jigsaw | 91312ac2c8fa00d56b7ce9839f8a2934620f69ef6043a0c177c810870d6edd92

Resubmissions

03-08-2024 03:16

240803-dse52awejb 10

03-08-2024 03:15

03-08-2024 03:15

03-08-2024 03:14

03-08-2024 03:14

03-08-2024 03:12

03-08-2024 03:08

03-08-2024 03:07

Analysis

max time kernel
210s
max time network
212s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-08-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rBlbqI2.exe
Size

291KB
MD5

2fec9bf50de5395f799b23a1099b10d6
SHA1

6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e
SHA256

df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763
SHA512

5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8
SSDEEP

6144:pdSK04ETTZ+4TBpvjLCnVlBpevKBauJirVuD05VSKJ:poL4EnU4T/vjLeVlayRihuA5D

Score

10^/10

jigsaw discovery persistence ransomware spyware stealer

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (1530) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

pid	Process
1028	drpbx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	rBlbqI2.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	rBlbqI2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	rBlbqI2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
144	discord.com
316	discord.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-36_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-20_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-72_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-64.png	drpbx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-256.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reminders_18.svg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-125_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\NewsMedTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchStoreLogo.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SplashScreen.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SnipSketchStoreLogo.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\CameraSplashScreen.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\VisualElements\SmallLogo.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-32_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSquare71x71Logo.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\StoreLogo.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-40_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\BadgeLogo.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-150_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-20_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateAppIcon.altform-lightunplated_targetsize-32.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\RunningLate.scale-64.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-80.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-96_altform-unplated_contrast-black.png	drpbx.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.zemblax	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-96_contrast-white.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif.zemblax	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Wide310x150Logo.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-36_altform-lightunplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare50x50Logo.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.scale-125_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-150_contrast-white.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.zemblax	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsAppList.scale-125_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideLogo.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\MoveToFolderToastQuickAction.scale-80.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-60_altform-lightunplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-unplated.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif.zemblax	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-48_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-60_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-64.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-200_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateCCFiles_280x192.svg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16_altform-lightunplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-36.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsMedTile.scale-200_contrast-white.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	drpbx.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	rBlbqI2.exe
File created	C:\Windows\assembly\Desktop.ini	rBlbqI2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	rBlbqI2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rBlbqI2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drpbx.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3007475212-2160282277-2943627620-1000\{C907909C-669F-4651-80DB-C137DC4D7D05}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GitHub.LoadTool.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1596	msedge.exe
1596	msedge.exe
1980	msedge.exe
1980	msedge.exe
2924	identity_helper.exe
2924	identity_helper.exe
1424	msedge.exe
1424	msedge.exe
4524	msedge.exe
4524	msedge.exe
7052	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe
5388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	rBlbqI2.exe
Token: SeDebugPrivilege	1028	drpbx.exe
Token: 33	6208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6208	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1028	2104	rBlbqI2.exe	78
PID 2104 wrote to memory of 1028	2104	rBlbqI2.exe	78
PID 2104 wrote to memory of 1028	2104	rBlbqI2.exe	78
PID 1596 wrote to memory of 2444	1596	msedge.exe	82
PID 1596 wrote to memory of 2444	1596	msedge.exe	82
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 4580	1596	msedge.exe	83
PID 1596 wrote to memory of 1572	1596	msedge.exe	84
PID 1596 wrote to memory of 1572	1596	msedge.exe	84
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85
PID 1596 wrote to memory of 4940	1596	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe
"C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\rBlbqI2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff813313cb8,0x7ff813313cc8,0x7ff813313cd8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8888 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8344 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9188 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9576 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10056 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9456 /prefetch:1
  2⤵
  PID:6384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8516 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10080 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10620 /prefetch:1
  2⤵
  PID:6620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10816 /prefetch:1
  2⤵
  PID:6468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15182208658640390018,13493551042920591035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10784 /prefetch:1
  2⤵
  PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x0000000000000480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.zemblax

Filesize
32KB

MD5
aec7bd7c96948d97d13c7df53988e89c

SHA1
7b906b88009e7509324ae92dc8a32ae4fb38626c

SHA256
15fcb7c77cf60f287e9c81ec8053a9cdd1aa8bc0413734e8a1499a9de635c6d0

SHA512
27d12f825c16d1d5349f53a23d57f71eb8d4534a1ae4af2c4eead9cda09a4440dadc518a8887a3ea818494cb6319fc82ab8147cdb85958e9b344400b7d6b2803

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.zemblax

Filesize
160B

MD5
000e8c41d4a15fb34d0be0dbb56e3778

SHA1
00c4eae64ee6239d7c65d819c6ce1ac329224f8c

SHA256
8bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28

SHA512
775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
291KB

MD5
2fec9bf50de5395f799b23a1099b10d6

SHA1
6000969e75d7d7a3fa1b908bdb9d5daeb5f2534e

SHA256
df049efbfa7ac0b76c8daff5d792c550c7a7a24f6e9e887d01a01013c9caa763

SHA512
5f6885fb1940ee4f84507e2b7929f637d8f264a5c77329aeae31803b772608ea93370177017f90f6f8d8bc9e0b30eb8607ed120d4ead68104fd70feec71a9ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
ed3c7f5755bf251bd20441f4dc65f5bf

SHA1
3919a57831d103837e0cc158182ac10b903942c5

SHA256
55cbb893756192704a23a400bf8f874e29c0feee435f8831af9cbe975d0ef85d

SHA512
c79460ded439678b6ebf2def675cbc5f15068b9ea4b19263439c3cca4fa1083dc278149cde85f551cd2ffc2c77fd1dc193200c683fc1c3cdac254e533df84f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
027a77a637cb439865b2008d68867e99

SHA1
ba448ff5be0d69dbe0889237693371f4f0a2425e

SHA256
6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd

SHA512
66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
66KB

MD5
4da59e33c394c9f96bcf13cd82703bfd

SHA1
bf8d24c19f34c7b06a7c2645cd3ae05b4f934c0f

SHA256
627fa50a246a5228a73f5906ba2ec574e2cd34b911150fd7a513e17bfc713973

SHA512
e8f9c98b857e6ece9eef3ddc18b2997df3c944313f0ce5121683be63919d8284e01c59606453621d543ba04755df7a6041fc0841dc7f62d47223b1073a473bec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
43KB

MD5
5ba77a4d6647a96613ac2b5f989d9d41

SHA1
0307028d3862ab2affee2e1429a0b259c7661beb

SHA256
68f74a3aadda9b79a48214612b47a9504d6da9fb820cb5bf5c95b4379c3d626f

SHA512
5b763115e9bc115897096d36a2e40d2f440962afe919793cb01a5444f7d9352ae0c3cea9e6fd1547de7f722d646ab1d8c74d0f6ce5576f2785a169cfffeecf93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
69KB

MD5
d91bac1b60b58c54f87f1d1b7b16d445

SHA1
9ed78d3cf7553e3180bcbcd2ea9779e1e1a141e1

SHA256
4dd5f57067798bd3132643930620ccde1e4140289d52fcbc4fcf7b252876fe8f

SHA512
eb474a57cce34e17d00972b927846f087c55a76f5fc1fdbea0e43111f9d9a5af848862984431402a6a043e5a1a96815be84e114fc03c0372a03285fcf0c2623c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
47KB

MD5
1b41de287931f25dcfdb32b449b62dce

SHA1
e457bbc7784ceacbb11cfa3ff65571de5c0ff227

SHA256
c1fe59b2b1995ef9709e1dcc147a96774f04c95374ca1c4df0c41e1cfbaeb8e0

SHA512
4d1de63bd0e1d61375a72252f41be91a61d766b3b204a0e72bf6530195a3f26d89c8aecd75e175281287b3b3b56a71f964ced207a0037641ba8c893d2ef75c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061

Filesize
229KB

MD5
57c541221efeb823a27c684f30a80469

SHA1
e957951d9c55c4d94f40f6bd9cd392b4f8c11688

SHA256
eb469eb2741dcddefd9bf7e33fa3027a4d1a25f8ecbc267eee7f40667f526ce0

SHA512
e4fb117cb65026cbd7a5567d018f3dedaca06dc47321b2d91ce7359fc0e0e9704de9b59a4a2caac491ff1680ed88fe4431960af5b01c0f395fbb1900101ccc5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006d

Filesize
20KB

MD5
644f2b0ee81b56ac7303031ab3ca10e4

SHA1
7ca67423f0ded5ff534f0a0d42df416b44d36805

SHA256
dda33f363084c0f939d6daf5e648ede370fe5be24bd408a6ea0e6bfa1042e6cc

SHA512
461b910c1c3d43d5e62ca18d8a2ec7c9a3db196d649c08ca56d92a8a5e39a991fa5dc53ee20572ecb93b3315b0ba2e2a0ba9f5644c61b2d2c81ef74c05abc39d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006e

Filesize
748KB

MD5
1641a722126bbb0875bc8fbac0451fae

SHA1
3cd27d8287f183290163cfaf1f0d6dc54456ee50

SHA256
380cc53c5badcd90643dcc7c1cedd159feb08fb19f975478001085b2cfa3a12f

SHA512
064f363dbd83e64595b3febb23e688907169b1161f941df1af354d571abfea72c2cc6f278255f55bc87a3eb381d4bae6019757365a5ea75699f2c45a9bc4383f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
4d13405bccd1ec130db68f1a67b267e3

SHA1
35e237994671069c56ce4950a033045cd84e6b37

SHA256
9432c2ee4a9aba347f3fa1d8aa75d0f2f56bcae8ddf7f40c58eb24995ab75fea

SHA512
b2ab04c9817946f603a81c92984b849c43b09eca12c74788bbd605cabccbb56fd7e9da2e47b9fa7f8c728956bbafb120601b51ce2296a6f5803b0ded62571c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
2b5eb3405003c4aab15d45e7eec82027

SHA1
890c82f82836e9616a3790c03b8438146f55ac0a

SHA256
5f967a5cdc79c7d5b2b0598a466640e50cee7203a04ce0c1e06c547f219b2796

SHA512
a81a3a8d395074908f86f002c3758c041fb44b37c26f2cca06119753d992f6cfda8935aab7818c0c5e23fe9d5912c3d4779d112d2ffcd9f05cf88e379c319b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
e428ad426c7a9529c3560f98a8eab57f

SHA1
e2158328530d55810491d56f3b07a4491a8d861b

SHA256
05962d2acfd744efb50bb36afee5fc37f005c5871dbd4332f946f96f589d9059

SHA512
689d91643f7f012ef61d54559f526975f7df19f8800f9e5e25e4d5e8ab7bc782234c3c7a2d938f4199750d57f2fc8543337e2ee01d241c92305debad0d78c39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
951b84fe292c35dcb61c743e18f300aa

SHA1
d7cb2fb8036bb75ed76d8175b25094149fd15dd7

SHA256
f26e7af66fe532d1f4e106e260e2a32b5eb34d38130ea261d06794fdbbaba4af

SHA512
e7d769f4308eb85c3d9f9394afdb8af28601b1ca333a41da1b693e4b6a1e0d2dcd19fdb2d965dcc81f70b57cc5132e37ba402044466b01060993e64b59fbf73b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5207d2dbef984107a4e74c5ff2518fd6

SHA1
deecc1ac0c97b8f721a41c50cc43681fc9edf71a

SHA256
a81026c20ea62f5be64c9f224f7c9db33953ef7578d21c385d80ba0d5f108c19

SHA512
e3d22335991847df37e8d645330a8e81d738b89bc99379b04f0f5444d0eb4b6ec3719f46919a4c72f270a0f46817960f0b07f5e8b9c85f6116119c39f1281230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
c3bf602812896e609dc50fe8a4483c1a

SHA1
91e5d656d54cbee4aa4f660b80c16f44e7511dbf

SHA256
7f5cf54571a620c951b90e74263b536360f6a5acd5aba78b972a6c7a29b600ab

SHA512
e0301b83448b130e98c69df59f583be51aab120324212e9168b2c3997de7d91989b29b163299d2811eecdec555528a3d1885bb89fa7b5e5918b9207ddf4e6e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
02c41f7fa0ab81baa80c42cff73f0c06

SHA1
f63e914a44dbdf934b0b1a2976a27ab84905197a

SHA256
e17366ecab79b0fbeabe0dd75f99792e558eb7135abc5f298746a89a32a0f0a2

SHA512
48d28869f507e5645aa1067e61e33c1e6a14ea0e1eef83b59b3451ed467b215a6e4f30e2c8f44dc724f87ae2ef9ff1ae17868a35bfc68eb1b5e94b3eeb6a786b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
bd1f8bd687aeff25e2a4163f9be88dca

SHA1
4c8875491cdedaa4b8e2c78a200b9834d08d1b71

SHA256
04bccc2df46c287518f8ec1a73b35f3c55fba4f2e69a36752f51e971c14c91ba

SHA512
e60bc8c0e1ebcc6e410409481a024b3688af6e86417a2fa04d0d140fbae97ad40b88476b81cdd88dbfed06029761e21c27bf97011515ba33db2179a988a376ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
55ef3c0fba8c121e69f669b552236ffb

SHA1
3c77b83784f9ca6e287ad9fe41e6a6b56c98d7e6

SHA256
64fc4694d06d3c656c87fa4394ffa716222d543e093f7f3485858b8be7a902d2

SHA512
8fd7236c9eabf0bf20036cbf0de6ac72f32b4fd066a20ed394759f4d677245d13c3a3541a25f85c2ee020789fbdd69fd5f39d082d3000f0ed2a7693694c6a7d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
f5eb974d397a6cfb853418960c09e07d

SHA1
cc2a46ed4ef133673f1451c3c5a4564337ab6a16

SHA256
d312d4da1d98a39b12278c024d4695ba76acf9a8bc71dfc4ccdbcce83ed99ed7

SHA512
41be33994dcedf18465f4e71d49c9b0cd4c7dfca83dbe357e153dcec4bf12d863143b53b3cac60a13a046065655853bb203d411e88e2978e263f81ea60ae2a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
81393855eb61505949e8a6cdbdf1454b

SHA1
23716e7fa4e03c7d0557d7e1795cb84269140ec1

SHA256
612da7008b84437cab1e2b34294db2b30eb499deebf1a49c9246383f6ef93f2a

SHA512
d694e422cd6aa89280b4a02f621b1240621e398887189039ee34722e5990c4381aee692e0fab08f015627ccf6d6185e738d3d12e77df51a0b53b0d169bd15ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb4673b7153d91de28b88cdc26f207d9

SHA1
b2e811db683d170ff3b85e8911903c6b31a8172c

SHA256
eb15a34282eb9c80faf01762fdda76e3c7bd6fc3c25ddd942e2ad7ec8158eaa9

SHA512
feec8857c332c029c8669dd7c8a613e4ab70615c1b03ef0387ecd2b530ef78bcde5a66f97fbc024f9efa0e25ab46f8999bd091ef488b6f044e7d6df3d183cdf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
863869e377e746d78d96e9c4ecd5a311

SHA1
025a532da81110c6d54f6f0b3687df76a31b1e09

SHA256
ff741571b0b4e658394d48791b04ef8120f18120221271aaf927def94e954882

SHA512
b748370d9b307920088a6a882ee6e759e9558d34a933c0aa2cf09795ef7461748511d6a757c1633d1ac84c4ca1ae8163478f2fc6838cea9a9920ce18b83a7674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
95c1089e7e60650c60ead19c6b5df72a

SHA1
34c7a8c87194bd0c4f744d9693de9c4e2b3c6990

SHA256
ea4c7141b75285961f593f8402922c15c8ce8466571d6ee6922b02a592cdf8bf

SHA512
91307fdc3b3dd05a54000d571ef3f78cd4c1bdc5f0196ccd2ebde054e527edb2c74cabc86d28956e59ac56eef293aaf51a1f89ce8c704fd71c7f95fe2c83c95d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
ccd3dd4599ab89588297c3a4f8a4077c

SHA1
475316ad0b379887398c6c17cadf899489b509e4

SHA256
ea122129e7089defe75166b9b7501b71389a1de86ca0594c2512a5e5cd60b730

SHA512
81180ac7001d2f4d654a470d1477a7ef8ed077d852f7fc6b9de5a9dfe99ee3fcf003327efd50cc46117f2ea937d2341319fb510a7361dbbefee0b5785f26dc24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6cad80717da95e386d673ed959f4d883

SHA1
db3e9d46a74f99e44cbb04f0fee5854eea0c65d0

SHA256
5a016eec68d270ce9977ac47e52961616f76eff9b6c0f8dd4595482a5dfd3908

SHA512
c2dd1f300a95ec9773a3c9965cafcc0950cd7bb2835c82a54494d9a9f792b6feef609d822450f38aa2fa4e581f0b53e9d2e6357cf4b9ea7d11dc9df5d28c9adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3fd850cb-d8c5-4bd8-8fc2-5e5fe935197b\index-dir\the-real-index

Filesize
624B

MD5
f925e5afa72ae36cd68b44f7a3d9cd50

SHA1
c26aeeccba3434d1833d770696959eab34cc02d2

SHA256
786462c3332e3a8fc589c619ed61feae34dbd84d0aa61daf4a26204e0019bbe8

SHA512
958429be4abb48afe4adf1402eb3c1053d3bfb40b8e237e7e4ab23859bd2f914dbd6f7f4470c6d0752b7cc845d2302149c20383fde65d90f043c8ddab9fab45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3fd850cb-d8c5-4bd8-8fc2-5e5fe935197b\index-dir\the-real-index~RFe59f1f7.TMP

Filesize
48B

MD5
fe077d4d03aaddadef37601ecd1b8710

SHA1
d00ad05e12216c5d6c5731c7803e8822820d32d1

SHA256
4524e7bfae511a5d834831b8d5f62d26e93b6304d30d30579265fd731326416b

SHA512
fadb74e6e367b1b1be3965cd7b6ae1f19115989495111c4a640c15e664cc6e7b290e4646b44f51d2a03d01d44c6fd5f380220148611d84833602c8ce2722c102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c1c76ba7-d072-47fd-84fe-f66f2ac8a247\index-dir\the-real-index

Filesize
2KB

MD5
a738329ba657cb85e3668861319b95d7

SHA1
c1afbf24458b9290b7627e35a4d35438899bf7f5

SHA256
25809385f860f55be198aa6c6139645de3cedc18f05a9c4a785aa6ca0031181a

SHA512
3fd6ec70f15192ff190ef9c80aa1085ea7733cb46f780415ea0fe7920d89c8bcaa46f42e213c30ed8effdc5e660c1d2838bf067a11efb2d6ed96e289e36afdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c1c76ba7-d072-47fd-84fe-f66f2ac8a247\index-dir\the-real-index

Filesize
2KB

MD5
235352ab1d9dd5b7674b5b51f981c108

SHA1
58597c9be9e82a4da082ab15c8375519fed60270

SHA256
52e8ccc640cef559e0e3de9b87418921a20a475b925260babc55762cb05d903f

SHA512
a5b30176a7fea5b7641708a16ad22abe527b3a578f96acfd2c788111fa785cf1b1d11d980c717d78b32d327cb4b67a837afeb06268e8ac7158234c9fb007f511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c1c76ba7-d072-47fd-84fe-f66f2ac8a247\index-dir\the-real-index~RFe596519.TMP

Filesize
48B

MD5
7c6b018696cd33c6235e70a0840d01d2

SHA1
6a8e5d01c03280583135cbcc1ae4419274eec8d6

SHA256
84a2eefd95647337d4d981e7012cca6cea3a3dc69f637d4c68dd551fdb5a95bc

SHA512
afcb15c091aa71bc03c51bac462ad915f38574775fea963802eec7ef5c2f9c852305a1a433cff9d67c13927cff70c33918253b43786fdec25d47198843f7c2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e07fee6a-2a1b-4f19-a7a6-273ae8e494f3\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
fd18b71609189501907d302413cfd644

SHA1
15e433e29bff9be7464e5afc0a210d43afcbb731

SHA256
051dd1fe54173ba537a668f583e0eb25f634fdce3870a393d93689dc69ab8c1c

SHA512
edf9f2e78fd4782632ffa8bbf0791ab9785b78279673e4f9350febc43482a9ce3b8af7cdca9f1973ff2e31ae5a72c9c2d2ec08bc20dde81ec7b9faa45b46065c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
c161cb554045f760ab790d6a5d5715a2

SHA1
acbd80028efc32d4e86b73f7c97dd290fb4e2bd9

SHA256
bd6e351db6b9bc676dccabf0f232b2b3b80e73683787634daa53bea060b6cb7d

SHA512
ebb1f0b1db27007d2ec01be56d5dda2b08c434129898bfbb60e3faf6bfe38ff61b7abbf00f0ae83e86d595deb8f740418360fce52339eef0c8b5b5a1abc86729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
5df9de313a07a3935c373d29a4f70412

SHA1
1200c8a2033c8b7fb845d5a3e7fcef2838517438

SHA256
97618b109d847e51664b611782dcece4e0158a225ad56f8073678daaf11c7ea5

SHA512
01d491e29d79ab34889d91d7fe0820f11a3272794cbd5a98bd76cb57163857aabe287c8cbc6c8a1a750a4d0478ed63bf9cad7b5570efd8a77aebbf5f2671950f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
ecc2d2ec87552e002978403b2441187c

SHA1
41c4e62d68bb6919ac3e3fc94800b6bde147eaed

SHA256
e6059add26bcde40345fc1c4d03b423b45e6ba9aadd2df89656225fe8c85837e

SHA512
adfa90d11700c00179641a279e148b8c80969916f78d8fa45feae706dcccb2e0ca484a382d1f556b0fc04cdb67a8d0e2cc9e7d94757aadf32edde1fbad49560e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
073da3a670919ec1c29d47af35d412cb

SHA1
b929f1ead7018ec05ba1dbe58d4fe6bba1df7d2b

SHA256
5a515a5fd922e0ba709956ad9d49456c70e3f3e24c25027ed119bfcbf0750d8d

SHA512
51a92e9d3bf3ce6010f070736d2782cb06b146a972d92e19b6045cde846ccdd7bacb8f9b6f29145ad33993caefa11d4da7a71e5db3407f31c4fd4798e3259dcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
f28400159441c3a51513697de4a33923

SHA1
d555f3a2cf96312d2262e29092722e4417f3b4a5

SHA256
c7af4cc20d579f02b1945f7a31cf956e314d40cfab24be4d37b44253ae0826a8

SHA512
823aa42d344c5a0c88bfec2d33ec1b419820d1c9213c3cf94f3fc3e6f87072fa1bbff417d16749b26f839263cfe239e2e80300eba77ed5f80637d2077bd3e271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
0f2ae145f08696059e4be2887d7db72a

SHA1
e0a2d0472bae66aa0245101306dd54b5bb1913bb

SHA256
688b160259abf7e04f0c6676c42b1a9396f9fc5091efec7162d26c7ad19ba320

SHA512
e26c70bfd42df79fc1c170607fb6734413c137fece75cc0e79faaf64d3aa9ac71a8a3ffa6effbd6606f9c2f622c74a6f2f7f91563ad49adaa45fcd5ac325b35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59478e.TMP

Filesize
89B

MD5
628bed56083b4d9b807780ce1b2ed38b

SHA1
29c4053965511698eb0ab73b0ad5e339e71fb3d5

SHA256
b7501a174e07be18a0a35662189ff0f2884e5d63ab1bafed49d253968ebedad1

SHA512
67b7838b810b0e5d76662268ddd6f934825bcc677aa0d4c95105683b94ae0fa5578b3dcd12307697d68dd28dd8fda046218e80c4c9f8e52246fbfc2fff5552fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
ba6092d880c8805a72cd01b1800ad4a1

SHA1
c2de3053fcaec9f6bf5cccccd9d30758a090d255

SHA256
ddaf95762814b22eb88e24ed1850fab5a9199d28e5fa66400f57f94839a847e8

SHA512
2bfa808e3ace7569dc60bccfa15754884a4c2e6d29f7664dd694d219978c74bb05a6e30ba248e24d2b9aecfe27a6a4f38e80b99634e888a504c856b699fc1489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e6ad.TMP

Filesize
48B

MD5
142c8b5340aad0c5d8f10b9ed0c1fb1d

SHA1
cfc5f5c353e13416772ad22930f1d98efa0d29be

SHA256
d22916f5b0080631b4580633cf5e7e76aad2a2b41e1becf558c651a2ded2cb67

SHA512
a0e3aa1d6dbe3f82abcda3f402447964db3a00504899eb36215ad7d427b84efdfac6c7ee8820445cb92fd9ad35e15086f3db5899731fede8795f35131e58ace7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8b0c507e4d145271d477853a8cbc429e

SHA1
3c67da7493aef21b6a271ddecce3f099338df2cd

SHA256
d175997e1f4d2b34389297b8c8f3801628b950e9380435454dbf7ffecdf9d8ed

SHA512
6bc13177fc6a6068319253f8d5ec52454a7404bd9992c9cde5ae7b55c1221353e99dea2c3cc85724636810bb8a1704d649db0ae5158b03b43d1a79829dc79b0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a2c4f718b66ffb382026f8d39b94be21

SHA1
d5b7128ddf9e9c34360e115d4e55c30a018366dd

SHA256
739dfa1223281e2a99300f2f5e2d10c42b505279af814adc7bb62dedcef4ec79

SHA512
8ffcd88cd9ff87f3ce2731fb835ebc1c0e18acf5f0669e53a6bcb7fab34f3809a5415bd5f826b6c70fce67c4105dd43e19e41a6943b192b53cf8c14dd2720151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
003369bb6222d0dcf1c646d5216e6b00

SHA1
a4c8520905d600fe6f563eb44795af8dc9c9051c

SHA256
3bee44d8c1f4a3a82e8ca7e1fb70f62e0bbda5664f6d88a016d18ed9dc8314a8

SHA512
ad4c9eac7be24035841f0600f3a77159f5db49769db0e2bcab5b77768773135e8cf12fdc766264e001ea9c197a48b367c39649eec5b5ece7c2142acb23bec3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
e96fa00f4d22dd83d3b057e8fac5a61d

SHA1
6f9b0cc4185ebb327950f2086b8505292b26cde1

SHA256
35449b55752c7b923f6046de0e89d5990dbc9927477a620489b974a0dc6e43cf

SHA512
26e27af1c3f9f4d2b9f3ae8e0b625d0331be425a29d1484d3873fa82c2212ea25204c62a003a6ed2b35be77ccfa8a3d4beb31afbee7343236f563443452cd9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
9b1a9a35f288743766fa9e0ff2d4cc96

SHA1
702a8a9d5ae5677ac84440fd17b798aab92f5389

SHA256
f7cc289ba44dc4452620533e391eae6e336c004e3bbee483e0d62ef31744988b

SHA512
ca7a1b533636e20e5748b2c61c28482021aaf7c15d5094d57f2e0f77103144ba11fd02482aab77394a0da217183f655c0a68235333633d704484b9e0fd54c807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
d1253f4088536b23c9b272a4b77da328

SHA1
e3fe58cc3e7cb717d92ea43f1cc1bdbfd00b83af

SHA256
ba880f154e600be80b6a3c6d32b6f76c10cd40714f8f9fb8503e5fc231fdc8e7

SHA512
fd409514d4aa3c224962d3eaf4aee73fd508bbc07def1667dc355f15de30554c489bacb0e5616d72f59c5952d59b8f0dbd9f9e29ecf0a6f9aaa4bb5e4b5685fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1cc125e5432bb31492663a274abe7b06

SHA1
261aa77afa34ac1a159707a1103fda90185c1e09

SHA256
02fd10c62cc8e289841f9c6ccf4da16317fcd02db99552e754ae2f37e9219123

SHA512
87105abc372420b1f615f506ea183cd6cea6ed51fa9cb892266f46da0971f0ce292d7b06d8812e7a4a0d158bb35be99c32f1484e54bfdb369b2b6cdd350b9521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
07b3da6bc6897b99926aa15043f270e6

SHA1
14911e3a4a57bcdaca324270e6bdd250f503cd5d

SHA256
3a0a9e8fc36384cb7755ed1861e034e8d78192d9827c882bd8c811d14cb02777

SHA512
c38f2314908c2ea3f42f42990f3c5b2a93c3366c0b4242f5754df11a504728eb06bb71ca4b3effc2cd217bf7ac6f21739f939bc29843cc19c1921782c7b7e506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
29f842e9463b3d3c22157546fbb35eb9

SHA1
e6ba2ccdd59b6138e85c75271713971bcb193428

SHA256
6100f796edada0e05cbfed1c3d8ba5fe9e12db2e7f01e6d57e1ded0f47649af8

SHA512
6ec5b823b78f44b68a0f58513824760a108ae26d2b7c1831f76f0aa84e0f8d61383b0196d0f31ec90df9e5eadae687836aa8ae1dc21fb3b2aace81c08bc23d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
4806d07f95295782012fef4c9e9ceaef

SHA1
7ecd1a0b199b20c0a06b56986c97fcf677d6afc3

SHA256
01bfb6437c72e66edce8902987eb65274ab1babb4c6ae7e68b0fe2ccd33ab0a2

SHA512
282f6a3e2947ce18aa9ca4c4e5f901ec34fecf7b9ff465c72d2534099d3b80cf9120210577dba62b7a4b30e8e9ad4e88790f7e4fdb5b187987f0d61c5fa14eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
ee8e2fe50d7d0855d88f82663be7acca

SHA1
7c32a58e1567cbf98babea318f694ff992d180cb

SHA256
b4e4090e8079de3ab24a81f9207cc1adc44d9967fe6aca8cb1f18ed6ef534040

SHA512
513de82f439b0bd5cf94f32235fff28419bd3e3952cb9ade6a19f4155e55bdc78b96eb61ca89f3778699dd76b322be3a53c027c67f754180c6903780fe321b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
7bad90f35d374596b1a2c50b00e4437a

SHA1
2bc2a7e6870a0f868f671cf359fe8c7cf4887f2e

SHA256
178ae4d7dd9373e58b84886253bcc4192c9859390b7b90612ef061ed7e183927

SHA512
bc55b700351673ce67bc58f15bf4126100af3d8943e26e65863b87b80e9f8a75edf9457d83127393e9adc948b2be878e51c493ccc3b65c869f7d7488c92dacb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585109.TMP

Filesize
868B

MD5
b4dcf5db485b17611528bc336fc1384c

SHA1
7a11671b54b81d45ef92b3ceaf2f702b4b60a3ae

SHA256
4f813e9a5b9ed18150531ea78d5624f46ba6b6304caccfc408529df4f7cfa3e5

SHA512
4b90d78e875bc675b2c811ed56c91f1ca03fe19d2c4c964274afc74a72a7344d58b63eea1952f512d6b993bd5050c86a6672c52f86afdcc0b1f9a902ca032f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97016bf508c5b08353a506a632330a74

SHA1
3a53239dd542145877e7b779b7f73bdc76e49c08

SHA256
250bea73aa5c3da10bcbf3d33efea2da8691d247a22d458bc88c37e3b62f5618

SHA512
7e23a3c34c44e0dbc082b2f2a46512fc42efb3c533843a245df64f28575de00b88ceb54039a66e011e815db987ee2e719d8153519d10af1e7c90c6211eb17968

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.zemblax

Filesize
8KB

MD5
420960c4b17842a24bbf117222c60e47

SHA1
4e2f5bc3a3fe7da4ea60dfaae851b1b88e48751d

SHA256
e94c37d7dc8dd954bfee8e340abc882bc361baf0d3771ed442ed625a3bcb0174

SHA512
b42f16f6fca9b66d49a2ad7c80e56c51e04d023a4ae50e984dbd267e204682ecbb929fefb5c7ee67775597773b08b6bd39416f13b87f1782cf8c5d553ecd7ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1722611635.txt.zemblax

Filesize
16B

MD5
cfdae8214d34112dbee6587664059558

SHA1
f649f45d08c46572a9a50476478ddaef7e964353

SHA256
33088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325

SHA512
c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\GitHub.LoadTool.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 926248.crdownload

Filesize
22.2MB

MD5
798950f894a3969b0d69fe6d5ccacd02

SHA1
a082e7f97af48655fcf48e6dc387c1bf2f99fa65

SHA256
75f0ba20b4f2e94ef1a6a646649a60cf11143c7ed6ef3d895734e32df72cd663

SHA512
38dda84b5635f417cb21777d5430bef24cd3fc7d1cccf30c5685587b267380b0a8bb256ae61d0c3c07b02034940f5244ddf9f7c92565690dcd986ecf7a442fff

Download Submit
memory/1028-709-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-342-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-704-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-705-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-707-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-965-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-708-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-798-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-801-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-334-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-339-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-340-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/1028-341-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/2104-25-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-164-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/2104-57-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-59-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-61-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-21-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-19-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-0-0x0000000074FC1000-0x0000000074FC2000-memory.dmp

Filesize
4KB

Download
memory/2104-51-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-37-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-6-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-241-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/2104-49-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-47-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-17-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-242-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/2104-15-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-63-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-46-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-55-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-27-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-43-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-42-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-67-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-29-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-69-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-5-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/2104-31-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-39-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-23-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-53-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-65-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-4-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/2104-13-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-11-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-1-0x0000000074FC0000-0x0000000075571000-memory.dmp

Filesize
5.7MB

Download
memory/2104-9-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-33-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-7-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download
memory/2104-35-0x0000000005240000-0x0000000005274000-memory.dmp

Filesize
208KB

Download