danabot | hxxps://www[.]roblox[.]com/home

Resubmissions

12-08-2024 12:04

240812-n8xp5avama 3

12-08-2024 11:49

240812-nzc95azcpp 10

Analysis

max time kernel
837s
max time network
847s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.roblox.com/home

Score

10^/10

danabot adware banker botnet defense_evasion discovery evasion persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fagot.a.exe

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x000700000002378e-2233.dat	family_danabot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit32.exe"	Fagot.a.exe

Modifies firewall policy service 3 TTPs 16 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	Fagot.a.exe

Modifies security service 2 TTPs 11 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters\PortKeywords	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\ACSERVICE	Fagot.a.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
238	2872	rundll32.exe
239	2872	rundll32.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 26 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23A20C3C-2ADD-4A80-AFB4-C146F8847D79}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A604D2C-E968-429B-8327-62B5CE52126D}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25FFAAD0-F4A3-4164-95FF-4461E9F35D51}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6EADE66-0000-0000-484E-7E8A45000000}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{990CB269-A600-38D0-B7D1-FBD392495F13}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	Fagot.a.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 47 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	Fagot.a.exe

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates\11194FAB14616ED8259FB94DCD17CE99DAB04CDD	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A42-8E59-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{6078065b-8f22-4b13-bd9b-5b762776f386}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\SystemCertificates\trust\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{189A3842-3041-11D1-85E1-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\SystemCertificates\trust\CTLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{6078065b-8f22-4b13-bd9b-5b762776f386}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}	Fagot.a.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	Fagot.a.exe

Loads dropped DLL 2 IoCs

pid	Process
4328	regsvr32.exe
2872	rundll32.exe

Modifies system executable filetype association 2 TTPs 54 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	Fagot.a.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost32 = "C:\\Windows\\system32\\dllhost32.exe"	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Fagot.a.exe

Indicator Removal: Clear Persistence 1 TTPs 47 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	Fagot.a.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	Fagot.a.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Fagot.a.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\ntoskrnl.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\bootok.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\dumprep.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\services.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wowexec.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\dllhost32.exe	Fagot.a.exe
File created	C:\WINDOWS\SysWOW64\userinit.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\chkntfs.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wuauclt.exe	Fagot.a.exe
File opened for modification	C:\Windows\SysWOW64\userinit32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\progman.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\regedit.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\imapi.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\recover.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ntkrnlpa.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\systray.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\userinit32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\shutdown.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\chcp.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\MDM.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\win.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\autochk.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\alg.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ctfmon.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\logon.exe	Fagot.a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\NOTEPAD.EXE	Fagot.a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Fagot.a.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2728	456	WerFault.exe	168
2452	4928	WerFault.exe	176

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fagot.a.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{652623DC-2BB4-4C1C-ADFB-57A218F1A5EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0149EEDF-D08F-4142-8D73-D23903D21E90}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{F5BEA1B9-FEF6-4093-846D-753C42A1B00A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BCA-3C52-11D0-9200-848C1D000000}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AF54BFA2-474E-4B82-A5F3-B79E6F7A80B1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\UnattendBackup\IntranetCompatibilityMode	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49E561B1-1091-4E65-98A0-AFCA4996CD1D}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F44BB2D0-F070-463E-9433-B0CCF3CFD627}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL\UTF8URLQUERY_ALWAYS	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{f5078f22-c551-11d3-89b9-0000f81fe221}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C832BE8F-4B89-4579-A217-DB92E7A27915}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44C79591-D0DE-49C4-BA3C-A45AB7003356}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{353359C1-39E1-491b-9951-464FD8AB071C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a1ad1bbb-3b33-4260-a74c-5fd8bc1479fc}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{03D9F3F2-B0E3-11D2-B081-006008039BF0}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\CONSOLEBUFFERALWAYS	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BC4-3C52-11D0-9200-848C1D000000}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B95B52E9-B839-4412-96EB-4DABAB2E4E24}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3050f667-98b5-11cf-bb82-00aa00bdce0b}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm7e.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm61.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{92085AD4-F48A-450D-BD93-B28CC7DF67CE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00020425-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{EF99BD32-C1FB-11D2-892F-0090271D4F88}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8FE7E181-BB96-11D2-A1CB-00609778EA66}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_APP_PROTOCOL_WARN_DIALOG	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm7a.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SMOOTH_SCROLLING	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{bc5f1e51-5110-11d1-aff5-006097c9a284}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{ADEADEB8-E54B-11D1-9A72-0000F875EADE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8136114B-FAF9-11D3-B0D3-00C04F612FF1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{466d66fa-9616-11d2-9342-0000f875ae17}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2764BCE5-CC39-11D2-B639-00C04F79498E}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm79.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F9769A06-7ACA-4E39-9CFB-97BB35F0E77E}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E476CBFF-E229-4524-B6B7-228A3129D1C7}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8FE85D00-4647-40B9-87E4-5EB8A52F4759}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2D360200-FFF5-11d1-8D03-00A0C959BC0A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{279D6C9A-652E-4833-BEFC-312CA8887857}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\UnattendBackup\MSCompatibilityMode	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6a.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7C8780B2-793F-11D0-94AB-0080C74C7E95}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27A3D328-D206-4106-8D33-1AA39B13394B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{238f6f83-b8b4-11cf-8771-00a024541ee3}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\URL Compatibility\~/CWIZINTR.HTM	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm74.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Capabilities\Roaming\AutocompleteFormData	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{EF28418F-FFB2-11D0-861A-00A0C903A97F}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CA8A9780-280D-11CF-A24D-444553540000}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BF2-3C52-11D0-9200-848C1D000000}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AA13BD85-7EC0-4CC8-9958-1BB2AA32FD0B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{970C7E08-05A7-11D0-89AA-00A0C9054129}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5z.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FA91DF8D-53AB-455D-AB20-F2F023E498D3}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2D8ED06D-3C30-438B-96AE-4D110FDC1FB8}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1D2B4F40-1F10-11D1-9E88-00C04FDCAB92}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7F1232EE-44D7-4494-AB8B-CC61B10E21A5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Plugins	Fagot.a.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.blacksnake.com"	Fagot.a.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.stl\Shell\3D Print\Command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.faq	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSRDC.SimilarityTraitsTable.1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/png	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4586725-EA85-5AC6-846E-A847E0E45A0B}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{FA10746C-9B63-4B6C-BC49-FC300EA5F256}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg4\shell\AddToPlaylistVLC\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{0785E3D2-6965-3DD2-A870-81BBA8A8547F}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp_8wekyb3d8bbwe!Microsoft.XboxApp\windows.protocol\xbox-setti	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{c1e9bc6d-1dae-421a-9369-cc7ff0d6e359}\Shell\Windows.BthMtpConnect\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51973C56-CB0C-11D0-B5C9-00A0244A0E7A}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Picture.8\NotInsertable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.OsfMui.InstallerMainShell\CLSID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\XEV.OriginalApp	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E18B-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.m2t\shellex\ContextMenuHandlers\PlayTo	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B8749705-255F-370D-B1DD-4B027F6DE5B6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.CDAudio\shell\Open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\System.EnterpriseServices.RegistrationHelper	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1341F4A7-3461-342D-A8B6-4F170A52F67F}\15.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Addin\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEEA7BF2-7335-4543-8CB9-23EFB03E155C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3853C880-77DE-4C04-BEAD-A123B08C9F59}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C3B7532-A36F-4A6E-9072-49BE649B8541}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E174-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell\Decrypt\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8537EF7D-E7D5-4F92-B3A1-8E0F8F1BAFF9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.b4s\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetBinaryMacroEnabled.12\shell\Edit\ddeexec	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72B82A24-A598-4E87-895F-CDB23A49E9DC}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE67FBE0-B834-4424-880A-52D6F71BA90B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F7F1-98B5-11CF-BB82-00AA00BDCE0B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6A837D9E-0B2A-4298-B550-C479278DB795}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.divx	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75D01070-1234-44E9-82F6-DB5B39A47C13}\InprocHandler32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.aac	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3gp2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{57187984-0CFA-4AD7-955A-ADA220110FC2}\15.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F27C-98B5-11CF-BB82-00AA00BDCE0B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A8766A0-62CE-11CF-A5D6-28DB04C10000}\InprocServer32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\icmfile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.asx\shell\Open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psd1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSStorageSense\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C03C4-0000-0000-C000-000000000046}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00030000-0000-0000-C000-000000000046}\NotInsertable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp3\shell\Open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.icc	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{305104C2-98B5-11CF-BB82-00AA00BDCE0B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020821-0000-0000-C000-000000000046}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\System.Runtime.Remoting.Metadata.W3cXsd2001.SoapInteger	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AFB1EEB5-369E-3C8D-BEE1-0CFF86414481}\15.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{78008402-40D4-30BF-BD91-A61D8815625E}\7.0.5000.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-drive-to	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49473E34-D4CC-49C8-BF62-79A08D2134A5}	Fagot.a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2900	msedge.exe
2900	msedge.exe
3852	identity_helper.exe
3852	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
2912	msedge.exe
2912	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
4928	msedge.exe
4928	msedge.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe
1120	Fagot.a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2004	2900	msedge.exe	86
PID 2900 wrote to memory of 2004	2900	msedge.exe	86
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 3956	2900	msedge.exe	87
PID 2900 wrote to memory of 2896	2900	msedge.exe	88
PID 2900 wrote to memory of 2896	2900	msedge.exe	88
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89
PID 2900 wrote to memory of 3032	2900	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/home
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3dd746f8,0x7fff3dd74708,0x7fff3dd74718
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1356 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1628 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5492 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,10164512211768885580,11204025711450948921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x248 0x474
1⤵
PID:4520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4568

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:456
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.exe@456
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4328
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll,f0
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 460
  2⤵
  - Program crash
  PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 456 -ip 456
1⤵
PID:3068

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 160
  2⤵
  - Program crash
  PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4928 -ip 4928
1⤵
PID:1500

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Fagot.a.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Fagot.a.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Manipulates Digital Signatures
- Impair Defenses: Safe Mode Boot
- Modifies system executable filetype association
- Adds Run key to start application
- Indicator Removal: Clear Persistence
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Windows directory
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
41KB

MD5
a7ee007fb008c17e73216d0d69e254e8

SHA1
160d970e6a8271b0907c50268146a28b5918c05e

SHA256
414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346

SHA512
669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
1.2MB

MD5
9f8f80ca4d9435d66dd761fbb0753642

SHA1
5f187d02303fd9044b9e7c74e0c02fe8e6a646b7

SHA256
ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359

SHA512
9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
73KB

MD5
cf604c923aae437f0acb62820b25d0fd

SHA1
84db753fe8494a397246ccd18b3bb47a6830bc98

SHA256
e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4

SHA512
754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
27KB

MD5
c3bd38af3c74a1efb0a240bf69a7c700

SHA1
7e4b80264179518c362bef5aa3d3a0eab00edccd

SHA256
1151160e75f88cbc8fe3ada9125cc2822abc1386c0eab7a1d5465cfd004522c8

SHA512
41a2852c8a38700cf4b38697f3a6cde3216c50b7ed23d80e16dea7f5700e074f08a52a10ba48d17111bb164c0a613732548fe65648658b52db882cacb87b9e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
18KB

MD5
7f7f83dbb8d3f7d0046944d557f1241c

SHA1
de7f53ff96f28c9ff125d76605ce0d355ac31e8f

SHA256
bd16f9ed19e1b9bb4022ca248b2c5cc33855957b4fe3cafe702c0aadab5876dd

SHA512
b3316a0fc7993c0165aef10e06bc714ef299b46e6bb4acdd6832e2d04a7bf3212a209057f589df0324997d0dcd67125cc1c4eaaa20ad8f5876e1537414e99af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02735674612cbc52_0

Filesize
3KB

MD5
d6c2ebfbdc87728674a26f924773f2d6

SHA1
295cdfff6121b784b2d24e672d28ec9e8ebc14f8

SHA256
d576af4f481545451efa2e451cddfa4edeca7af3d0f4b19bfdc0bfc8ef873445

SHA512
a0460bd5c972ba40b634c2902ce6a4a4974d217bbde720b944b0c64805d165943bb0f0f7b2ac092fff52ef78b605d54416f1f2de9bef9d55ebb0bc400295546f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0

Filesize
2KB

MD5
0cba99893a520c20f965ffad0433a91b

SHA1
d63c254c1535ec72211f93a466b51d84fea5475b

SHA256
9c4a0065c3dc376e0f91521e40c85fac43ad52c7eba930596df74eadfefa5e25

SHA512
4d87f5436005e7d2ec682d738936183b588ea746e51e72899342d97d35a1e84af08fbdc4afce0ccebff99518f39392f43c5d95f281bbcaa4199af9893cfb3724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
5KB

MD5
66147e0fdcc5822f52c759316641e91c

SHA1
47f27a683b081d7989c981794dedfff53082f5bf

SHA256
546db67a6ee30d2392eccf6a9a5c469439eff7ffad2da9751a6a2c7fbb1fa86f

SHA512
f1d841e215d39218feb55d73cb5180cc165b4195727ec1611f663cf7b3a687a292fdfe208c8f15b99446b2680db4e5a9d0bed5e2ee040e5c4e2eebc74ebf6815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\120ab24e8b469464_0

Filesize
9KB

MD5
11f839c839864c0fb6635d8f1a76d2e0

SHA1
5dc6dc7f420b2bc634e80186c465aeb9a5353d58

SHA256
fd303fe95d443cef1520f78027ee81c22626dea627d951422304a8bb30c54fc8

SHA512
a1a76cf13bc31cdf009b926d810027fbe499b97e07c9aae0a815c38f9f4889d28518d29711185a2e9a4aad01c25bca43b7adfdb15c6152a728b821d45b4dd4e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
bad0b2cb075bdc39cd2756ad811cc2b7

SHA1
476e8fe787864a275f11be3041274899f4020b39

SHA256
e8ab7a124dd02b186c12336bd87d910630271d283a6cffb587fbd817bcb53b66

SHA512
d1b8658e7c9c5b49c3de576c32807f09410da014e32f29255900baac7d3b6a23ae3eb67f4b9c843c53f1c2e2e2c14dcbdc96720ae771d3224ef4cdddb8f3bd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1927a26afb9a8b4a_0

Filesize
3KB

MD5
f326ff4c9c840ac0e160baac0b0c113c

SHA1
7b6010355c4acac11900801275039f0b64f17005

SHA256
d9257a911e5f2fa5273ea28db65906214cbad9774055f7ca3212e620b27f9246

SHA512
647780dd05d1966833c71a71e425efba23528ea397df99fa1dbb533da53873da760a5a0ac4155bb5d6da0a84e99dba06c98409b5ddbbf393e4c58be235d5307e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ba208775fb5fe09_0

Filesize
4KB

MD5
9e3db0506b33cb2d8d9b93ec3c11d6f3

SHA1
7b1ea8a2ec416c5997df4a64ec5da6fa0829f821

SHA256
471edb9d6733ec11129febcbc0877640522766e67aa1d993b9c91653a85cfba1

SHA512
1e6cc9ba48e7644ce16ce6b0b175875b487f7c959705363abfb4a31c71b4907eaa42c9069680d780d3c0e9c9d996740dd4604aaa249f6c24d79fe04eef715f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
3KB

MD5
47291c994a91243db63792ed072a1e36

SHA1
360684485dc5c2632aea5c7f96c920ab39b06981

SHA256
452923ea9a939bce854d4d75ba0bca90cddc25cfb56941d43715383002235355

SHA512
3a52da042ec3ed6b877fb3fa7b416b4150119568d351606ba902846b09f8ee723694fdfdc75141ec4a6fc30421a21ab2db90f3f81fcdbc6cd8508efc4542af66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\32d0ee376fcec3e1_0

Filesize
180KB

MD5
debd846ffed31632b07a3c8ab7fb1e54

SHA1
94eb4b768f09e298b56e127c783e0def8b21fa32

SHA256
d3ec8315893e37b20bc7b879e3953c4ca6a69e4440f7b20251cdc996493c57c0

SHA512
3812841c456deb681954ebec802b73331c7841b9052cdacb91fc01ba8925c67224d8fd7f6d57ddcd1456bbf11583bc35600e3986807610b8eb4a4257c22231f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3557d97bacb52931_0

Filesize
31KB

MD5
649c583b5a559894ec3465228c231777

SHA1
141fa4d217c64d6f0ab03b63079f9d1e58a61327

SHA256
8418f3ae0372680fd3de1a0859041d5908e3e20f6be85fbe7b5a7a0dc2906153

SHA512
ecc68d4170de0b6b913cacbaf2a3f01047a7837f094b0ec7ec12f7dcc006e344e4ef6544fc76bdc8135e3ca6d0ef185fdb4f426f8aac86c4b96f809f012662df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f02c4494b1a18ff_0

Filesize
2KB

MD5
69e029c2f7f11149cd5ef2c88c2b6385

SHA1
acdc923e3dfb8272c5b200af2fb753ff5fa8d13c

SHA256
12268c6d3f419222afa66bf8919788015699c78c05a931652e7d5781136d8740

SHA512
b4bedc3f09661e4db4ec0586c13cd2cc128c3264d0305b03148f49270a5a6e90dfedb4f75ca3ac0773aa032fdb8fb6113e9dcf32fa842e0200b6ed998c0707d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
8011c9a760c36902398d76945b86bc34

SHA1
fb1eaf6b57da827baef9da72db86d28dcddc21be

SHA256
aec288c948c5a85c9717308e39daad89d87ec0add2de663db5a8e9b7f7aa5cea

SHA512
8a643b9ce5b6315675d77246ec99ca89c5145bdce7defa92038eca47e620f8e883bf1879e5145bc84dcd4b1a0d4f33d23e709409260f2cb5587969b9187fcb28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47d4e623e47f5bdd_0

Filesize
262B

MD5
adb66ee34e34728fb69bee0376c3383b

SHA1
faf41a45ac05f6cc767e922cb889759a281f2935

SHA256
2db24cd0a0ae4c68aaa6b9cc0cba53ba6e64bf3eecf9e74ba2fda97a01e88c84

SHA512
77ee43c818b6e3401556b91c81b544feead774c57092040dd75280581807aeedc4235caabb6277f263b34ef5c63c84934f664ac4829c4c7d66ec41a75118ffc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\48b1105b4c2874b5_0

Filesize
3KB

MD5
7db7bc384b1d2ab86f753eb4b8f06216

SHA1
eec81cde2eb2492f82f748bc35fe286e5d945d0b

SHA256
cedbb9b94d64bf0e20852b73d8e67014556fb1559baa4bcbe91651e6b908a1d6

SHA512
b5e11742ceb3a4694c5b796dc6e38c3625de41e3a7726f5bd0a28048b90cca3dc7ed8d4dbd4e08f08d9cb947b5420a55c0009f1e9154fc2835b6f79c94101fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\537f62c2e00def92_0

Filesize
262B

MD5
af025ccf81d78c43ea6e5cf46262f9c3

SHA1
e6e24e03e9429cb16b566a55f296f6ecbff75e1f

SHA256
a2f6e8b44f5c9761dd40cd62171ad85b656f94bae7c01e08d3ccfdc089d623c6

SHA512
658f19892b694dc4b6688f68da5e8c5ca8cf9b94f0c514b3ffe5ba3f0f7cb04791de1a8bd039a1f1a4fba2637430eafb381c093ad38a8d2575e0032a1957543e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
9c038b5accd9246f6c15c6f593fa1d22

SHA1
32cc3e159fd9f2bd43c7dbda6c151ecade7a0737

SHA256
df3e43f4850d49e0763eabb1cfa65af0e883bb8895089775bded90116a9442fc

SHA512
c171577cdd6bf21faf987f5c24d9c275677458a9ff39adaf97aa1b067c5ec59a91e5a5ac64e0800afc463ce5d41987b4204f3d4cbf1b12fedc1d6a42fd718f8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54621936eea23565_0

Filesize
11KB

MD5
330bf7dc5604c59bf1045593476024ae

SHA1
8703fc63250b9d6ff9c76e9913981cee9142e510

SHA256
8bbe9b93cfdff9157d2d8463888fd4bb18495a71a5bc86fca0ede760e0474ee7

SHA512
dd857c4ab1099b195b0620569c8a213d28f69a36812b196624a8d21e48e7514f9b60a589e173d40167e3b9b8397703420d8923cd9e9ae3bb783107213888b94a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\580fd9376c2d4a3e_0

Filesize
9KB

MD5
3e93289a941cdd6f1d706ff21bfabb34

SHA1
6cea741039fb603bf7ff5ee2b045241ae7a08b83

SHA256
d6f614219bc392f18b8be84628aeb5678c11d72df9fcdea93e7349155fe76189

SHA512
7a0326291917ad64d0c9b72d767007331f8adfc59c039f61f161c8e53efa4850dc1b0dbfc8e3110c6c28f519eedd171401f1cb2236d8b653c12454f49e297341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a994fe24b451732_0

Filesize
14KB

MD5
20fc8b184745183fd75547f8f82d16e6

SHA1
312338078b88bd5520897e223001ccf68d1d23b4

SHA256
45805633bbc621bc8962d26dfb05422a5346fa139e2f61c4648c1e72890a688e

SHA512
a1b01f36709908e1b23e7146c2b12d2fbb536b9881dd78270f11af4632089ada41b7bf0b5dbbc842447c6a46febe68e76b8361ae1445046352edb510ebffa140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b2f11f3f15a5775_0

Filesize
5KB

MD5
0fee6c76e68fcf45acbd73531ebdeb43

SHA1
6759a39782780543f1058031eefea5ffff303f8f

SHA256
8a47850089460e1793fa9124350d8f8491043da2f08b14584cbb89f461c12cfe

SHA512
cdf64f5a1dd0bfc71ed161ad4df40c9b4fba3560996d7b511216f56bcdef280e1379a61ca264a07b4d298d836a216464394ce02281c74e1d1e1b43677bc20247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5bfcdd37423dcef0_0

Filesize
433KB

MD5
7e80de5a973ac022d056a38974d3926f

SHA1
64d2ede3430043e52e1873cdccf3838e1fb95c00

SHA256
cecd2b5bf8b1e1c59e51a7506b3dc92302973e425d68cd28764879d53e5df0d9

SHA512
ae539eab8161a8fae829d9928e5f80b2eae4dc6fa589302f70a842bc9e2e2b291bf4b68f5cfce78eb3fa3cf17259c757ec6bb5b6612a2b7f188a0ab059d538aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0

Filesize
1KB

MD5
c3a8dd4b352c5b1ecde690cf273942e8

SHA1
e9c21c1cfc875ccbf441aac5b6db8c0e834e166b

SHA256
f3390109ba9d960ee110aa74ab4dfb7ae01a1e03c2849e2b05ab827c75bb17d2

SHA512
04641b7dc0fd627c2791f268f8ae9b36c8aae494c4fbfb882a5ec21145036575a646dfaa461a1806534ccd4e7fd2562308b9f990fd6113369f142936fe83d7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f08ada4b341233e_0

Filesize
2KB

MD5
d8b4738c786dbf54c0cdeb70fae90b3a

SHA1
bbcffc8cf2cceb64291fc118af3b8151fee75f98

SHA256
df167c2e2275008e3803f0bfb18f104e0490e531bbc9dde74afafa653b0b49f2

SHA512
cc93ad748b001f1fc392a846548d2dc363c69121b12d17c38f106c0d6375144b29f7d4cdd06e63d3b41dd4161f494bde4a83a9cd26bcdb6d57261e5a61fc8c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
2KB

MD5
76694603f858e841d747ba08377eb9b3

SHA1
bc2395bb35296ecd5b115f5ef7b9f83383e3cb1f

SHA256
a1837274c795812ebc9f4dfe583e65f3432def32a8fdcc08b79d129fe407bf1d

SHA512
c2f2c66bd1cbad6b366c077bf2872dc4f505b6ae9fe0c533202a1b3a3335f6b7918214a4b46786efbee3102b755f6e2033a63609f5e00351c61abecb70778779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0

Filesize
12KB

MD5
ba3254678166c43ca3f39b1614ef9ddd

SHA1
2b94823a62ab0e2f34d5c26794f7b0eba0f0fc2d

SHA256
cd329aa5e7f8d2d98398328edfa2f0e85eb2bfccfab598a631b8597eea7b69c9

SHA512
6cf2635ae3ed1f793de97cc62ac60837ec3cf850e628585d9146f122c50218960c42763c9acfb40e6387d4e0983a0e96311150d7dcfacbce18c7abe9a71a8a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e23bcf4dbf5c221_0

Filesize
42KB

MD5
6f9d550f56133a80585d8d5b0efa588c

SHA1
5aa98b66e75063ec1acd0ef58100f70e3007b9d0

SHA256
8e48a696e1b7a06a040a27b746e29429932083446d03eb2bca35f52b15409c33

SHA512
f24cb92590cedf56a04667d363ef1bc8c6ea68cad7c42e4a00ba38de2989df0926f540298cbcd3458083debbb021cd985edb46eedd40ed99bec0e096dd2af2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81764cdb356c9506_0

Filesize
8KB

MD5
c939247ecc61957fec936af9c1932382

SHA1
773f4093217140d6555597c16a867d7ecc418d71

SHA256
708e71f8f3d86f98a2e14aab64dd8895bdefff11f1110d0ebfa7c2b604505561

SHA512
617c61ceca0ad928697438ec5206421eaa81ac238f4fd15aa01c1e036a005589e73717dc0c207e552790196a41f844d88c844bd60a58897b1a8129f66462109f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\83d6d3a772bbc707_0

Filesize
6KB

MD5
0b05e75f7d4032cf78f2f910aba38cad

SHA1
a1b4582ebbf481cbe2dd9dc5905b3afa6ec6385b

SHA256
72afef78690ed954345301d5cdf1249f125b706b9b6210b5faec8b448d1876f7

SHA512
f7931f12f8ad9a3875192a9ce0448d2db782cdde391791d6d277e1880b1154fda094277b4af5707e33b056ab732f7a5c09fcc53c078afb65f8896702c4566fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b65cb26998de8ee_0

Filesize
17KB

MD5
babdcfa837f616f446d1d075415d6884

SHA1
11c74d8fa7bffe5da03019284432fb5cf1928deb

SHA256
9e55f77c9bd925915bb4f99a826145f50adc29fbf1ec0d4e0aa4e6020aac2e4e

SHA512
929df08d655c6d55d3b0593ace93b4c152bdf31d0c4bf999e5f33a24b7436210dc887ae265a0c53c66299a814b3546d4f19d6a4391b68cde61dcf3ff58e47f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
e1f87d31ca423b5882bbf36d8d8e5c31

SHA1
da897204ef9e297de5dfdfd3f801d747b53c4239

SHA256
761147577b430646e252818b2313014ad4d0d0780d7562785c984a645a72c385

SHA512
ea3565aa92143e2124f9113f6a491ef3eb12d254b62c57f2475212337ee981f0e61f215b88e0ed503815d04a6a49586a4388baa9863d7f75eca57fefd5fd3483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ee73a31bd0cce7d_0

Filesize
20KB

MD5
715331928f73f49bb7a9abafa180a16c

SHA1
a4775d58e557e820b0b50742374771205130c4b8

SHA256
9645377486d2655fbc605d848952070413ef52b7cd893b7d34cb17f0fdf5848d

SHA512
fcb0f5214db832c7326a700cbb0bfae53a216f9230315b4b9b6591f85721398a9b1d6646f848fe2291f2bf696be2dc2b15b1ea53e4065933267777821e14787b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
2KB

MD5
4e0250c96148ef4fc99b2b8c267e290e

SHA1
c61ac23db26fa59b8e31b3269f1932bc69dff36c

SHA256
11c45cab254bcd0f70ba1de8806a1dedf5d4d3230095e7eb13764e8e74d5e5dd

SHA512
fd48bca9637c6e98666d01c172e1c77af26562a53a870a677e22727e94dd345c98e50b4f5b8ada2f09ab07da6d3d56821f0d0e4d09be79e8fd0483a4a0a7342a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94cabec0fa031a1d_0

Filesize
5.1MB

MD5
da093ebb84ab0983ba65b2f26d84896d

SHA1
bc600cfd86987ac564bee396697d0ba368ca61fc

SHA256
c2e64996fb09891a17483c92c2ee0a025a4898b771190ab442cbaf59ef9a5718

SHA512
48d4f53da126643ff1c1cc533410445b1757f4113025af7a9935d5bc58375303ee6b940bccb42f5822066393550aaf2e44016dc0d336476b5e1a1f12977a3ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\97e5761b2a976f35_0

Filesize
262B

MD5
3210f8b1b342f92c6e49f9923086a144

SHA1
0d331f52220cda61129122f2943ddda8107e41a0

SHA256
232cc41728ec04e9e8adfa552bea7135c623d72074417ffefe504041b65694df

SHA512
86b6b54bd8c82cad609632cf3f635d03fadb0f893a00fbe6a30a6e7fd49264cfb4f040e1845d1baa745abacd71ccc3ee5db1a5a614b198e9f69f4a9d2af6551e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c0109f54c03223c_0

Filesize
262B

MD5
6040590bb25d7a1004de27d9d57f6506

SHA1
798c68305f2e7c52f9f1e905016cf8727129ebce

SHA256
8d5522042f8838953859c8b668d9e8c813386704919a3c4c72435a0e136eecd6

SHA512
c5e9c0777c4325def198b0ad762516c0275ced5823a384291d51edf37b7783c48d0d2e6e5db9e0af3c75dbe4ab042600e1fc44da0fd3b3f535f82f22bc851dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0

Filesize
47KB

MD5
c0f90ca2cbd4bba0ae4f4916b07ecc66

SHA1
080762a9b16bfa8d38d53f001a4687fea8aadb12

SHA256
481e46583340ca465206b1500d7f1754b8f0623cce4e49164a6501803858fe13

SHA512
f3af1fc20d1e4f6d800f7fee8a5d5f4e08133c8ca5a9895596b1c45c1eada0a46992d23edd5b25e18fc305aee0008e2a5160d46491a2ab5c98610f89d1e618e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a267b7c21d8b8c9c_0

Filesize
19KB

MD5
d45f639b1b3b21149778b00c5dd2315e

SHA1
2e1108f7eccc2b56d9ae165e42e1981a13a9fa87

SHA256
b7998abafcc083f1d4278009729c6265765e9f2513a417bfc9ed42b0bbafa19e

SHA512
3016aeef8bfe9d980ab9b7be026309689ccb1552dd1d2b21cd754f1e8d3919f7a6823e9404308cbec3bfc5804cb6416bba1fd726f9536881d2c756516aa20985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a51ef587dc6dd4bd_0

Filesize
7KB

MD5
fcac77d1c44967c2e20bd0d2c1a775ea

SHA1
1995cf95a6516b0f578b7f5125d535737075e077

SHA256
befa9f67a4b22af1a795d080918a3de5fe0d99a44e82e4161f4a258c533b8f35

SHA512
8580735bd84b7fe26969b4d9a10fc86458870f8d6700f476a61bf1bc9831a97b831a95519a9a531e292219fcd40504a97dd2c6a25f9e907e4815f06f322df41f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6537dab24e365f9_0

Filesize
4KB

MD5
ea5137b71fc696e3b57d264de671a146

SHA1
469feccc2bcd0aeb9e72c94532c50fa79ecd1117

SHA256
e1c955f829f4025adcd64b4e7fcaca319c31c999098c7049c8a272a72c947467

SHA512
f49927648670ce3c1cc9e73fb19ac1420d8c4ac28219ed8d81f9efcad05046c68792a2fafe79714f8afad5a2e6527d3346fb9815ad83c2b635d91705395e2f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a88fa0f1b0412482_0

Filesize
303KB

MD5
c0876422b5c8ec9668ff64a92b9b8646

SHA1
9f026a21192c38de706b9b9c516effcbde13016f

SHA256
9448ff0fd44f481608fa57cbc49dadca00f979eb2c537addd59bf29048d95732

SHA512
06d90da25521cc141008d32e8bc5222c8534e77c6bf8640bc0778d8382279b584dbd48d9e5cf4b389997340ff5e61c0b72beba955e457ff322e9c1a6588c2502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa20c296787a3f88_0

Filesize
3KB

MD5
a95564e1b884348bfc643252439c0871

SHA1
6118cf0b91a3c0decc2b98513cc04fc58f4a1d61

SHA256
c68ce1c26480c5254fad4b4fe542b4c2b9eecc2ddac0fb9c4143c8875ef17fbf

SHA512
082541bebbc4db64ff31bf66d336cb41e3663aecf20c8b64b9afe3232ed603276f1012643e26c99ca81c365dd8e10fea504125a1b3d25bb44ffcb99fe47ba0d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ac9b40a0411376f7_0

Filesize
1KB

MD5
b909598680e862759b0f4ab93d268d72

SHA1
2998213f3948330f25f8be82cd1011b9b739ee0a

SHA256
dc1485bfb99a590b57c58d9fd58d4cb3531219d1d55a5f53a55db02943b58eb8

SHA512
89804d5354293c0859b6631ba9efb9bf3af9b1daa6f13d13196a426e58c4c744209926c8ec5640f4817428574bd36f1e09ec155ebbdd3b452d6886820a3e3111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ad0daeaaf7ab1b75_0

Filesize
289KB

MD5
381a6f73cc2999911987526fc71d9490

SHA1
d761539ea647eb4c3220116835a6423dc954c95c

SHA256
0656af03dfc4c6687667e7be2353ecadfa4a70ac677ebc61718ab9fc9f6de415

SHA512
62f878bc1666e107ba85f103437145a8ae8aa280fa8b68fc69983e9d52c643c780c0f563d0e7c07a127b1b031ecda1d6ce2c0798d4ac1fc6256606376619b349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae8d0b05a4b538df_0

Filesize
262B

MD5
89fe53095d07ab10b2954df453856e24

SHA1
038a965faa5b3aff8bdbf8f3a4d1b379d9422fa2

SHA256
7c3b6598535f001132ffd305b5c0d1ffb23d1054281dbe44018305530500e4cf

SHA512
7547fba061b9ac338f1c3977722b4a052957210d31639c135f4b85af64470e34a1a7aa2c48cc9dcf97e30ac5af6899a93dcb18d07274566c33fb60674fa64ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0

Filesize
5KB

MD5
835e986d7ab5d9833b5afe32f7b901a3

SHA1
0669ec79a2aa22930698c5328d234f6d056fdabb

SHA256
84f9efc0b5dd80d0aa5ad140041290ccfe8ae0c5014cf8703a999c8226ee45fb

SHA512
c1022939e41fc7e8c05df35fcf9d758f575c27651e351d50747d0f614804e54efc500078bd5d259ca6b29f69f4cc2247c8ab755095aca3b395d08b33b6756beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d7d09e2437e8ee_0

Filesize
5KB

MD5
ea50bfc08bef2fed9915f977e31a2a3f

SHA1
3cb7e3046d8a3273173b8dfc3acf1e5ee0b56096

SHA256
0c8cbc50c831e3c918fd84ff2c7467286d134ae67761aa2b1afd0f264c3ac85a

SHA512
cffe0d78659dd2f6b4aea9b72f1ae16abc8a943f63a28878265fbb85fc404575bc81e9b9c61db024c85ab52208bba440bcc940aebe81778f6cd31f009e31af4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bfd9b5c29c5c8524_0

Filesize
1KB

MD5
aeb1fb45be1bb08af471cb1a1057ca89

SHA1
7e48ac0c72266579a782a4fcf690a80847a7e6aa

SHA256
171d271afe980b5b82de280b951f9b21d82830994ccc6c5fd790756211985665

SHA512
25fb1fd0c6909d582599863d44917596c584453d4af55d9d1d44a767025ae3d2496448d4520b4c76960525f11745ff8bb6e560f48ad326d64dc8b5cae2a23510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c807b8e9088e4030_0

Filesize
28KB

MD5
ecdf053a86b38ca91aa782e5af0e02da

SHA1
11104c5bab7d6f494b4a83b8d54ba68623fc999f

SHA256
9806ff2ee8d516b0ac55eecf717b0a015e8587f323c18deb6173c1454b0cdf94

SHA512
f6c91427a4bc5ca97f8ceb1350bb711739766d520ba284e7390611b4d05b8e8ab91a1154504624736e45b3c7b7563d9ef2ba26720d1c756eb558091126e05d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ca892b448ce010ff_0

Filesize
35KB

MD5
62a1aa8734e751db497c7a92ed686320

SHA1
71ab5e23cff856e799ec04f75b473b56e58c9845

SHA256
80a91417247310c7eee4c753533f800cd77d4baf451897e2fcffd4a3fcaa729c

SHA512
398d70cd05b8c1d87353b8033e1d6fe8334d5fdc57ee73fe30225b7ca2f5c0e4a292ba296ff395546bb7f8db71106e4087dbd0846ff3bfe3d18638c0a1cb396f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d00019f29c31fea5_0

Filesize
2KB

MD5
6f857a67b173d7477c54d2627b8a04cc

SHA1
c99c0e16dbbf20bc47a6a6321643b95693fd50bc

SHA256
2809372a553e1a5dd957e410651c7d28eb08bdf517b3a3248b10ef8f97a06eea

SHA512
3b12ea40b2cdb2ad5f87c6e8ccaf7743fa823eeff5570cb451878ca641b90878984afd86a86d88ec9a65e6169c688c7991b3f92f3095b1f4a70a98c7158d2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d1d5771f5974fe10_0

Filesize
262B

MD5
3ebaf1b2bbdd469d727ebfee7179a310

SHA1
7bc8d257c29b65703af6c4166b08368edbee166c

SHA256
73fb7ea206724ea332d307e3037a4b8a41ef4e038eae4f51db64f450c117a144

SHA512
afbddd8841365dfec78ab46d8723f31f05b7331932374c685fe68c9ba9d97e157a76b937df8b1220194e0a3d44e4a1c7a55ff634eb70eadcdaec44d6a2be0084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d37cb16ef5eb861d_0

Filesize
26KB

MD5
51d23ea7df1277f90992bcabc58e2344

SHA1
576b2149fe41941a2ae6299e5577ac225873d49f

SHA256
c75cb515fd6a15e7c8d808eff615f4d16360afb92610ab0baff4e948a0f1ffb4

SHA512
a1a1ee240f7fc61db30d24a35cbf91276d17b51c5dff742fdd372febb3ca9cf2bc81e083ab9ab255bcc80f53d1398c5a633e9775a6374852f79d98aab3057661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3dbb3008455b523_0

Filesize
262B

MD5
979c1b73e0e9148abdd16ef1b0b0f3bc

SHA1
817ea05c0aa57644eb788e7459564bb5bd6dd2b9

SHA256
b43f6cbb6f6e46ade10e895b72cab4bb22727a3932ab2e300790743d7929e08d

SHA512
516ac75da7f5498ad6be26baa369f628ef7a4d45e6767834db91491d6b58fd36b5a5052c76f881bb56b071b937ac4ef68fc7e7656dfa81b308b84910ad70e88a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d495b1e4dd8bf2d6_0

Filesize
175KB

MD5
03b5e3eb04b975a556aceba40bf7a7de

SHA1
a5fbdf01fb130d2f78a51d7746326053755022a1

SHA256
1020f6573e9c855354b6dc6303b50ce2f2107347e3144953bc7d4d7b95f23128

SHA512
6b482415f404915adbef685d0694d4c2ac31600b2d3f6c3fa1f25c6695793bd7c54d50d77b6400367080abefbee42156f1e415ecf23acab76951d5cab854ea37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0

Filesize
262B

MD5
01f4ac00b4aed696cd10488f7639d58d

SHA1
678b5166fe61851e5a230c43f9b5fa8705bdee25

SHA256
41f1b0b32c7a4bceab1da6d1726da21286e44d6d5cf327856ec3ee261dca98b0

SHA512
2bfdf3fae911742177622967a2e5e007f4d3c67a1c1dd7d284fc86fa6131aea747bb96abd6b3745823408a581682607970517808ccab0cdd52969bf418351df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daca09b4eb185a45_0

Filesize
11KB

MD5
35cecb4e93f11d6ec5c19c903f0937c0

SHA1
b8691a41fb6b41cc46555b2ae85ddf6200d603b7

SHA256
6285712ff24480785939fae626c1bd0097f4d73f12b430e780abf1f21f1f1aab

SHA512
3a9c2f7cf50df5cf2fa49ade27d7244fea9360823bc87ec80d3392433cce35a1ea9dc953e579a652ad6f4f022878d3f6f8831be5f3d7c5e1fd1d2d57503358ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0

Filesize
3KB

MD5
8e6c37c450ab0649fb40eda585e94e8c

SHA1
af5f4287e1b76fe38597ddc85af7af4953a325ab

SHA256
3b35e888d8b5152207f754656bc7653c075f6131f647491b4e372bb24bde978a

SHA512
96525f034904d0044ee55ed615693977e3edc2dfe425565256e6469636bd3262c97c9de8de071d140fad59e09e5e6ed17410755b7bef3a77153ad6da137d2a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e504183595893c5c_0

Filesize
4KB

MD5
3e33a92ee249a9bcbd566f31023289ec

SHA1
271bfbb3c853758cb50bc1ce655178cd66d6b3b5

SHA256
146ab79f15b0fe16b4d369ba42221913ac67f6e13759ed4cff3c8ad84b8828f4

SHA512
b701de1f6b6ba6f0ed98c83fd0ba1ca5c05028309566576472216244f4b86f32f7cbd013bd4c7e08eefc081ab5c55078bf9f6a948d38fe5ec67ee64b8cde2a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
0d1f91ec1dcf216dbc4f63e291e1a7ab

SHA1
09f48f69ea279ce2a65dc807b13810356816d23f

SHA256
2b08ab0b3468585f06f881da5dbc837d1d7a13efec5e0d6acaabd5ddb1efb489

SHA512
2f6d219d0f409d0eb651753f7a68639b68d85d0be9b5203e119032a8035fe7be1fb2e494e9972b227698ade6783edae3e7e79b187c29aed198787aa1d032e159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e83798036165846c_0

Filesize
33KB

MD5
e21fc4949d8cb73dcb21704f50a28a50

SHA1
5d5a61c4cf54671b9c1a4393b7bd446bed4c4b66

SHA256
70ced3092bd4cf8d31d7be0cf60e8c41a3f6ae619ae521e61ce508432dee1566

SHA512
12eba7cba7c277d90cbf15e22d20df7d10654e515c19ca1aef21c6fc46e490d52e56ac13ad4d5b4c152cb37c310c9f0ebf0ef65bd97fe535caf5fb8c57fc05a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8f6640eef188435_0

Filesize
5KB

MD5
33ab1e6f17b2b28d8cfc24ce3eaf8932

SHA1
c54b0513283a37d3cb25153ccebb768fa5d147b8

SHA256
8aa3b995ffbde69427df2ac2eba3b33aec62826651552c398dacbe5c171b1b1b

SHA512
2243b35204d09e228fa14f32cefa10d73d94754611df73b7c5cdd6685664534699fd102c398d7cad9c826b22167cb22c2b5a2ae461e79ed23de4fd44cdc1d0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edb3b6840a8ddc0a_0

Filesize
7KB

MD5
0dacb30d28cb42e564e574efadbbf81f

SHA1
d97e27a4564447711c1b7d34dbe1487866471f9b

SHA256
37307ba2872dd223484cf1d5575f1e3de4ada1116dac693e581be1334a1d80e0

SHA512
90284d8a99f407df105dacd4f998850e0b1153c20d56c9de9ef0ba41c04d9714829705c949d440f423d1d9bbad8f4bf9c3143918c902ae96aa9f95b5373e74f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f078f5fb70fd150f_0

Filesize
2KB

MD5
04b1c16c25cd67da73397670cc80b3eb

SHA1
89b269c8b4f74b2ec17033aaa70b115507be0e7f

SHA256
90412d57670f1fc41fc201485f8107e5b61e35bc3232e9432d5884415aa95058

SHA512
b8c911a0ade8236337a32a519c528a64ec0dbe4566e4b3397e0c173c5704df4c59c5fa2d610b87c4f3b67fdca129b2318ab76cdc59c99e13316b4266ffd33c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
76ea986de4d51c65c0a74b7a997fec23

SHA1
1ed37a9b29dc608f1df23f2fc75632cbddc3100b

SHA256
5339357be2a9181c41990ec4cac4f2d8ab8a168500844b9fea4063771ab219d9

SHA512
2462261f9a021a749debdce3ca23bbd5874ec05c02683a9214560a26049b4ed3213fba1d9e735e7cc366a02c0e8bf3b9063d23297959b6382726fcca970c782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f3c8193acced3e42_0

Filesize
77KB

MD5
e9e358f6e36b2ba0979be958a26b3982

SHA1
8ba66989f54aa063ad1a0e7889741f005751bfe6

SHA256
375955dd1008e6ba6bcc8855af7be67e68d568cac73002b0a12ee3b34e7e129e

SHA512
f3a37d0466820c6d889047eb4c52d2f222c264516e6cee5dfab27dab2df1d92c064645d5cac0cb73809f6b90203ae8227e3e31f10fa0cfc7cd9b1f7c859f5444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f89251fac2b69325_0

Filesize
3KB

MD5
eaa92a5087fed187bb8eaa2d691d94a5

SHA1
d979ac73cbfe97eb1b6e0e3ea387e162c24ce98d

SHA256
88af00bb9c126960e93f3775b617f11aff4680293b47ae0dc7d77cfe405eb9b9

SHA512
1af4b1fc2be650bdd7f91b51f841a7dee7925b88b099cb7d391422de8c9fe3c3a64061829a629ab47012307037ac357b926c7df0f093ff6c73170c4eb0b10bd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\feadcc6fa014c0d1_0

Filesize
1KB

MD5
98e1d1a3c68374da47905a61dab864f6

SHA1
f173cc4df2f7badeda48090c0eda74ea61258d83

SHA256
bd47ad683664449290c19ded472b71b97b35d0b076843d36404c29f35e1142b4

SHA512
801e2d2a4f4d579b5098cab05a3359fbe503778a6bb7c3022d604609a7b20305ffbfde25857ce523404e441c0bc542561a840173a147103fe2c467ec165c29c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fec8579dd1b49dc7_0

Filesize
68KB

MD5
3b9d2e557ba01eca5b52c7d9c2020b3a

SHA1
6f69ce1a82e132c6cb8cac266053bd5af7e9e1bb

SHA256
2507a266a3d0312445597d9f2d52814ff60f1171a89a3e3c7ea2174b12459940

SHA512
e5d3ac7b0f5f06ee175adc1a62c6a9794541ef7396058ee8c461cca4bd674d831df59049b2d48d8e9218644baafa16eb09b6aec5c176d9c75abb2f61d548aa38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
ac4c93021e9651d1f75252846bca18a1

SHA1
f9b0d7f25d6ec51cf40bc909d9f7cdca24ab1609

SHA256
1121fe30bf1f3a273e8bc89c3df2c6548a213c322ae4f7dc1468e906e8d6dc40

SHA512
b9c044c3404b324c3fb908300ca55b837066faef3ebe6df4593f43c412249e5b0396dbeed51f565e6e3b1cea37588b40991b71ef24899f08d015f9c1c02c63c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
0d7dac537ba8e6546f4291ed9148853e

SHA1
dedbd8e1519dd3a960507a38e59d07613f8b59ff

SHA256
fce73b443c7e35be54c31b9e9defbd2b5a60b5b75774b28352dc7b6a04a7eebd

SHA512
1fb66b5a039a210f04ca3003fef3105108d5b5dea5e92366bee3f86f0fa758ff58fd09415140f715c1129885ec73165a1a49ed1570343a35f74e7b9661936d29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
8e5533a4b60e30a2b6ee1ceb527ffcf8

SHA1
b35cd03a3aadfd3ebc41601cea7ac4d76fff121a

SHA256
7bb776cc6ecf3aeb3b0d24bf3c1857998a57c82bd24564b229be370bf47cfb44

SHA512
2d9f8a2971d342611bb80e08537c068fe7a17ba5a27cff43115c6f3cdd2a5986ed067e31f3dd7687731b742af38a3b1496c1e4c0f458af46c003c6888333c410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
7c60a46e38bffc357f75917d2a3b62de

SHA1
838d4c53b6053e8bee06d5098da4beaa64474c0f

SHA256
1c91d708088c5645cc654ce3565826d8542b5297434501a5bcfbd0f61c512f23

SHA512
1d65818ea8545e3af7ddb09265105183f08c7eca509299f1786590abf6d6365193b7b3ce982b18a73f70300a38d6e2d4ab14574d061828b4947e85dddf17c78b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
895a2937a5ea658fa66114b2e62d3df1

SHA1
9bbe9206d20689ac375e804d557ad61071a80299

SHA256
4815f4f184a869ec22e6d4e115934c204a42b764f66604d060aa36510ebaa04e

SHA512
0e43994f4c0b53eae6f1978e293a7d900c3f7b077561819ad2de9eaeafcd19e0e9d6ae5d553d3e6a6e875681f7a751ca12d62a8ca84d81f256b45d17a8881987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
65adcb19446c1026ab2563e498d01dd6

SHA1
bbd7879c4678c91039666d4dd72bf6d1a5ea9236

SHA256
e5e20d64d418d01a5a9040f935f100378fff157ab43068aa0c8207c4927cb861

SHA512
429a7affd5e4b374e8dcaf140e3612d0de1bfbfe6e246c5be94b6c434f4ffa13218f648cf43d8779a4569acb18af9e9526731401506e84d684172813633a68f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f5117d8338b33397042e16ae1a6fedd2

SHA1
688a936b74eb7c0c487c67d3b67c39b5ba369da8

SHA256
30df1a877604b69af02ac0c4e24be3144071adbe8bc5365039f5625ad017c321

SHA512
cabefccaa043fa9b675a8628eac428a497a3391ba8b4f0c6666415952fa4d49f52f554b5e64cb9ea7970ca1039b69f4c3919a61f9dcceb89477337900ba1ee5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
09b0c60364319a5865695d85c3c05dbe

SHA1
40621ac9940e94d9d20791d27ed789aa6100f31a

SHA256
517d4430d770cc1dc5f2e8d58ec3a1e847176d4b4a13f1c37b33ec56f4309da9

SHA512
e2f8a17c36d2f416df46fc0c616a9b0546a1f49daa9ec6c0831dd51c6de389bc62aa99d159972c1863b3d94431215e5a6c80b5ca9a7cb1e4d2f5f69600a80337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e1fe4e7983d185303d28499549ac94e5

SHA1
1094f1e4d3f75044018764e6d251a5c4ad27e1c2

SHA256
e60274027b6875f761f89dcbfebf28f6cda78d1ad5181fca7be8588be9e8e93f

SHA512
0e00aa631068434346f6fc0052abbe84e62d6bc6adf9a8f54b43346e2915f1a3e9cb86a9ba7098b719a737b8717d8d10f8c65d4ac575112c13ca38797a7a8abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ade4254c7489ef5afbb229cb8b45725e

SHA1
2a9973264830cdd18fd2918598e78cbc31ee565c

SHA256
974a8a1744a6157a0d8000609bfcc4a59845a3fadb7c8d327dbbd6502501bf6b

SHA512
0447255a1caa51283e3da891b0322a52820499aa5ec124224beb1fc80e7eceb6c6f630e580aa23eddec3491ce6b72241b303e86f7ea68d09a5c7d0adeee31792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3c9a76ff829e804d81b466c4d569e3b1

SHA1
057c7aa2045752b92ab9dcc64a8bd2bec309084a

SHA256
b85be6d5eb478d2369d6c0901d9fdf3aa08693e1757be1aa1316d0c2cf6be163

SHA512
cf1326514a67558c61c8e781285c4f47148c8a61cc7d1bd0f356e0459e8bb35ba7a59ff66d892f629ad744a12a3895fffa17d9dbd969ccf7934f882a0dcca236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9ce9d44963078c0bea0fadf4822cd8eb

SHA1
366df2ca004be0c6cfc8ab40f316c99971bf58b4

SHA256
b217bd285b9ee22bec4395d062ec726fddb4d7a8cd4c70f463995c8d84a26bde

SHA512
e9813d7b174b2adf5e170d99c860d2d4387649cfdfaad0bee16c4ebb4d2529b835976e4b0a2fcb8566909e900795dc0a6411513be6cac26b2814ce1cb8857942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
217b31698abb98dd95366d637a8e6ed1

SHA1
08186d228190818df13256b90d9e3d56a7f00772

SHA256
ce230a924bec043ad3c0918fbe5820b54f855fe8487fadfdfdccb133af94e8b6

SHA512
f716dac0db0dffc5e655c1c3eef61868628537986c86df87faf9be558dc1924d70cd9110f28f169d025875e334302d5c32ffa11b0e4270630965e1f023ba8dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
07d13929784024301049be8b1b4c25c5

SHA1
10494bbdabf8d842409c6277b3eb8c3970ce8f62

SHA256
83a0ef3b869d74c68cfc528446a9b20de54ab1eff42b5cc460c9e929f497b728

SHA512
c08bc337f13939bd2316b279fdd8703d6a6eb5c0d3e3904197e2eee2f435fa774b9327e622e603a8cf2e5b127316fc1eacc0390261f5a5fd9f4557ebcfc6e520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ac5b70f1cb9104daf6348cffce5c365

SHA1
bf731d77bc9818da22e86930c03dbcbacc132bf3

SHA256
27544d4a6b4a12106639e1e6712e69487c45f85b1d092d6ed115e58f382dd3bb

SHA512
e1b685a2848eb3d32284c9826bc89f234b79e3fd4af677a2536a3f7c7c54e23c41d80510d30b7e34e5ba6dfc59ac403c2a33978cda29b31d006990812ba16206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8910e1439a4ca9ab0f9fbdf653f2da63

SHA1
912873613aaa7c91fb30e7ed829fb1c77a0e4ef0

SHA256
17d8b0f8937708eef78af5f9834b60aa0601eb75d7f12914a6118383b8c0f153

SHA512
396b98f5e2c622d397dce9855fda62c5eedb03329ee262782932f6a1a4d5d3b8bcb710782b7eab78ae72f8bc662178d4c78be77a757bbd55a2bbd6cf4b7a3078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7250c5ca6696c8e24a1fd60ec61b3706

SHA1
deda4be145bd0a1e0528cb4321d3dff34026ef89

SHA256
aadd5e907f5b6a421fe96f37c9a7d2ba8f031bf280fec263af76792a9f7bf028

SHA512
fb9f53c950a2d02c7d06d351f6caa94c6a2de59314eaa49aa6a512ad6938a336814b70fd62bd19bd94765ee38b08ee6f64ee866f612372a66e10bfef133641c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1df08625bd212de0f55b07584a665754

SHA1
a62b45480b648c4744a3d712f684fee09a6633f5

SHA256
b01c7b80bf21642eb998ad90142da2e67a35941d7639404a8b839e659e309bc7

SHA512
611673d2b9a69f21120db3dbb24ecc421add5ed75b4f93a05a1f7e3cd4688319fb3af5513fec9062057cbefa4b3e90b2b5c6903413f9030c188fe1103d0d3b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c248178afd93c3145938ebc9794d8bc

SHA1
cf934441b64376da88fb98aaaf8e90cbfa540a29

SHA256
4ff1139d9715461a9c32920d586bdc9b05a0cc0278a9a1e1bbd0d69f6e21dbf7

SHA512
6b206e7f3a5f72f7afea66d3716c78754dda7617f4e3c83ce3cf6e08c57ede8033ec4abf296ffd1799e6f0d6e213527be7ac97b840d5fb63efee8db263bc9a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5bccace9686bfccb2f1afe4e9f3d511a

SHA1
c80d6ada7135b02c294afe0dcbc8019fcbfa8078

SHA256
ea930e62c02957c2a32a851f1485d072331048b06b7732b07a7d9fa57958d363

SHA512
e4c190a106317a79d7199abf03347ee93629d7e154af6eefdbfaed717f11386816915f48c2f883075c34f452034724487e5019511231a2973e0ec78528467c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72d18be437af54bd7cfb7bb73c95815a

SHA1
d7d1980f2d75f08af347537d0fb664a83517bc2b

SHA256
ad369c14d9fbe75c88a4bd11cd68faf34edbf33745305204f0382f7433e429c4

SHA512
edf360ed05aea2d07fa0c6b04c3ed218d7ccd414df5833581a9cb4f755e9497375cc97d1414948c147b37bad097e85af006a90583e3b769fb9919dcbb2d92c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5635401f8eac61c2438274f139241a6b

SHA1
1ec8b69c10b81454ecfb78ceedb9a5c3fb0933c4

SHA256
66cd125479d8d2c6ed77c1cf579a84cb932ff8cda683e7d311003eda85a19166

SHA512
414319c5da23756e037f4baf588eda3eb65d45bcbd14d939d25e420bdee75aea507e684d63e630ffec7d30f24d13f52bc636d48268a5d054848e8f2d6eb6723d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8d91d7b3020c9ba44508da906c8c53bb

SHA1
f769a4f84b699f7dd821b13e3d8bd5d4133a4791

SHA256
8299f2ead5415e254c22b097597df35e9a2d3d191b9859f62cf2d2e6e0a9c0ed

SHA512
20d79248e011e8d19c38fe155052e789a9d1e29e1b0cdb31e478ad08172148ea278b1085866a8ba52134611f922b7dbc2024871de993417e4d0fead6dcbb7f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d6e81c40a065a6e624f354deec207e97

SHA1
0c21c673ab17fee56f2bca318e88477c98c268fe

SHA256
505e3864276c484b4291e9785c1ccca516d205f500ad0d668bd6d276d76567cb

SHA512
80abc33d74f87937b4e802b770266826b349e60e873abd673e6f2d4ab6f4e67ed638eabb91e76d895f3a0e9a4b50a6d396c13d6c5aaecfa3021a4bdac85e4958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
df98af10f9857e6ec8803e5133c5b40a

SHA1
9f53e8cd42c2539932204e51d8af9707eb21afee

SHA256
a53da4e28a9900d56793407dead8a1b8d20c92f9f4dea3c2a54bf44a812fb5b0

SHA512
aa2b92eec1d01ffbba3794c47c875c93220e78f2e71efaa8a1230cc57ccd36fc86fe2ba55de09d26055ba7a0356367864fe7c0aabc2aae5576de0a9f093831b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e06a2dc0b2e682e0714969979012274d

SHA1
2ebc905942a1d834732b3f958d305c94b76f447b

SHA256
13d6b3b9088b61907d9fe686fd41537d52122e2a3ba353135f4be38316ae1abe

SHA512
3ccde0933548a411f527a7a34b71b20d7b6e9aee70bb737fe7756c381b3faaf6e3e72b69834482e5a976b8f98f274799e8a8c32d20af49635de34a9cb6894770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
83d9b4d70cca25d7d745f82e777f3b78

SHA1
397618c72cde02aa54f4be3b71546f415688a733

SHA256
35494b9b0ecac53804cd574dc3d00c17b0bffe33019f7258a60d5c9b01438a93

SHA512
d9f7a679a94e86ac20954444f633b07312a53b8145baac7952f854d5aba67e32156995a58e5a0d9e898a32d5147921c283d5de7f0baf9775653b0a36019af51c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d86a8620b46042801d8196f3ab76ad49

SHA1
fb9564c3d62c98e754f189b07ab9d74a5bc16a84

SHA256
95e25c704915262bcdda800258d1b7c5a3c520b5cb20a6858ed843c10904c9e0

SHA512
16898763880657cf003f6dcc61a6bfacc43d9ea19b8d20a870dd319accd03c7ff5d2d9154fe7e310c575398c8116308dbeb0c626f3fa65e4d1c42d83a7877de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f97cdbb5752886fab519c569c258e3e0

SHA1
041430e1f6a032f062aa30e502ebcec699ac4546

SHA256
0f64e119de830cc6639546208ab1d7c500f5d50cf44e27d3b2a924b65c3b0b62

SHA512
85605b1c664e2f37a143d95bb876567ebe70a6bafe45e2f44aade9bbce06ba815e71231fec7c47fc02a632bbb53925fc00a82c1546a1f3fbeb5a10bad8412c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
91801eaaab69c2b5495d98a956e4cb02

SHA1
01c2e09f0f50695fb29389b577ec084fb4a7c2ab

SHA256
4d178441cebc88effd318d539340909b7fbec5b13970a3a59b549a887b5a63d4

SHA512
d4f9f7bd307dbfd516fa2a0694980c2480449878b25a1e2d96e52565a2180cc5ebb208fdecb3566240441b5bcf84feeb968a8b8caa8057f7d846b9ec1be2872d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4a7cd6aa5e1db81ff323fd078dd4ae6a

SHA1
eac737244e66a59882e6c71cefb9aeac12f33a52

SHA256
d2414e8c182be162d3be38d9df248ab75f5233d166006f0c6a9fa2803a264c3d

SHA512
2c239fb65e2cd4e3536eff8c9face8862301bc3278bfbdb2357c3779f68280664bd0a80d123e6ab98eb89f6ae316cd6ce4f3c865ecc580df6ac3f910e70b1a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ebb5573c8df0202c4eb681e9573a980d

SHA1
03d05dde5f31d3c9c32a1cd814fab8ed41ba64e8

SHA256
76008cab13eb20ff1effc26dc1c0302025f45cb41bf98125fa46fc893c1c1c74

SHA512
6b9975a6d028ae9a4d1fc075ed25fa1f5d7b6de7fb1f3cd3b1f900a0be89507b2e153ecf426971ba2100efbef61e161dd75b58828816fedd692c9cae0af71046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8722f5383e9ac9d2e7ad21420b07b9bf

SHA1
28237fa5511362a43c8893682e6847f876840aa5

SHA256
38c21a1b83a9111042fb0ade448b1c647fa47ba8780d475da7755be91a1da463

SHA512
e0d05c2bae9ddcc041c92c63bf514bc50adb0fed09b0aa1ff48b266b9184af00bcb6068cebdd7365587000408e781da72ff07d28dae05019362dc5b26692120d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
38db4a238a6b05c16d0a06265688a7e6

SHA1
bb761ccf81cef5b2dd24a9d0e91ad1db172667af

SHA256
95ce3e1ef881a89aac9ca0e28686ec7fb2f75a8f5e2ffd02fcac350006936a0e

SHA512
1e8f0e53c4641938919496da90948acb62f9e3be3da221dea7c8e07ccab19c4d2b42ba1190a7846c0a65778d6044cd76d1bf4e09a34e2e90f046f2fc16306b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b9724ed709115de97c1cccdbee7ead37

SHA1
23dea8aec57268c478135a440be489b9b0c01cb8

SHA256
086fb44acb61802303be0649d4c44b6232694216fdb3e3e07d4d58d3c3f6e5f8

SHA512
7ec87592c982dca72a0e327c161da8f69cda911de579e8ccc20aa6f7a4a9b07711f0e31afc1108dc298281c94ad560cf9e59cd3d02222899dde051d7bf707963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580ba3.TMP

Filesize
1KB

MD5
eeb8a78be25c78ef1184ab25b0cf402d

SHA1
5b951e68c3d562d63c000ca99f094b0616821214

SHA256
84188d50c545ca233e330de85074c6ec667fb2acee0fdfbc2749d7a5fcebe01d

SHA512
5ff4e6cd1f8ea7c1f756de053b9dc51c20b8e3798997992a812ec660596272849bd1e412f32aeec709a9853ebcbb35a6f8e6c468a9c99a009f62c62ade5dc1fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
df47832ba8e8481b3bc53a39ec619033

SHA1
6f8029bbb9e1954234a1fdf9b2ae7c9024c89d6f

SHA256
c7552fa48447ef5b2ded0194d8d3fdf47001040509a58acfc7a571217bda0933

SHA512
272ecc46abfc9bac80b80e400daac6e48f018bcac2aba8d3179e9404398aafb4bf5eb1e57bc3666fa6d4975b9775e4e51939819767178f4cc78c7a6c49bade09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed68ac1e9bf4378b36b549394b789c77

SHA1
9de103b604f5281e9ba868e718f1a913437746b1

SHA256
4f86c795e236ba86a5b6300b197d2aee320a49c665fb70cc655d503948ca5245

SHA512
ba949c4542dcdbbb14bc35a014346c697bae4da23b0ad335e9d76299e18e550cdd644afaab4af5b531618ab6332f6a91f509a1c2d6f642bf17a5c0c7d09e74ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
15b7d6453b371079a34bce81a44a81d5

SHA1
586f9c72574423848eae42e45c068e3e680bbdc6

SHA256
c56db5dd225134e11d252369e6bad709a1369635d51da034c4c40bed2d4009c3

SHA512
a2608de58755eb958ed3f567269f996ca30fb3b2fa1ca598433866c7ff9386c7e232e8e38adff1e2ad50c1a6e60fef2edc12bea35c4ef37c212306e5504e13bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
c052cb4638b0c1f059b8b02ce76a1435

SHA1
3cf1af1847252631680a8cda06e056ba446839f4

SHA256
437202b96902accb9691cae98a9125eaeb801022788fae58da77b3e7c76b4df3

SHA512
2ba9bc0538fcffcae395d76a9bcf2f9d403164e135292e7f55438002d1947897173d8fd661f16205a19e22886873fd8ebf6b51dbef4dab4064d054060b731c37

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
350ee66b0b4225f2986eaa3c249ae8a9

SHA1
1198686019a94aefb1f023f7f4dfb2377411566b

SHA256
dfb1715c3b5b71fb6d34b23e38fac5d08ab41a7ff6183e4c62d5c9ac4965a4dd

SHA512
decb4c45a8fbdb898e521c93242c983c1217f1531e7f33d1a057624981474cf8e5890a08fc8fcfd98a33591da1dedbe9f930621881696480e29bbed9197c9142

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
b357de7f385b366b4bb1b2466e185861

SHA1
4583126a6fbd5204383c542f280010aa4a46e791

SHA256
b31f8e08a7c9d2a93de5a7566b79b24c1190ccf46cc10823358ec0c7d4f5b9f3

SHA512
ead88c6b39648b4d72c9fccf7b5db95003312eadbe78849d5a4050cc69613955774eb9dfadd9f476043d41f41060b82d46810fe73f862f8f50bb35978ee20cf3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
bbf76d764f74e27f250d01033722fba1

SHA1
60ad9dce598e601452a74f7a22a4283b40304d56

SHA256
444ab06782ff58b60312c129927f999b90180da20993ced1d227a0192f07915f

SHA512
81d1e513847bb8f3e2015c9c10ade00ce9bd97bce0276ff13eeb0520ef152681cf38acbdc000f4b777e675afd7c0b74e027dbfa215d56cb132947476aa3e76f1

Download Submit
C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll

Filesize
2.4MB

MD5
7e76f7a5c55a5bc5f5e2d7a9e886782b

SHA1
fc500153dba682e53776bef53123086f00c0e041

SHA256
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3

SHA512
0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24

Download Submit
C:\Windows\SysWOW64\ntkrnlpa.exe

Filesize
373KB

MD5
30cdab5cf1d607ee7b34f44ab38e9190

SHA1
d4823f90d14eba0801653e8c970f47d54f655d36

SHA256
1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

SHA512
b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

Download Submit
memory/456-2236-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/1120-2259-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1120-2261-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2872-2239-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/2872-2240-0x0000000000400000-0x000000000066B000-memory.dmp

Filesize
2.4MB

Download
memory/4928-2238-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download