181c2bfaaf5d33860acf519b7baed628a249c67541a5cb8a7cd02bf7784292eb199beb3ae677974404f2cf4da8d4e7628ff80cb74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6537dab24e365f9_0

Filesize
2KB

MD5
ba251f226fb52d0fac5f89e857a78d9b

SHA1
cb8ade36c83180172a091cc423f96e384dc46fc6

SHA256
837adb881e316d9cea8b80ccc880d93a79702be2e52beb4b7e91216a392a365a

SHA512
9c64571089b6c18ba06b9bb5181c74b8da67a2fcaa62f2eeee7ec19f72cd79de0ed490f880d912b8230157ba43bf9c2400e4d86b6a84bd1036a6627c78f8c252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa20c296787a3f88_0

Filesize
2KB

MD5
300dfa7bcf27b9d309a3a990f2aacf6a

SHA1
6ebeeb4a6ca794573759d0dc10b3ec46c8c99027

SHA256
06c692c657a543050f8a490b37959a17025c2125fe145899de3fc30b609fb787

SHA512
d4f11e483fd54ac1c0c569d98fbb5226116ee53836669e43428bf33e205dd8f8442a5b5229436307b2abb80288d6378f87aae7e16a9ecb1834cca7d1c43e2a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ac9b40a0411376f7_0

Filesize
1KB

MD5
ee0c10cdf3c1ed8777d47d0e316409fd

SHA1
e93fdebbe0629e9f8014ef0926a287d6f72e0548

SHA256
e0b53908a1ebc7c9803efec53bffea5121675c5f65794451b0c162460d5d121f

SHA512
da7cc13ca8a636c7453a287f14cc62165d743ea5784d379338fc810de6885825ec6b38e4ee35aac7cf8ee8bb6eba2fd27ab6a94acee5c8ff041d5c4ffdf634d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae8d0b05a4b538df_0

Filesize
262B

MD5
6a543634874418b3c9cba2b6fdbe2465

SHA1
ff005f6da05d469074ede6ac15975abaddc8b495

SHA256
afcfafbeea62db4e0ca24efb600858c7b37dae281f7ded051f634e1a80bad06a

SHA512
e69c9058bf31139685fe357d3c9095660a9139d4a5f81e88b8ce2ff21aeb26877481367e3a8de344f93d9b6b82ec229f7c501fe7fe1fd58420cbee822f18bf33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0

Filesize
2KB

MD5
039745ad259b88ef662d54d1b6705ee8

SHA1
69aa1fcab825d27709820ecf5e45fb9d37c61a2b

SHA256
5d50e1a38d37e6a7aed265bc0fe16945606e073112c8d514175fc1229bce8ebd

SHA512
8b7858514a282f7996c4fa91abad3e0e46222d6058433235e751b3773f6fdb476d1adaceba4ade465f34c3a751dabd486075f2bd3e14334c1e71da3dfee3526f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d7d09e2437e8ee_0

Filesize
5KB

MD5
141fb22c9af7d08d0afc6eed0c4814af

SHA1
cf5ee54134834afffcbea19a8c3da5cce31437a7

SHA256
6368861e2b4965f4eb3f10f9a0b091b1870ba942cabaace2ac29b93c3be38daf

SHA512
a500d24c37f745220a4f2c0dfb2038a4a64ddf36b6110fb1b71a25dcae6361471efdc47e6fbb9061febda937caad002f84131725f6206c7d0337f3f7adbdb55c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b2a2ea4987d45e0f_0

Filesize
3KB

MD5
7b14b7183dce40f349165482d846c848

SHA1
8ae238b63f683106698f854199a4ea5c8f52c67d

SHA256
e6fc426cf9ec9a4cff282f02c3efd278e14fb40ddbe35f05fdc88147583be9cd

SHA512
a5da99430e536644e2053c867d19635ed9a4f25d93994ed64e7f8cc7578f2dedf2c89fd90ef92e8c0fcf4f51582a760f26e21a07ee835c665b2184f37b76d72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bfd9b5c29c5c8524_0

Filesize
1KB

MD5
9f7ba47306f22febe3b1832ab446dc54

SHA1
b4e62e0b5994295a357522d3310e46e084e09d27

SHA256
69c23646b551e569aae3bf4f361b646d21877332b0775f59840809a7a7d1ef07

SHA512
843a81dfd7a6ccfbd1c11e1b3581d2c29b1b12afd0feca06e7779045b46615bc06a165258b4f21c3145b6e586ee4b3aef1d5b8723adbd5abe3acf03fff7848c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c44b2d1b8c99d0b5_0

Filesize
6KB

MD5
776260490ec445f0f2bea7db480543b9

SHA1
459fa3a6cdc301c74d03ba77d5662502d8319316

SHA256
82ed23fe7e68e8418b53f245566d2b3a957d157c63475e47bb6c8f1e81df399a

SHA512
1aa184fa27601673758fde888b1e88a7b221df0f3c6eeeca3a1b6224a4b43159c74d90d4e5540669d2ccbe66bbba7c063d489dcdb4f3cc61411e9c6cf85fa8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c807b8e9088e4030_0

Filesize
26KB

MD5
9689b290ea03b927ebea03deaf5676c3

SHA1
86d91b8e1ab2d3a5e48b0ac36ba2e6926f9ff118

SHA256
b5176adac181657473be769eed1a1f268896cec58339d7039b8afc244c0220ac

SHA512
b1489cdcf084e865b595953091543fca8c8b414e1cf7ed2738b9c26f1947c1461e5782347bbc8e33d9fe9476a66c42ca7cc54ba182b37dc84cbae7251ced3600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ceb88c56dd50d3e6_0

Filesize
26KB

MD5
71f8dc92f48de52aac99ffbec9753f32

SHA1
1f56a0d09278d23416c866a518111aec1f6e8a77

SHA256
05f90bd503318834577b0ccd4bd86c27ee4d848acc5769d6cf7dafd5cadf3a87

SHA512
6297ca06d74362c2d043fbecabf404ab11bf5822ff7577b48abf10f1c27218561cbd87e2618f90e0b76cdd7d3c4a42ed7a3b18f0cb6aef125bfdc57d10b2e542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d00019f29c31fea5_0

Filesize
2KB

MD5
cd4b8acc87d3f535cb2c96ab956a8d88

SHA1
80325f3c51b06bfa255c8b94f945ab8993477329

SHA256
3049c08da1caf940e2ba9b7a020226feeb06a6828eefa5d5169feb6592461cc9

SHA512
f509f86cdb9f89fb2e95b37a28115fcbf03efb668e0174d707b4f18161f3477ad827eeba4cf1933eec3fe03b185892e1fb52f5ec28bfdccafef388e0906b43b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3dbb3008455b523_0

Filesize
262B

MD5
fa87bfffb30296c8c88aefc446f92f2f

SHA1
401d7f4978c189741258d2c6f8a7c76cd7265d66

SHA256
619d4ed4014e2fd0236bcdcac71fb9bbbf2dc07c78bfdfc72bbad7d020d14bab

SHA512
53f424450adbee3c1cd44839c86a7d60bacaec3aa1f5ccd30b18688d906b927857b4bdc2826c6c3946506e50bce013be11d79fddd11ff744567eb0e7488738b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d78772b940a6b308_0

Filesize
4KB

MD5
a6e3be3fc633c73486ceb56e7730d1b1

SHA1
0fd2d980e3a7aa24211593c32f86ef61e536e15a

SHA256
9ef8ddf7912a86176eda81f2f164142f78c9c17f77a6aa12c98106a19cd7c181

SHA512
67beb5892fca65ffe46d58d26ff917c669f4940c74469128bbf67291f5618b878f614688a7752af93231f13cd47185c7e9a1e5ab635122f52d2a3ba5a73eea01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0

Filesize
262B

MD5
3c6d22d8e09ad0b9087620720a467867

SHA1
53d761d04a3055412d43e79e50e9bf469edc89c7

SHA256
859f6742ae4506e746a194b076bdf5ed86a0bb699fbfc40cf876cdd45d62b568

SHA512
f9f60bd952a4e3e8ef695d0d3db21caf4c932cbd7b7ca05aad17e98c0a252af2ffa9945939ea505ad036efcd800dbf7179425aafa19f9c4ea261236ce50fe663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daca09b4eb185a45_0

Filesize
6KB

MD5
7573e5e8496452a39d551676ee464ea1

SHA1
4eb3e6740ec3b3f3ea1f363d1fb610c90f67642a

SHA256
4d67358f5ca1594fb21f23f79a4793bc52ad5af379c330475b02752d117f99be

SHA512
bb86c189d8b4ded48b6f329a9b2af891978991a304596220de512a4b2854e53a716ad878ed84162b019bd57e586acc6c10234afe3265406ecc249ccf338dc273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0

Filesize
2KB

MD5
7b0398e485f44e9305a0a272d92fc354

SHA1
b8eb459faef6a24357069ddf5d336a9cd14c8e5d

SHA256
51f9c3aa2108e3a4c1737c480281465d253838bc9167a4f703b44ed03cdcec4e

SHA512
f3cd9919ff1111b1f01ca76cfdbb19a1f7aa0c4fba08129297f6422774e0524f0595199afe064242c5173a0f85399678d68690ea3da27cd14bca1e88335aa2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e3d18be5d494e38e_0

Filesize
2KB

MD5
181a4d607044cbcec67c361cbff208f5

SHA1
03e9c99eada7be4c0676d43676ae30ca355209f0

SHA256
7f9a8397d4723484a523869f60a2c5ed714208cb650e31ac500c76439d0eaeef

SHA512
bf29357d42c240a4aca1481773b54c33ce7270a9695f5cf2be32822f5f9909e4349d0e19d5333309afdfb4a62b467774105d10da824eba595afda9bd6db103a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e4384637ddacf994_0

Filesize
28KB

MD5
a64bd824ba3e5633dbf739ca6051ebf9

SHA1
0a76e1502c4e364adfcfa52d4ccd69494337396f

SHA256
234c257ed09b8d1759397277858aefcb4ebb02e3a46cecf22875de62b7eababf

SHA512
346890236bc59fd136ef9b8c0a7f5dc413426c64b64f16b1d3b58e7a46a3ccd37e1d4c5a6933ccbfb9b90b7b514926cca0f664aa69b671586697ea445b01ab77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
ed2512e5de179fb7b9a9dd6f2c5592fe

SHA1
376f03756904d75cdf9d7997f22fec2171688321

SHA256
a2a98955196e908a3d7e09771385917cc1ca0b942cc3cb4f7fa57bd5a4f45c01

SHA512
a63d74647cbaba5045cc89ebc6abc7a30d5940c4b2621493f26ab6abd8e19947c36eb6c065ef0845377f3e910c7cadd6aabaf3e253ffea7a0b56833e0026f88d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e562e6d43b7971b2_0

Filesize
303KB

MD5
e2895ee8fe7e9eb1effdcd897f1727a5

SHA1
5beeecdd54b6a92911b42062be2f65162d5c1de8

SHA256
b76f55274537986eba8a42b49b69cc1bdb02cc11b2429eb06d73e55b199691f9

SHA512
b337d963972b7e3ebdbfa2dc382fb5c8dcfb199d616415bdbb808a9416489291ff5c0d1173b5221b99dee723a2b742f335e82f7d7a31595435e485453e1bbfb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8f6640eef188435_0

Filesize
3KB

MD5
da61f49ae7e02e1bdab895c7dc5b2651

SHA1
5542486ea44944e3131cc67c86b1c5ab46348f84

SHA256
1101e9262d81faa432de60b464a304f9d98fe894236242a8f34b752cd03eec61

SHA512
6c70ef1e81ad3f74b5284c1a005e27a07fe47d8c71cb40c7c0a63013362adbaf32eaae86ac008f3d408fe6d97435eaa18185f13b798bd0cd6b6a8f5d1e356ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eafdef011b18f148_0

Filesize
5KB

MD5
75030a7de95edc21ef9a30eb4d992567

SHA1
05f9d2f26c5a6e8cd7cdd9d6a40b25a9805b5202

SHA256
994fca627623b087e3ce5862fb3198a1935e53c7405819e570a4e8e51ef0b2a0

SHA512
f49793db005c43d690e00427e5aede3f9d995b8424a07b1f7df27034509f0a638dc3e2d9901890e4bce09ad4c13ef1b2b5aceefd8e432dbbd36174060bf00db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edb3b6840a8ddc0a_0

Filesize
7KB

MD5
82a8df49feb9be4b4baf5062db380719

SHA1
d9a5710e76bd5632230dd3dd52a1394ac5c7e964

SHA256
fabf8d296d54200642e40b9cf6c61489897eee2bc8778c52af097028f6cd5abd

SHA512
87e2973eeab839554bcd08187c2f93e23bd77d12c9cd07c91d38b87ddad75dd2bfebf6ecf0760110e4395733fd76f1e21454ab533315550505fdd16ecb747d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f078f5fb70fd150f_0

Filesize
2KB

MD5
3ba2addef897edab16f485a3f1b57d1c

SHA1
433c4cf4cd1f6ffaf06fc72e02eb122966c10008

SHA256
020d92e76f80205cae5eecf9e7b405a0d99e1c61df997677fb4e5220bc5e9257

SHA512
39ef4d8912188dcb08133aa60610fcc49ba907a2d0168da0ab4d3ab18814cd56acbe7b5ad563b0ec368df30037cb7d7ea7e97ad1dfaa450d9a1b6f4b89de4529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
bcf3ac42ec9421708c8476aba0be2213

SHA1
bc6ef8352834520e5cb8907d6dbc307546151ba4

SHA256
f358844650d084cb71558963d7a226b5a1dbf87332479d78582dbdfeb65606b2

SHA512
1497d68d5f3605796baa790d8a824fd251ffd74175092475556d309ffad62b2e5c5f5f8e8378efb3c36c28790a652ca99a890e1d4bcb27300beac2503644e4a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f89251fac2b69325_0

Filesize
3KB

MD5
ad53123e7d7ce80584433afbdd0a48c4

SHA1
ebddaf391416bc0ef9e44093951fbb1c924d4450

SHA256
ccf023df207a976ad036c479adfc70c4dbe72bb4365bf804bfe3865b840c75aa

SHA512
b586f0c25d4cece150dbb2a4abc7279da13ad82e7529fa9958ad580f2337d808fd322d770b255af80473c5f281d13fa0a1e0efb48ec585996c3f2f741157d488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbbc3b076556d40d_0

Filesize
14KB

MD5
fc85fdb5b4d2279521a43d5a03e42d3c

SHA1
35eec214e2dbaeaff19d044044aeb4546f89e1ae

SHA256
35475e4bcbebca34361f87582c3507d7b1011eaa0eec067644bbf8920c29c488

SHA512
ed7116e67715a742966ce4e3b07ac63b202714b7384f5de682528ac748c8328049d08f8e3819bc77e619309f87f9d64a4da67f41eb8965d2ff22535866406148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
47a2273f95b86cda34a5be2cc8bb55d3

SHA1
5066a2b9c34a667c289c151099d9ea9c7692c2d2

SHA256
8d0858a91ee8653eeaf9c2307cc196bb5a36775c27d5795b20782da5933dfc50

SHA512
4882f00a7d521a518a61fa87e082b27d0001b78f2fe348c15c057f935592991f8252586f4be6fd85c416ad26dae091957ba6572c2445473ee2640ed1957841e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d1e37327c582529c79f18ca6e05977e7

SHA1
e032f4eafa97bd7bbfff3d541121fa73e630206b

SHA256
aded7b6d34fbcf73dc14f3e0f39ca4ba455549ad9d60ad14bdab574d347fd876

SHA512
493191799e43bbcd7acd64cc48489120b3698a6895a3ff0a27259193503452e564db75b69717f5cb4cbee8ec1086b8cdea1cbb992dfff1100ec9a4990847ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
3f7c8063f3ad0e0f1546f940a64f7a34

SHA1
a6522774f3ab16e43c74892b0313934b70901bd8

SHA256
45d1c845ff771de3d5763f4bc80fcde35fae13b45ed44476d8fd38cce56be0b6

SHA512
22305d32146f50c1997c1240efca211cc7dcd1efa1060c9108ffc2a225c454fa3a2d2e9b4cc2d01b4c9aa2064bb8565a9832155d7299a26df8453511642d4ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cd299870fee54ee326e25de2392fb3d9

SHA1
29128a145c0d4932d28dd7ad64554cf50e65a19d

SHA256
aa875cf6fc22086d44181b241e9e8c0e9e3fcc30b05d1f47e8b6fc4c0a604e17

SHA512
59a4e1327ad6a1a5f928dcdee15872df0fd724014238442ba2735df8cd60eb0e36e98f215842ada54a6ea5412c9761b50db9c0be2fb123d500abc4ab8430861d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0ebd1d976b92c086f7cf5442914d7821

SHA1
7e1e6fbe7929b38522c1953e0987eea1e5943c01

SHA256
842c55555e192d7083cbbfd1622802e57ccb4607b1a7a8406888acc8e8eacf63

SHA512
1cbc5261ed4b133fd9039ae5610a594d0636faa43c8f8c9394e9d4ce42c9ad47fd01159cfb3514547b1962837f77b7aa0cef0814d902d659199b241b839d7c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
17badfa3cbc87e7d080f06a61a66c7ee

SHA1
b33974a1d1b3fab9ac6a5b397f75327e55b79a5b

SHA256
098112b47725d5c57ce76d97e61cf9f1bd95ca2f59a67cfadde72f163a14fed0

SHA512
b4fd49e7cce8f51e0572fc96c8c45857064d9e2e46ec7a849acb75a8f995e88bba11a0fdd1f28d4d46c345183fe997362a8a95b6a5a68111446eceb9f041eb0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
53c8da2d13fb65dff7b74dad64d61263

SHA1
5eff0633aa1b19f55a3059b992e36c0b6511a7d2

SHA256
178911e986870daccdc36721c14ca2d78a8dc107469c78c3669b118ba8eadbd1

SHA512
44dc5816d39afd716d8108b75e72e60901f28318dfe2db9a2d69f46effbdd1134da430bbd667b11ca0d2fdd614897e47d4f89fccdaa65c482fc9c581c5e39e34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3a1a654b5e6077c70f67044c93df48e5

SHA1
c7e2aa4ffb16abf3d3cc4bfd47b40554121a4822

SHA256
fb361bc8f015f4cf26360c66f519ebdfa212726f090ee043bb0221c07b21d6fe

SHA512
e5d86a426f3e22a458b1cee9b0df1c6de2c26eb90b6c4fed929b293295ebf3a5de06305569d7966eb8814e32735c3a9c7f317ef0dbddeae59fc7357e6d7d1ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
bb1bcd63061830d97397884afcc9bd2c

SHA1
ba946f7fb18ac882ed1be2ad91d1a9776611e7b4

SHA256
a51ab9a6d74434f9812e79a1f382887dbf5295c9f88abc52b511da5a7ffb7cb5

SHA512
47f3cc86dc508f5253ea632b6d0b040732e40604d6d1b7223db033ec2942c45c564c3f6db6bef7397b36aa687800ad90e01142e35d3abeced8e2379796a1724d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a30f0ff6454124ff14f84f6dadf0d181

SHA1
14fb3af222ad01162e03b20b7644726ad05533fa

SHA256
5ae7b50756f98fca2b185359b0771693d096e4b4d0c8228eb442662e103631ad

SHA512
540d78bc388865d408a0ee458b31a746db8d43527f12b1d7de8af575597eb906ebdae89f62110256c43b4db49ce17915c201640f3871d57286b739aaf9fba83a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4fac615244eba0f3530d655a4f2dbfeb

SHA1
2c3becad815e5d409a28de6d0faffd9e3b7ec3b4

SHA256
f7ebacb3b0912e78d5257e862ca0d76c1c9cf05cd1e16c35ca3f04d92ba68ad1

SHA512
648fc6e6242dd06fe05be225788b86c8c700499b5458aab5aa97a295de26461ef3c5a1f869b49f7718e9e200c48fa7294153be808dcf24b038d3e9bf52b39506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5ea4baf5f16d7736afb3e8e4b995a5ff

SHA1
d48d0aeb63594b77626b6f5504019632d5657d97

SHA256
b27210d65abbe8b8aefc20747c5b4d5f2bce095d16ffbf2d068a0a98184f41b8

SHA512
dbcab15d68b3288cf8c8beaa478ee7c55b575c6854d74c601cc7ca49a73364f105d1fda161b1365d90d4bb990d11b7dfb4d01db05330c37e96838d111cde69d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8501180964663c7985a8371dd33a88bf

SHA1
ed4107ba0625389dbd20409e37406ccdadffeda7

SHA256
d69624a54ef0f5caa27833b39ad89709d7479f4209c9e6b02b07b6b4784ff500

SHA512
bed2a4a9cbef9eb093095ba9496b329ea5d56190848a9876e744b20b64b86d35c13175ffac2385b8aa118049a898b8d0b936fa2d01915ea1a76a4df63a707979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7d307cdb06adc1796727ae38d7ef2667

SHA1
42107a4fba0ef2c0d837030cfe30894c828e14bf

SHA256
6b4f7fbb868da56580b341d7e93139fa4ddc417fa01660de4201c5be9e7af341

SHA512
20765675de49c2ba8c32aa707524a97db6304544d2a7090879f03a7898381aa7be98cf61c34e3e7e4edbe704acaca38815ba76ef78711340ad2139e0535068ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
36adf9e834729bb3da684c3df9b5c91b

SHA1
eec179c3b53c483693f4eeef8e76e8899eed7366

SHA256
605aa6299e34c453a93c6ad0f83194cec24c78c49e9fb834aebd639d81b0ee53

SHA512
b131f9d389ad8868ac01f916d58553673e2e602fb613c3f0b137f76862512ccc4024f99ac258969dbb65f4eca8b909f59f68cad7deae907bbd8773f6defa887e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
caf33265e8d076292e9b2fe36a7f13f8

SHA1
afdff5757561980090add2cc392be0446ab5a074

SHA256
8e49a2495e513348745cec92d4737499dd259427f6c37005d1783ac383c99249

SHA512
1ac73886c62e92e212e5fd0ae826355aa4de515c3603bd8323f9a4e54923f2fd8cb28a6bad7b7c1789738ecd6fde2b6c0c42928870a68414f0beb206ee1ff6bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7917afd84a5dc1526f1b2d1861c8654e

SHA1
3d0ec620968e4fa486ae60024f80d523b848ddb2

SHA256
3c2edd659678ad161878d8da74192b37fd84ab2cf4f4d3ed8561c0924927e4da

SHA512
d44911278d5b2ec5986f4b77e0971b832b6c80dadd78c88412cb8aa1a9ff26ad262c6dd691c53e3dfa5a66747a4ca6a22f0e3000a10b710539f725da04d995dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6f6cb14dd2c4cd38a2683c6a008bb10b

SHA1
dc02730f5cb311277a768388b54d64e0942828fd

SHA256
d69b1ff61354098f8b1305e92ded9152719651b1eb59aa03faacd5ca5036177c

SHA512
79d786dfca1f3ff7a6c7fcc134f3576544467b2ac647fa1fb220602e882c5d7aced130b2e3613a06bbedabcbb820313e88bb90c11e95400b918239ff53b921ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b05da939796313f27b9ea580e7603b8f

SHA1
806196fa4c31b3a8fe8d046d64c48a5fb07c9c2d

SHA256
335831201ba5317bef2dfd00e119ef77169fc1cc237bc94d78a612a1f36c0632

SHA512
deb2e2dc1f51c72ca507f46aaae18cf07295da006b0d4354112c9755a161badd246d1c09c346efcb95260c673a6a91a2f1f54bbb94e2c32b698d1fe86dd3f036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66961b366e2d2d61af9bc9e7b673a427

SHA1
eebdab28a2f3b74e9315bb194a58303ec249246c

SHA256
f55fbb61198a9e6492298d15c625ecf78b666a1331eeb80bb0577a744b68ca8c

SHA512
f14b8d1e3788472bbee7a604b9f4530c576f227d95035da26f66508c2a959c526054692ab54e1f24ccaad79fbbf7ef7e6332bda074ba60454fcce0d1d4af53fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
4545ce0810a3802dff517a7db926668e

SHA1
e0ef774dd85d0a0fe05f3f34c9ee721e245d17dd

SHA256
8f287a346f8e2f1f2cd24b52109f25f6d355c2ddb0beac6e6a57bc9a3977d9ba

SHA512
4f743b081809686ce3195f9b8478ae0807b50229ae911c9bc1dde7b9d2bbeb551f9fa709790e221369da2c40821c80c9d63fc8a79473b69a762a5c00f3c75a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c7b7c4d5e16cf1a24e652b83f9162416

SHA1
85df23f66d53e40615a4451816c4d4331d546040

SHA256
61c1b5a005014d9b62553a40f839bcb83512bdf5d43f520e5ce66955e1ae972a

SHA512
bf9c63c26ebed34c5d5ee0e6b86834add7d65de7abf6706269db160520530facc46dbe73d5b4d397545b8a40d65a15306a48aadcb9640045e2c6a772dc0da012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7791f2fe49193e31a5961046d7b9016c

SHA1
b98104e6e5554dcb571f5a4ca9e18b5b10268c8f

SHA256
6330c193e019c6a5cdc8fd2dc36f3ef3e33d8a7e04755896d73b883dfa702dd5

SHA512
d48fc03d57d49040e50158ebe5bd9ed79721be3056fe2796fe7ab6f431f2edd17c7a7ea2a7f14490c6f18a382b05b30200c48479c3b7783d7b81bd2840995ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
9713fbbe62aca86825062692169f37bb

SHA1
c453bf37b82bc462a4ab0b3a1238ff64af1fcd27

SHA256
88cdbb49606765c12255662f44e92bd8cdb6c23f0962b2cb248ad2f95ebec71e

SHA512
cfff2bde079889ccf0326142612e6418a13605a5e522fb901b1b23dfda385fbea00b4167ed3113065836f55904ce25b444103b00c25ed093e4c8e3114b5d48cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a1ef1eece3d19f1b654b572312087f71

SHA1
617e509ae6858dc8c1270207c987242aa2c9b4fa

SHA256
55a97edf31ab55b4c07a79d6eb87897deb8c5c8267562353cda56dd12d832058

SHA512
d1d9a356f6a9cf575e217e198d64a19b86c654ae437eac7fd6f5a1525edf60bb136463bf42f14ba57aa4f4e87fdb522d176eddc131fc4d8832318aef5581ccbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
700B

MD5
948cdddff25764bae03fcf4003c414e8

SHA1
0683d493eda5dce00a3b6bda5753310485092fe4

SHA256
c36793fce5ffd60031fc41c45c9de017d36abe37fc0f034f55621fd116d7defa

SHA512
78328976dbc33efc2d1376213399a1c41f55a3ba712f089143dc9b2db09d752d4e6380c29bc7046a987e5fec80a34a5dcf280cc0cc8ea02c766f8d28fb05f98f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ccc574ba4bc0ca003a2e525886476b49

SHA1
19f645345b31e3e2e5416d7498cbc01aee4e2c84

SHA256
91384afa173ead8384949c8b5b618537c2cdb180c15490f947b32de436113c08

SHA512
b68208aba070d71225606e5eeac830f8de28ac68b824320b2c624677177a26d65ddad94c7b2cb4ee27a5627781d98faa5a9d6285c51965173c570810eb33f39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e81ab1696bc4dfbe581898aacb6f8353

SHA1
6caca56b94fa89dde02e9af496bc20a1a0dda4d5

SHA256
bf97e62c4e1faeb3434688c95debbd17d994e7f5932e24b6b6e5402b7296043a

SHA512
bd2228af0d3b52d99e8cb685cea408f06e03d41e55cdc87bee42556931eaf4e695bacde66ca01321c199aee1b7f10d13ebe4ca4acb60e125855e2fd1edf169d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
5e8b7e5a9bcb098c0bf231a0b201c571

SHA1
0fde1a21f506bbe321ed499ceae6b790619ee682

SHA256
6e5ac000192ca20a8fcd47fe2fbdb44c73f976996d7c0d90d961cf92e5fe589f

SHA512
66cf4975d998305109d311ce343dab3298577759037b5a9c5a2333e878f801078b5e74afb789e85dafa25c181fdce110d5430b68990833fe6dec618c565880ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
9afe82e0e6a70962748001d65be1dc0a

SHA1
e297377b556b767d451c290eb128b2947dde3ea0

SHA256
4583d6500b1d5710415a92d82510d5d0aa1678348be853db961f8e2d4d9dcf3e

SHA512
58374c2ac0622b4ff6c902911f3895fb255b6a0581d2d1f7e6386d47ef7e91778a1934a2e803464dac70325fe63cdfee9565985aba8cbaeca7a559b6131bdf80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e868000c584b5f79aac58b4ee69d1ef

SHA1
a72de49363d2ab3dac59419ac236042d6ef95356

SHA256
2ce40afbbf656d21875a6407b4c6763619cc46c10941178243b5a3c30a1bdedf

SHA512
05bcfe02a8ac404a2d4dbac16d5704101b5300a39f321dd9a77ec7aa9d8fa7403326680794f5d5ee73396c3e880ca92924a5791b6d6be70d0580c9bbed9b51da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
17df666b39450877b1fca252e409d61e

SHA1
84fefe556ded540d310f83af62742cde5916c793

SHA256
b208652fc0583fb4ea69d269a033bf2836df25c09ff54ea0019798c01a040301

SHA512
bf23226cd9f05af8dbfe4700d05b9f55eb6020956d17e27e3543f1c9f2fb4ecc77d89f533edc93200147f2e62ffae479778ef5ed1f6bc7a3ceb228224b3e031c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
56253bcdf7484e1699601372459f0169

SHA1
851143787d21c96a2107600e05d50790981401b0

SHA256
c7dc04da831d25419a41168be93040977f3a5a2c7231c7b4c9e8501ce2433713

SHA512
721385f3da067a93ba9b04eb78e50c7a8df99d5d1231eccc1e317fd3fcafba52419a866fd096b78216dd7e24bcbaf4ad066a9fc45b9ed058cdca3a3085a705c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
200B

MD5
ece66c05c3300efcf1582516b561f822

SHA1
f44d85a8d9bc59aacec93f51b3543d58a0022a4d

SHA256
4b1f40d7d1c9f8314dfb651e0da2a3208ebdcbaa8a7dfaba3faa3afef9818672

SHA512
c5756e288eedddf3af8aa1f535a56549b89bca4c178ebec2e0ac92ac6f25f8494d520ce3553d8cb7ede85dbb9042ec1fb0d6f625113970209b45972a68d60235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
668f71be9deb78f3e46a4376f959802f

SHA1
8cec7d7a0b6dc77b27bc1c9f018df7f147df0548

SHA256
b52f1083b36fdafb879c77a7a10a2743d4d5e50a3c9a4626f1ac1315a30b566b

SHA512
66985a39d225ca20a9cca21079037c44dbc6eb6805e6ad7d392c5688827a6bd60876434058f8e2a68ee860bcaa65a222683e61dea4dee140f5db63fa26650488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d597b74077d82c859a41ffa92a08d84f

SHA1
0b929217ecaf6cb8c97fb726416b42d67c7c852f

SHA256
bf3afea2705f80796bc39340769f2d1b5dc09709a80b9f84d1c66bf887c43b09

SHA512
6aae2784e7a34ef894e605ebab1b970f58da0cac2e9f256f23fe4c44b26c42d539c9871c8b210fb87c1380f8b6a0fc48e5e650652d18ceb08ca1bb40a0d115f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e3a24b4290af7bdf87da572ebb6336b4

SHA1
d56b2df34ca598398509d811dcc11f899c4ff0c5

SHA256
01bc98a510608e58c85a5f689a47de8af3901a339ee40d3abd18f4dde268ffd5

SHA512
abff02ea547153f05a46c7e287509ff3c65175f622c5d7369c28e945dbcba584260cb0d5527f5401d1ddede43b3f627092df8640464d371cae77c56a989385bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
698B

MD5
61f1eb9a0795764ab7630b6a83f5ac2a

SHA1
6071f806c2b96f570071150b2816c9eacbd662bc

SHA256
1256900616ad3d692241e773159c38e8219488c20080a0ffbd36d6befacf2bcd

SHA512
1d28ef5cd1ef52b1d71a4984f67a4b4ee7d92e5289d9941aa0cd72ac3be886ebd3759a6ce936fe73bb236e73d402f70ef8da27cbf6eb3c0910c89863f196cba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6b4034bfd2280b709d4ca37dae02ebd3

SHA1
0b32f2ccf165c609aec275446508d868c99cad61

SHA256
8b8bc918c68da8dd6db63d26e1e0be9f907509037b4a0f4fe3418b9ba2c68b31

SHA512
9c6943270f0174549f40ae9c7af020b217207c68f2db75efc9552576a4307cde60697f263d8b0a69986c17b10ca78ea22c3e7b3f4d3c04885ded3594facf6c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6d8.TMP

Filesize
200B

MD5
9a32059a264bfc82e28e6bdac12f17e5

SHA1
3d9420971423f2e12e02a47ea0f04a3a190592c6

SHA256
797ff59a99ae552b7de64570ef4388097e46e7f70ccb07c6f5d0f09b716da728

SHA512
fe966d0afc90584b978a4d6294eb05c4f32c5b844175f5e216648176d4406ac74775a6d366e5e5ba00df24b47b75ec34c8a0ac79a9a4691be97ebac2c6ce977c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b32920767e83923f156793cab19e436c

SHA1
f93827765b82f717f5f82b91cb1fbd2a18a10f7b

SHA256
fec0cbb9d50ad5fc28ac7135915606d480b0fe6e47f0d564df3fa364261cd9da

SHA512
dcf65d752319b430df97b110580da7d66fcea5ffe04be89d98de3ce1959ba4c26542b31c00dce8e9be30c58ac8c10f86841425c7c9cff84696c01c9f2e4ddbba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
614de01ae60a7e651dbcfed400f78421

SHA1
1f30ab096269e9da21b8cd205f5baf891012a6ca

SHA256
f79a2b745ddfb1e62f0efb5cbebdf7a523bdb76b0e7882ba7380de66f287f146

SHA512
2bce50aa2ee7a49e4111326c6c2d4a85fe9589d601600be144bb377ea40a07c8e17c0bf3ebfc18311a1973cd2e144c82c6a1cb89f0e9b3a6a7363236c2c1760e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a1b3bb0e5eb22c1a4d4d0bcdd9d62be2

SHA1
46868a0618ab711f86a25d31165477c36681dd50

SHA256
36ac23dfdf5a7cfaa3c15786bc9232b63a8ccdb7eab3d75e67e8ebec12480f72

SHA512
631a7d4d5eb6659505f7fe7fdd41e6c5231cb345f3f8ec0086daeb6bd814bf593412f5c33b31b29d8cec7b9238c01f2be177ef69edffffeef5238e197ca8f077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d00e5468bb69405d0a1dd480eaa02d3b

SHA1
f6c085a3bdbe09224663877ad40504d253abd2b2

SHA256
c039b092e621975b03143800ba380f1c1a4ed5e76c4095bbdc81c9420ff96abd

SHA512
d4971e1734f2b0eb132b488891afa1d4152251f2e1e27ae89f1e18f96a589c2ae3ffd1da0208c905bb2779ea4a515aaaf822395ce649895382d54a0692d3106d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2187f2d03cb5fa0eba701a5d182d6840

SHA1
b9f63dad7bbd83216f584e9c020fb329723d3264

SHA256
607f307b94c187594edacb423259f243b082b74c4b4ab573542bd5daf223dcba

SHA512
b0e8aeb0e31c9adb5625128197655a0f3df3e23e001213e2a27e689d02978f606fc424de1abf3c735d820d6ece1dc54b1b04ccb7d40d1bf70a3ab0fa3d32bb61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4d6c489a0195219d10a832a7a413f041

SHA1
a7b7187afb430412ddca635ad43cf280875039f9

SHA256
ae08756c1326406c93784a3586b78d9569e3904deca7ba2d760a879c3b5f65d0

SHA512
97ce5f2619e195a133a154a0213d90d6c17c038f682a75af5c545b73995162aac56f379077d8136411e61c30003a6a43269d08b6c7b66d1ee551f464d6602d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DF043PQ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
77ab35864d8b3f0745b3ea30dbb244f0

SHA1
c59cd75eb57472b64a1887bab10b804893d7d475

SHA256
ef34e709b9c71d9a2829ef8e9e6b799505e233e7dce6baaf1ce69de5a66e9294

SHA512
3a604f1c0775a4192c1573741ccad4b869c51dd2417d82e0e7ff56e12fbd6ed522d6fb417ea55e37d2c6c97ae722d10f880dacf6317269948c5a863aebc7f5e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f2091896cd92b8956b5185f48fd78009

SHA1
8c2b635d77c7d8ecef85c9b548e0634c3d346026

SHA256
109702326c832b8a641587a37aa28e63b34340a4e76d0be597377d8d5ff7ee16

SHA512
fea1f659ca073e3c9e3003dd64e5d0bdfd04a8f395043573a242aba3f064ea9973e416ca25a17ffdcfadee8056f6a8c179cda78698576021d0dc9d57a1717ad0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
0bc050b65753a1fbbd06ed9e5643d82a

SHA1
68854c436792a2de7f0f6ee28eabd3909e758871

SHA256
442467a67378bcaeab501e75d4a5583f165bcdc41f2a5b530af6b8179d855b95

SHA512
0efeb19dc9c57aad215ed44e1de8ba67c459af32bfa8e1fbdb4bd073e6f8fa30e5b6de982a13e044a10bc0c921fa0105693feeee9093e78b952193514cc2f8fa

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 233789.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 405751.crdownload

Filesize
48KB

MD5
ab3e43a60f47a98962d50f2da0507df7

SHA1
4177228a54c15ac42855e87854d4cd9a1722fe39

SHA256
4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

SHA512
9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 409820.crdownload

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 411150.crdownload

Filesize
2.8MB

MD5
1535aa21451192109b86be9bcc7c4345

SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c

SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 653441.crdownload

Filesize
232KB

MD5
60fabd1a2509b59831876d5e2aa71a6b

SHA1
8b91f3c4f721cb04cc4974fc91056f397ae78faa

SHA256
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

SHA512
3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Download Submit
memory/1068-1775-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1068-1797-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1212-1798-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1212-1747-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1212-1774-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3100-1982-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/3100-1972-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/3100-2102-0x0000000000A80000-0x0000000000A9A000-memory.dmp

Filesize
104KB

Download
memory/3100-2100-0x0000000000A80000-0x0000000000A9A000-memory.dmp

Filesize
104KB

Download
memory/3100-2098-0x00000000007F0000-0x0000000000806000-memory.dmp

Filesize
88KB

Download
memory/3316-2029-0x0000000021CC0000-0x0000000022466000-memory.dmp

Filesize
7.6MB

Download
memory/3316-1572-0x0000000000610000-0x000000000063E000-memory.dmp

Filesize
184KB

Download
memory/4748-1617-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4748-1524-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4804-2094-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download