3b14f10b8cd5c55d405785829bf2e8e4917fe1ac432ec0a376b2b4621314686c

Resubmissions

14/08/2024, 15:44

240814-s6jgyazgqb 10

14/08/2024, 15:10

240814-sj92datfkm 10

Analysis

max time kernel
1800s
max time network
1746s
platform
windows10-2004_x64
resource
win10v2004-20240802-it
resource tags

arch:x64arch:x86image:win10v2004-20240802-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
14/08/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

idapro.exe
Size

327KB
MD5

0ed74836af595a75d959e703e98f3735
SHA1

f48fe1347528b1bcc210a90c60e93300ddfb1c31
SHA256

3b14f10b8cd5c55d405785829bf2e8e4917fe1ac432ec0a376b2b4621314686c
SHA512

dd5bb6e6c2674b8b2de6b22c0f7cc051303592d0fd50e14c8452988646760c907c9650e5b7ab594027e01faa9216f2b865b5ab015f34d92e62d51373f8152fbe
SSDEEP

6144:UsLqdufVUNDa+anxutqrmxBpwrWlTKh4Qffn2n:PFUNDa+axuS+waZ84

Score

10^/10

aspackv2 discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Downloads MZ/PE file

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000002354f-650.dat	aspack_v212_v242
behavioral2/files/0x000a0000000235b9-1977.dat	aspack_v212_v242

Executes dropped EXE 35 IoCs

pid	Process
4500	idapro.exe
3984	icsys.icn.exe
4220	explorer.exe
1500	spoolsv.exe
1360	svchost.exe
4680	spoolsv.exe
2832	Launcher.exe
6092	launcher.exe
1712	icsys.icn.exe
5540	explorer.exe
5092	Launcher.exe
5960	launcher.exe
3592	icsys.icn.exe
4960	explorer.exe
5300	RegisterDeny.exe
224	icsys.icn.exe
1692	explorer.exe
5336	WindowsUpdate.exe
5860	windowsupdate.exe
2688	icsys.icn.exe
3344	explorer.exe
1452	WindowsUpdate.exe
3312	windowsupdate.exe
5720	icsys.icn.exe
5804	explorer.exe
5848	spoolsv.exe
1100	explorer.exe
1508	spoolsv.exe
1600	spoolsv.exe
1520	explorer.exe
2936	spoolsv.exe
2920	Popup.exe
2940	popup.exe
4080	icsys.icn.exe
4480	explorer.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
129	raw.githubusercontent.com
130	raw.githubusercontent.com
222	raw.githubusercontent.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	idapro.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Popup.exe
File opened for modification	C:\Windows\Resources\Themes\tjcm.cmn	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Launcher.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	WindowsUpdate.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	RegisterDeny.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	WindowsUpdate.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn	svchost.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Launcher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegisterDeny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idapro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}	popup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{E0497F73-FC85-48C8-B490-B7F7B0D49C38}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Pictures"	popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	popup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{885C96EE-1CD4-41BD-B9F2-3A9B18B9592D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000007393172d7e4da01cd67990162eeda01cd67990162eeda0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	popup.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	popup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{E2E087EC-0B35-4AB7-BC12-DAA27CB34FBA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Non confermato 636201.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Non confermato 91674.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Non confermato 775893.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3852	idapro.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
3984	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4220	explorer.exe
1360	svchost.exe
1520	explorer.exe
2940	popup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeDebugPrivilege	3600	taskmgr.exe
Token: SeSystemProfilePrivilege	3600	taskmgr.exe
Token: SeCreateGlobalPrivilege	3600	taskmgr.exe
Token: 33	3600	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3600	taskmgr.exe
Token: 33	2252	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2252	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
5860	windowsupdate.exe
5860	windowsupdate.exe
5860	windowsupdate.exe
3312	windowsupdate.exe
3312	windowsupdate.exe
3312	windowsupdate.exe
5652	msedge.exe
5652	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3852	idapro.exe
3852	idapro.exe
3984	icsys.icn.exe
3984	icsys.icn.exe
4220	explorer.exe
4220	explorer.exe
1500	spoolsv.exe
1500	spoolsv.exe
1360	svchost.exe
1360	svchost.exe
4680	spoolsv.exe
4680	spoolsv.exe
2832	Launcher.exe
2832	Launcher.exe
2832	Launcher.exe
6092	launcher.exe
1712	icsys.icn.exe
1712	icsys.icn.exe
1712	icsys.icn.exe
5540	explorer.exe
5540	explorer.exe
5540	explorer.exe
5092	Launcher.exe
5092	Launcher.exe
5092	Launcher.exe
5960	launcher.exe
3592	icsys.icn.exe
3592	icsys.icn.exe
3592	icsys.icn.exe
4960	explorer.exe
4960	explorer.exe
4960	explorer.exe
5300	RegisterDeny.exe
5300	RegisterDeny.exe
5300	RegisterDeny.exe
224	icsys.icn.exe
224	icsys.icn.exe
224	icsys.icn.exe
1692	explorer.exe
1692	explorer.exe
1692	explorer.exe
5336	WindowsUpdate.exe
5336	WindowsUpdate.exe
5336	WindowsUpdate.exe
5860	windowsupdate.exe
2688	icsys.icn.exe
2688	icsys.icn.exe
2688	icsys.icn.exe
3344	explorer.exe
3344	explorer.exe
3344	explorer.exe
1452	WindowsUpdate.exe
1452	WindowsUpdate.exe
1452	WindowsUpdate.exe
3312	windowsupdate.exe
5720	icsys.icn.exe
5720	icsys.icn.exe
5720	icsys.icn.exe
5804	explorer.exe
5804	explorer.exe
5804	explorer.exe
5848	spoolsv.exe
5848	spoolsv.exe
1100	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4500	3852	idapro.exe	84
PID 3852 wrote to memory of 4500	3852	idapro.exe	84
PID 3852 wrote to memory of 3984	3852	idapro.exe	85
PID 3852 wrote to memory of 3984	3852	idapro.exe	85
PID 3852 wrote to memory of 3984	3852	idapro.exe	85
PID 3984 wrote to memory of 4220	3984	icsys.icn.exe	87
PID 3984 wrote to memory of 4220	3984	icsys.icn.exe	87
PID 3984 wrote to memory of 4220	3984	icsys.icn.exe	87
PID 4220 wrote to memory of 1500	4220	explorer.exe	88
PID 4220 wrote to memory of 1500	4220	explorer.exe	88
PID 4220 wrote to memory of 1500	4220	explorer.exe	88
PID 1500 wrote to memory of 1360	1500	spoolsv.exe	89
PID 1500 wrote to memory of 1360	1500	spoolsv.exe	89
PID 1500 wrote to memory of 1360	1500	spoolsv.exe	89
PID 1360 wrote to memory of 4680	1360	svchost.exe	91
PID 1360 wrote to memory of 4680	1360	svchost.exe	91
PID 1360 wrote to memory of 4680	1360	svchost.exe	91
PID 1580 wrote to memory of 3100	1580	chrome.exe	104
PID 1580 wrote to memory of 3100	1580	chrome.exe	104
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 1656	1580	chrome.exe	105
PID 1580 wrote to memory of 2116	1580	chrome.exe	106
PID 1580 wrote to memory of 2116	1580	chrome.exe	106
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107
PID 1580 wrote to memory of 4276	1580	chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\idapro.exe
"C:\Users\Admin\AppData\Local\Temp\idapro.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852
- \??\c:\users\admin\appdata\local\temp\idapro.exe
  c:\users\admin\appdata\local\temp\idapro.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3984
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1500
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1360
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4680
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5848
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1100
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1508
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        7⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:1520
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd75e3cc40,0x7ffd75e3cc4c,0x7ffd75e3cc58
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,2374451366892390936,3242515037018385598,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2096,i,2374451366892390936,3242515037018385598,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,2374451366892390936,3242515037018385598,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,2374451366892390936,3242515037018385598,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3376,i,2374451366892390936,3242515037018385598,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4592,i,2374451366892390936,3242515037018385598,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4068,i,2374451366892390936,3242515037018385598,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1236

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd750346f8,0x7ffd75034708,0x7ffd75034718
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=audio --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=video_capture --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=collections --mojo-platform-channel-handle=3184 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6192 /prefetch:2
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,9006033219638741852,12676412489754191427,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5884

C:\Users\Admin\Desktop\Launcher.exe
"C:\Users\Admin\Desktop\Launcher.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2832
- \??\c:\users\admin\desktop\launcher.exe
  c:\users\admin\desktop\launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6092
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1712
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5540

C:\Users\Admin\Desktop\Launcher.exe
"C:\Users\Admin\Desktop\Launcher.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5092
- \??\c:\users\admin\desktop\launcher.exe
  c:\users\admin\desktop\launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5960
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3592
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4960

C:\Users\Admin\Downloads\RegisterDeny.exe
"C:\Users\Admin\Downloads\RegisterDeny.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5300
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:224
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1692

C:\Users\Admin\Desktop\WindowsUpdate.exe
"C:\Users\Admin\Desktop\WindowsUpdate.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5336
- \??\c:\users\admin\desktop\windowsupdate.exe
  c:\users\admin\desktop\windowsupdate.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5860
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2688
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3344

C:\Users\Admin\Desktop\WindowsUpdate.exe
"C:\Users\Admin\Desktop\WindowsUpdate.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1452
- \??\c:\users\admin\desktop\windowsupdate.exe
  c:\users\admin\desktop\windowsupdate.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3312
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5720
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd750346f8,0x7ffd75034708,0x7ffd75034718
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --service-sandbox-type=audio --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --service-sandbox-type=video_capture --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1294917256286372225,5114283381583818567,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:6052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5552

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd750346f8,0x7ffd75034708,0x7ffd75034718
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=audio --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=video_capture --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=collections --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,6128082272452174602,16609866787661659513,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

C:\Users\Admin\Desktop\Popup.exe
"C:\Users\Admin\Desktop\Popup.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2920
- \??\c:\users\admin\desktop\popup.exe
  c:\users\admin\desktop\popup.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.rjlsoftware.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd750346f8,0x7ffd75034708,0x7ffd75034718
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,9118305578210655923,6300088481356277846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,9118305578210655923,6300088481356277846,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,9118305578210655923,6300088481356277846,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9118305578210655923,6300088481356277846,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9118305578210655923,6300088481356277846,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,9118305578210655923,6300088481356277846,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:5688
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4080
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd750346f8,0x7ffd75034708,0x7ffd75034718
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=audio --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=video_capture --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=collections --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13962655194454338199,5442414295692683853,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffd750346f8,0x7ffd75034708,0x7ffd75034718
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --service-sandbox-type=audio --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --service-sandbox-type=video_capture --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --service-sandbox-type=service --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2871614838893596501,12933493464881044144,131072 --disable-gpu-compositing --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c46e84639875652d67251d2f9b0b448c

SHA1
4488417ea3f0b5dfd5f75423fdafb1465c39fc25

SHA256
3786518c1a4f22efb2692427011b8f3f1918f2529b8b0c4e432e0255fc5928ab

SHA512
954a942833de642490f97e2dd0e22f45b4fda7b99522d6f5a04c84239e8997f937aedf83f3a85a526ec9b0515be89b37da18734cde1871e90bfdf973b503786d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
80ad1de3c3a29e4afa10ad81c2987f3d

SHA1
8937c2b56d709a90a166b33146a571df33354ef5

SHA256
5dadde0a050c823de0f1a235f9714707d56ff0893af0bfe20297e79b94175a37

SHA512
dc916e3ff7779f1cf0d9d34d83c437686b19e145472c5ad07cebd9f149b8a25bf90e1e2965ffb2e4274344e5293b1af4ba6e0894e87f2338b6a9b3d13e081715

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
78fdb63c1ebe4e076a287c9fc0c7c876

SHA1
15163503992705809a8a9f6cf6a85b5ce96b43d1

SHA256
190b170077f46e800240fe4140d72f5d27099bb4a91cedb3e9242378f8ecb0f4

SHA512
95f41e02dceda1cc560717e1c59f10a3c52871aac8cd6303fce9d6711a82329a111a878e271b046da6cf8103c3153c1116d8ac9a57773d667fbd2137358fab4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e6b08134029c86e46f7511f971fd6fc6

SHA1
1123419b3c9368ad29a2137cd3056a567445f0e2

SHA256
384c9710adf0a455f101050797b05d68c9d4c5b6cb9136e5e4184c0d25e5c71f

SHA512
8d00314adaffde25600b75d0b4ca46b4cd9edfc02c1ce9b142b7fb5114a95768f38ae3656fffcff203a5dc6cea86fb5c5cd8c06bae16729b5f4857ce0ce24770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2fa38702a06f2c277f47288703904b65

SHA1
c2c1f3feae4aaade85f1c712aa652e34af74c97a

SHA256
cbe73e1d91243a07cf5790e4134ac6249a9fa69790c86e42b4f854136f54b362

SHA512
3e6b083d935c63f332c44ebb7a86aaf0cf87f78b166404a54350c3b53f79efe75f192c73ec1818fb8c577323b71e9c3b328c142924a93ba33701dcf85505f83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa56a4c230ba9c41b8aed6ce11889c2c

SHA1
37752b28407a087a5a753f730b6b9f8ff2033906

SHA256
290ed6ef66b3125d3a62c878cc657a593ec4eb9ff785658e3c2c22de7e39cc3a

SHA512
2c680d18da115e512a45c864a735ab58ed9dc55c5185765030c86bd5e9b9dace55eced24f7386c21584867d42de67fdb2d0927def31ee397a58e244eb87f3575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111424a9de05969fb3f1f54981b482c3

SHA1
75e2a5245666f6d5b7153280fad8b2b3b794f1b3

SHA256
4041fd1af2d538506d6744aa579d1d0cdc9df14f41dab608829cb75e36f84196

SHA512
26f1fb4a0558ef189010b02f72baed918434655f1110304d29e0153e82828e21df252fd09a5c84f974c2b5489fdf205e1bc06528ac3cd9191af51807ab4a60ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
092e4dccdc60f621fb4491c1add0e07d

SHA1
c8bf873d8f984c8c0ed847ab8f86604839c96228

SHA256
b9578cd4c97348d2abda1ef9eab5c14830044cff792ab5282c3057334c5bfcaf

SHA512
893b44d94d3017d753feac6ce8842677605336c201150bfd94342a3ea63b0f6d5a0d2d96c2dabe7011c198661253a2a8324f8b8022374dec439c107c9ba48444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e071c61-9756-4fdd-a0c1-63f5a272ae3c.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
24KB

MD5
8cd3c6d8cf9e5a9655bf5624dd0bcdad

SHA1
09c3fa22560c7f4559a343847fcf2b629e35513b

SHA256
bda6f5004cf18a54fd3e447b0fc82565303616c8b1d7e0094a96af72691a0b3e

SHA512
925e3849c68315ecbfe3d7b0fe6b4320dfadc0defd2e56063216b36fdfa0930b40be2d948233037b0c672c5708dd612fa7a3b8189e276d2f8faaccc4d9586d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
18KB

MD5
03a9b25a0ed28884fb8e5cd87a04d9aa

SHA1
3d400abd9303772073518b5338c5c352890fcc6e

SHA256
346e0d6052ca6c0466e92a9dcb771c0e5a48b706b9293029fe51af7ffc974d8c

SHA512
e86ac57a80f842aaf4ed3e9ec33f4d75ca4c95a0716c9a1b302bb1612297e893b993dd7850de8d5782e80086fe6d55672ac2fe8385c806892b164f37fdf9f31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000082

Filesize
730KB

MD5
b0ca1da1357c022aad84ee4628da18c9

SHA1
1190cc039b2cb32845ef921bfa23044256773cf2

SHA256
cd3e5ec005f09d1471110ea5c98fb95b95c3ab1dc4a69bae6c6d074a7375971e

SHA512
a00052ec3a093308c4bc028a92af3a27bf2e155af2590a4019e53fa1c36fdb61979b6e14fa5650aaf65d0e36131ab03987b0a3e7fef50c184094fcc901ba8863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
bbfee1485554a9d249fc5ccd968129e6

SHA1
af9bd0e5044c2acd3865f3fbee965d60a56e6e3b

SHA256
045a8d56e4a03dbb4ca6fd1671c3ec2b9ded2da530a846a90141304d5ffa768a

SHA512
64b63fec5cc7076934729463d07de304c137da3b346b24618c67329bfc27d1b56d278764d48e5612e5e97e48b840dc6834ad44ff3c7899f60ef4f282c3c31308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
6f15eaa5bd4257f88499200a861cec91

SHA1
b7fc48fddf6db955314042c83e0fdf0d2126affb

SHA256
c87626a00bff1d94a280c6b583f894234b33150684b5014c067f0509fea13579

SHA512
1d6711e1e2bc44365ca98ee4e0fd9b7e776b10ea4e4b2ad5f3739d4f2d63cf3b442ce37d34df6e5dbe3e0a6d5330d19b08df5bd18041a781ef5fa7b76be5968e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ddc626c8f8abe57fbcec1c6cac343e58

SHA1
048da56c99b93450402352def31ce77b8e69ed7d

SHA256
7b161aff4a94809aee3e298a86aebcd1a3d067602a60fe49f3cc0a86029ed1ae

SHA512
9dfc067b4da67cf9bf6ff93f4ddbc8012448ea0663d4241c7fd4e248368df5d7f91404157911f60d961b85ee437d4e6d82851d042c14a9a68c8c1f6fd98d2ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
895802488b281b8f65e1fe2b105fe745

SHA1
8233cd17e5e20e495761cb81c987637a398b699e

SHA256
42661507db4e53ecbcd9b216ec1765e154d0210869ec5eb7dcd1df7adf3b62c9

SHA512
fa703e4b93edf2aca34a957fb62d4a37262235670747aaf09f0389b547ed3b98e67dcffc5d4a59f8cad5d5b93226a2c45996d48ff1f451d599fa907ea1d3566a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7eb28b31d5ecbbb9a62bba941b108447

SHA1
2e9fea72d0565a61e097e99da68111371793aa1d

SHA256
cbc673caae0f896e09c5dfd0f88b44a6707876da3611fb04c393ca2df52bf977

SHA512
90dc74c49ae8aa4f453ce1771c119e14d792a882523a9fc5a55e15e55444a79048aeabfa642578dd6e68d4edc13eaa265e03f92d43e96696efca5dd814b6abf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
792baf4b077080e9d043e5bf3ec470f9

SHA1
54ae57a2242ade7f802fa33132b742a2c16ef778

SHA256
252b8ab6259572d55866112ae1f14098f681ad936d96c89c96b17a6a06a2049b

SHA512
42aacc54ba2c0b6b3573c65077a230ae2fa7fe065d39b38968f187048bb8578e2aea18ff49e449ef252f16d89ecb22af5cd7ff8e1c3530afb25721b62675584b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
35KB

MD5
f37607b7098f45792156b3b5dd9b7518

SHA1
3f867fe73f96d346c89ed2026ec4abb48937aa6e

SHA256
d4f3dc5442958edaee101ce396d3f6a36f99cfb7d94db40161d465d77e3657bf

SHA512
f3a5e87095ae7a03a13a7bc58b21924d4ca220dba2f662d7442b273b6ceb8c3ff39a59cfc460ac21773023b0ff1c9c7aa1bbaed370c859ad723f2d0d736c2c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
db87ffd30378c3792a5dbb3510a7c76c

SHA1
3c63aabfee1a6334a52ab0bc5292723812abf2b5

SHA256
7ac8fa07c2756348501e56fdb496f04b4422aa35a73984f5749ca404ac3cf5bb

SHA512
4ad2664fa4e591a3af4ec059daefd603c0a30d4e8c7694dd202b7eb30b0894b315b4b20ebefb10aca245b6856f12ffadf6a1559d7445ef2a149cc3cd9d6da16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dc309187daf42dbf63a4a1ac124ab683

SHA1
df7275fcf469e1e6ea29aa9c50bddd1ade6ed711

SHA256
3e662c637134e1927d38d62ba0d758e1fcc9e0e9165da857e0028ab078ade5c8

SHA512
328ad331ececda6b013bdbb93ddaf248c50948717bde5d4cdd7a880cfb98d260c4f0665f25d1cb8c1e0802871967faf7af443e4776965ee301b47fe7853403ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
736911043ae9a8889567d85781605e07

SHA1
7dc1860b5cd64d1e4857261df5be6b8e9bfd02d9

SHA256
bde789655142d723fd0cc81b4ba912243de7808cdcc734b35fe922131b1dc1ff

SHA512
735318ba39ed0913b59360d514431da47dfd5251ad49aaf8c0d3722930b9e2281a8f55f535d9727bea249d52e46e603191554da40eef9bb8481d79a438e40f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
927b462d2a3777c4bb13e9f547b14a27

SHA1
50261f41d89fa2c37b3d87c3c76e0d6ba6f87943

SHA256
1913613ba3f81950ed4567e784be0fb5dba67808652ec7179a4f60dad284df50

SHA512
b929176ff7ebd49918098be5588eab4ce2119442f25481b6f7e3baa66a99f38a900e46b4ee597e568396f45f46ed42fe0830d6502dff0abd4def5121cd0538f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4ccee3da309c7cbe676e21d1effdc3d7

SHA1
1c5545c8342b39c9db49655e31f18f139eeb3884

SHA256
846a347baaa51da4bc099423b27f60b12111d8a12821ebc8f8fea2596b345198

SHA512
53a83f630c1de85c685b2dc58f48a93ca5e528706fde31b135a69ed102b25a21c1bee1ef785df43c587bb5fa43530f407e907e362dd8689ba995c3c7740d6b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2e4aaf74a4c5fac817d8bee039f9576f

SHA1
2322aba59b9c1de5c231066de353f13a59d0ce81

SHA256
f6ca30b4f2e980f62ddb43986d86398aaa1e20f11bf0330a35f20a26950bde54

SHA512
3cfbf43005d923df22b1c1d506e10ca01515e7cca16b623ec5ba1c6a3627de60caaac63eae45e5c174e7a56a2c955371410cc885e53e82a895d0dad448281a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a9b394025f46eb862558673bf71c7701

SHA1
71910df5435cea8370a10bbb74fcafa8f1fed036

SHA256
15a0f9cddc6c8eb10898fc65881639f6a7af6e6247e03980dda1193cb4c75428

SHA512
1eea8309e7e0243fb06f1fb7189545030dcb561b052816d04498b84e021eac0661da1e650e4c5051c5ec8bc4c568fd41751d903c5d66f0ad8b2d870e084532ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
625f62adad939c540d359026bba25a49

SHA1
735f760883b0689f6ab65f548524b2de3ac69bc4

SHA256
a3a1127f5f502be30775d90350740c72f999f742b3787ac9da830d818ef960da

SHA512
aa3c2775f92b7b393c81759e8f1d32784828f816392b07e4d7434bcc9932d1df72212a809407201bb167aaf27ecd2e71e89f7f5138e05d82fe8a95abfd1b13fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c6156128db29a3c65b7254bd2e6ef3a7

SHA1
fe5dce9f1f3e852f637711bd01410af3b03a5410

SHA256
0b00258b66df086800d755cd573eb931f58925784c1b0f92eb7a5a7ff241146d

SHA512
a6eaba29e4ae28f7905a060dd50c85a5da81199c7812d119f0ddec58dfd434be5d1c27d02cef370f69a8ecbfeed0f487d862e9d6a819b62523589098c9daee2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e583e3ee5e6a21f1f6b3fe1f156b7f48

SHA1
6dcb8b9470c0088aeeb11a1a068d45a271ec46dc

SHA256
8d62746ede0dc76fec7afe1c7a4ea199a10d04018a10aeeb645b6382ae217a0e

SHA512
6cd0cbe594ca132ded294ac5fd9e69a871709024f12d9701fec0d0acd951446ffb4ff93827b36fbb830b3916ec26e50b4c8d1cb233b12f5cdab843a7dac9ea4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b65f9b6971812a446da1a2767f3472b9

SHA1
41d8e352003e734eacb1b68d1d1f8d0fca41a76b

SHA256
da7f80cb5344a11fef9b29d64d2e69777e959a53069bd9a517867c4eb91b92e7

SHA512
29571b1fb8bdca1b6caa3d54803afcf660f1189a58bc5de63c6b032301c545f150536abc54ace8fe0224d4961864c6b4e8bb078ca4f52695954a3e7e4cf340f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cb24ed8fc93b3bfd15e5cb6e2f879ba1

SHA1
6f9ec00a1823d43d27b5e05dd0636c208697bdfd

SHA256
3d43c2204858b7849e7ef56e0695b02e3d1c0f6341902a504109034ce410712f

SHA512
d4264b219eaaf65fcedd105bcc7e43951bd18308438e9dc170c64402abe51340970e8aba56252840eef571278ba012eb191afb9f5d50c5e3814100688e329e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dc8cf756bcce915b9c8ca2e7778a2752

SHA1
ff1bb29c38003bda09d4ccf7871429c5ebfc962e

SHA256
b929c7457b67d22f9880fcf2d5ab6daacd377eb34b272adb24ef5f90b35aac1f

SHA512
7ca2324d6f58c04a8a4d47f4f5cc8d669fa416309ad98462792953692b1a111fcce86855b04bcc64c777b49c5e93dc54e4efcf96b20cd501341e10bf21f8b352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c9a959a3123722cb60d452b9b31d4cf2

SHA1
becfb208dc4ce2c2856ca74c23a7d8ebbb0b3d89

SHA256
9d65770b0efd679ce0ea7dd0456e5b31325d8861a2460392fa0396d205ea8f77

SHA512
c4503c62a8d0f24c0907ab5ef36c0a83b618ef05ea8f45f219456ac2921385470027ba3888bf183c0324b8b40ae80aa74a6ceab1f8d683f65784c4f4a5d4e442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb382339012e764a38a76b16a11b5462

SHA1
0491f4ba59a2803687de27cf22f424cbd231330a

SHA256
6c119326dbcc1c3634a4bd8eb2e930cf96f7eb0593014eca788189ccb8b8abb3

SHA512
389594410957002ed4b7d3629056225495710ddd3349a30fdf432fd6a61c358667c45bb29fc80e4e3ae2077640868cc9cb4006f5de7b62b466f3948a8b72a1f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
61871ad2ca37c29ac11553771e298f6a

SHA1
cf016b37386b148ff903bdbee825c9763be367c4

SHA256
c5bad56cd774beba0e5bd77ebe13fd6a206e0b4a1b91664144d6556f06e44b44

SHA512
09efc911a6086ffe98eeb317a7a37070f935c460a219cf47520bb5ab2d61827f800db0760b5adaa4054f6a51f314bb391b90577090fd8120c22e2a2cbb881e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9529eee08cb79a00bd31a0d37c33fce3

SHA1
7f03de3df7293a61e76e4d4e878f7d9c7264855d

SHA256
055a0e324575ccd645d0cfb8baf4a326ef4ef4222cd834e8a5ce3da189b4147e

SHA512
79b1035d2cc0734c69535ba660fd3e39a51bc08867b26bb9dde03b8ed79e7526f5ae0259a683ada6f09c5b4cfa0291f30b78894851e66bc821b53879c152dd7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
b8374bc57e46ce4da876c944ef55981f

SHA1
8286625d68b1bca4020d0758ef65d63f2747aa9e

SHA256
c55d8e108324af061f27df225a7843510e7ca48d9604f49c0e95456b4d03da82

SHA512
eb0d73b5457ad7fd25335a89caf54008e97c5d3364af4d1d8a72b08e2a59723d1188a6a213a26b2b3a14c6468056ff097e25da25ca986c18b9372060ac7fea9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3bbc3b794bd3f7c71057065e2ff1ada7

SHA1
91c167fd78fd3cc4fc510fb470e3f9d7564e5075

SHA256
60b4064267db10f1e12ccc01813a470a264afcf8a2b8a96162914e38c453e204

SHA512
a3afb007c0cce52294a6556dce80ae7a76fbdbdc9ccaaaec8db31cf3b0d9e487b2ba1e52447ae66583982be78049c3b50365ce52261e3e2429bf2ec4206f2f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a903c1f3f7e8ed52fa0b45b526f41b1a

SHA1
519477c26e2114e712e1f781d570c8793f31cb1b

SHA256
c6d0e61576e00fff87e3f5d4c1d3f0e7c54836d5d576ef1ed33a84fe6006b971

SHA512
da28db66f5633cfd2cbdb1446d294d9b985a2853332e38a87e9682b413d78c8088ff28ee74a83dde8f9887c294745a0afcd9817b5b94992c1a8c2dafaaecb60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac80400a2f6327e4374c8287e4c5dfdf

SHA1
7e1302b36afed73aa4ddb5f1b168d45cf1f61eae

SHA256
bc360d6ebce743b91775510bdd4e8540ee3a28f2970302dcdabd5cedaa26e699

SHA512
00592a17f39123cec087ee89ecf04bb3c837941928c8dc2950f847c5264a83821e14442ffd504a01082487b119724fae3a2753fe87a137be369b62df883997aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e188c5caf6f1343bc8b76b3d3fe6a416

SHA1
7afb40e3249684480cc8e66fa9a4bec321518d9f

SHA256
08de7d9f828e686819a3e6d7da9d52be06298e435214bf0eacdea9bd9a09861b

SHA512
a295627c223efc03ccd6af9b21d2ba96866698c517b019ae2582d160a06ae194e7623a198330abcdc91edd8bd7ef8e21e9e5d2fdf9b9f4c675c849afcdc41fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
358923c4baf2981685e47ca35d960551

SHA1
1e28daddfedc6f78b74795c104613c0be2121f1d

SHA256
8dbf425773e398c8d366b9ae38448e7f1ea1a69436d7baa51d20731b5134e61e

SHA512
a33fbba9390a8fa9c7d1445d9ec07c752d2fdcccd609bf4452158728e459970ac95ab819a347e0255620af0b299bbd7df89e9c2fa0ac24d8754f7fccf45a14c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7e35fb566565a716529c66f87de93dea

SHA1
f6b5ff473d3f18efb30886bcec7b6534be3e5f7f

SHA256
4252a664788dbe04fc48670c96651e56905f5be0b95ee3e97a3435db3f7069fb

SHA512
6f5a89597d4d45bbb83d37d56af3dcdb1c9be05a83a68e42689bb761e3f971a64a5a1a87e8841f60d2e777e297bd4541072de45edb4f485cfb82a7b47d0600e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
aee8c99b76c66b5c29a84084c0b666b7

SHA1
46aca160412d84289096a52309fd53cca849ecd2

SHA256
ffcdb882e7713d73361434f7bf6e881f57326f71f5eca8d9dfd6e8a58bc9b76d

SHA512
9d4742cb36e04146f5c7c27270d0ccdb4a73c8deac9024ae238e0144c57a43ba58e905270668f8b120df8110dcf2bd676b826342f4479a4447d973b3f230f6d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e5ca1890cfdd01a11468f903fe35399d

SHA1
5354d874e8b8cb75d5210509eb1703991a4ea206

SHA256
3db7dca5777225d5d159f1f65d1e8dc3f1556ffa256eac0a51335f0ce758fb3d

SHA512
3c4cf2781923204aa97308bed8589abec495d633ff72cd69ea1962b77a5db52065e0dec08cae5ce318b38fd120b66112d431bf123f67ac228669db9423cf2441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fca2ea146515ced6774654f1ba8c82d9

SHA1
dfd360d1bf23d4c63fb2164919ab0b9aaf44bdab

SHA256
8855631195745cf4907352e3a6fe428e5746287c71f8832e20909f40cf7db22d

SHA512
786f68ee76f4b4a0f0acb12cd47523cc52bafbf144b1ff4b94cd5d385df814ff49c514c51af408ef1fbff488a7e6d8ecfd4c9ae85e30d8ee30a40f255acb0243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d07f3bd80e7c6b4fe9a60def5bc4c0e2

SHA1
531e3d71f8b0908d8cc632bc8d0b8e54994ec65d

SHA256
e48ae21ae21c64030a7333cfb816d7d56e96d621b3f050ff5bf197b9f822ce52

SHA512
e1ddd47515eb7a695831b48921ea45cc5dab02f8f5cc1f935067d28f46de20c0c7ee19c16fa8e2b0aba014e1e8f79560191912af6652a81fc6cb8b062141bb43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
caabd72b936fdb0b071b2f6c6a04cde5

SHA1
94def0619d1b9873e669eaf2d0a85b3bb09d7790

SHA256
292584bb9ed0c8582b110502cacf7f1ea90e3ab3bc05ec459f9cb8aa36d227dd

SHA512
f8061814c945dea73d92b02b84c949b9d3306e56dfde121ac1f9664b9ef7b64b84b6a6ec2bce863a7ef423489cb6249549e4956bdc2235d20f71b1160c0f7e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4b6848e39cdb05188b130dbded38ba44

SHA1
5d93466ca80b1255790858bf079c78a8dcae61b4

SHA256
0b98c2094cbcbd2f29f1f7274043b4f204cedfba54789953d3b7052fa19fa03c

SHA512
3892f8e928d048b101584637f54af34eb06f5987cb14ceac5167ccab50ef5888319fda5110983d70ba24f3e237b31b79157cd1e8b82fd5e788023348f3744507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4179ea6fbf9e74c0a1c935d01fd42921

SHA1
0564cacde4bafb052fa7b84195bc10f6fd371a2a

SHA256
7b8e5618ca4d0d95db6a8112a3f2cebb9bf59036418d5a40e9e1d7ee337a71d3

SHA512
e46e3ddc8e3d5a799d4401918a29aba14ea1d75aa85abcd6cfd782cfc0fb63b74d506e31e05c3293c95a7d21218e343daad1cd446c7f9ad85aaf6ec1e4b7ff22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a6a065fb05c51c1010219298c68f8eda

SHA1
1214c902dcc1698831e46d4750092aafddf7f7fc

SHA256
79ac8dc42ef0b32f1eb90704b1dc831149a6a2a760d5a8cf0e9cd96014279ee8

SHA512
fbdced9efec2e111df51e55f0f3b171eb4f01ee88f34ec20fa1f4cbfe71dd56511504a7b2b04f7df707caf7ec498af909f09b0b0ede0dfa4c00900c8bec58039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
d8c88e0f267bd64209f80eb430187ec1

SHA1
4fe45c1860437d1500f48507af2089922e1f5533

SHA256
5b1cebdb29b8384685cde29e8aee212b7f03afd043f82564e4e3cc9034ee7fc4

SHA512
3da8f59f881487cac4cc9055e99f4d174ec74f3b3322b5f58c05d6be078058e4d176e6ebdd7e74274d9e8371bc479fc7b17daf8869986c82958307dafff0da07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a074a5115b099fbc03c9eae1c742d371

SHA1
64e11834f30a812abeb474d23deb2ae67e02a82e

SHA256
7a24e45dddea68681ab7c3b43c305c1453616380489a189c04933de827313c6d

SHA512
bdc2abce54b2baa7aebc4d3a24dacb81f4b0b5bd3895c42bccb1db6ab79e9104cc01bbb0b375947073dda97db83d5dd7dc077571b8ceceed97471d6dd604882d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8eca0d7307e9275c236d2889b479baa8

SHA1
d5e51729495fbd30a0439d250ef737011326e4e8

SHA256
5d234c1ec5c273806f524603418ac0adc10b9460fac2565d9ca940c66badfcee

SHA512
4f9d3c853b5d195aedbc716b650a7ef79515eed69ba108a99a1d1cf3385b33902070cd15622ca143b56d0e782f5fce8bf48a2b5fcf3737704280b23083d5cfc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d0b27760-286c-4aa6-a911-a6ec41eaeaa0\index-dir\the-real-index

Filesize
2KB

MD5
3e1cfdb71e71ea9b125b4fb6874d998b

SHA1
916f353d89811d8e014541fbf2f01bce9ecad7ea

SHA256
5cd164827f9a64335f6eb9099961f1ea05d96d695a0b1d72081bb5a31b5de712

SHA512
ec07ade8236b5f1a057f4c961ab540c9287872f17ad10e23de5bd2f0d3a8047457b32565aec87cf5f31a393785b6a6f2a2feb62467f79e1a5f0b820688e519c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d0b27760-286c-4aa6-a911-a6ec41eaeaa0\index-dir\the-real-index~RFe619942.TMP

Filesize
48B

MD5
9c967ffec4e4b11426db9bfd94fa0b53

SHA1
03dfa31450251174c1a75790c606dfcb9c88e30e

SHA256
45f08d422a0bac1dd325623118dfcd779661666c54be214641e4580efc9f56db

SHA512
bd30a5459df98eb8b158570ca935d325b7d63aa2f158cfce7e9756a4a5ec92f6b01c6cab122b360804886c9eace3f6a8cb83aae640d0f18f36c4dbbd080702e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
025b1d5798b2fac3b4086958ed4b92fc

SHA1
25a8f6dca8dd271f4d522212e50c5b10402ba78e

SHA256
b2ac255e817951d46e20759a365ac1cd9cffb59692bb7ee8f61a7e840e237d98

SHA512
05e546a25e6b9096fa21ecebec178bbc8884e1be841ba80cc51a34ba545a8b8da332773d9cfc7a93c0aeae65fef1361d6351140716c32cf10307e58eb95e6a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
98857b96af8cdfe8ed588d6d0bca028d

SHA1
f4ac2ba9cca04fa49401dbca5b9e30f89da07025

SHA256
2aeb09302c3d95e3d353c39bcf94568be9aefc8e8e8ff63fc003cd3331ecf539

SHA512
20f6c8ab249951028919602ab1e8c3fecd41c40aeb6dc3f0cc0a94f8251d649b247cbf2f561a22469c5b3f64b1aa5e75d73a54763f19a136e27bf8004133576e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
fc55337d77b1cd2d9b95c96812c68eb3

SHA1
4a320efaa4723826679a6cd874b71fba1b84e2ad

SHA256
9d09036e5fe2b5bfe9758a0dbcc823d54a0c596c3613f5234db0ec95574e98e5

SHA512
1b9b27c0327211bb2709a792076ad72ce320e6051c930f842e369b8defd227a0370b7cb235feb10d7f02fd82e60810c1f4e115d2943028177d2b4d49799d3427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
91efd92c5b8eb08cc1c491c8cb6e954c

SHA1
e632b9eee72f11a8cb3f2ad3933dbc9b0500f1ac

SHA256
d59f01f5bff51da8ec5895c8bad6acaff5c0fb49b0729088c553048a9ba05f75

SHA512
2d0df5509fb38e45b7a7c783b0799063591cd1c95f67a79dcb23fb48c0893414138e63b9b1524ea7e40b01adfef2d53a48ce18ceead6e690329be78e1d314f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
585280807fb46bc6fe384c11e5ba00b2

SHA1
aa43266ffbae842d92093bb6900f1c43b4c7d77f

SHA256
a5aed783114c7f6c19600a7b09a60a8a324d0a852a242296875e6b5701ea810d

SHA512
8f22befa4eec43631a1e4e333dc5a4436d6fc83a032f386ab6a9684c8a891263e87d234e9fc592287b3cf8ee17ab2e328a26614ed8ffb496f94884246fb1f149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe61f9f0.TMP

Filesize
48B

MD5
535c9b2d214f7b4c7d616ce3b1abfd1e

SHA1
95fa82d8adc06412732a72d8c5878a9fbcb79953

SHA256
91e809d672ffa0f360039cec2f4db3dfa666adbfed362e0cb7ecd5340cf4a964

SHA512
5b2ce5800b0afb8d2575ad5e36f1d6954f2c5f9e3b1c92385956f9d6630e3820bbc2c7fede028efa6d3e1234b2362dcdede7450b91eabe37602f6a4de4dfe6df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13368124505042212

Filesize
78KB

MD5
fd11a70b65cb6bbc6ab4d9a19ee4c612

SHA1
c737edc3824a4b4a43230404819f555dd9e6e817

SHA256
8f58d239ad5964cdbfd420eb5fe7cc63a0b0ecd04c0211441143a388802363ce

SHA512
5b1d697ecbd7f64df9a23e8ca834baa6fc5199b7c9e9f7e175a4fbfd4ecd1bcef0794530b3c1c66ace1d6ab22b79bf82648373719ef2f7df5a5d0021918c1c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
42505ab6bc7d3315f426e9e39d895298

SHA1
c2a8d0f90d2a9c951731de6cf79aa010ca4d172d

SHA256
8da3b33b0a1d99f134c7fff653ece37780d94e2f9bfb997dfa048aa90f742eee

SHA512
4b733b7b5bf864c7807e6fd1bf7caedd6733ef21b46311a6800a2fa82df17b47f3359d71dfeddce5525f7f19ead757489972fb8aa98c2d17a70fda1602b3b643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90776dbb916e24be10bca57025b85764

SHA1
a1a872ec324df789162c9e24c35b3fdc5a14878f

SHA256
2a7105528a2731e1a44ee281888bf4bbfa2b9208186fc081ff6b42e6481826b1

SHA512
2c53d27577337d395a4947dced0670342aca32e0b0fb6c5ed290993273f7601f32820d91abb9f587537105bc748a9dc1d334320cf0da1b905f7889aafa323087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98dcd3c2edfe54727bca54f5cb71c43e

SHA1
7233e58e31c596953925058a93213148805d950c

SHA256
f28c6a7dd76aba62b9e2d5705fa88f4cb7516341ebda5ca2b02d004c697f908d

SHA512
64033b6dabbf532140b826011e465dd4f5f6d6f719acaf6422aec8b63934f73519bcdcdf28cf7fa53c05e4f29010ac772af5be28e382d197cff9e93b0162094e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84b18ab00fc6ea89264e70a09a3507ed

SHA1
8129ab53441a41a8d295a4b03d9da1801afcf24e

SHA256
308228fc7f99290adb0d0e898a1989910565d931c740d34b09d652ae734c1e78

SHA512
4e36f4519ec524068c1bc9496515055c6f4011ee75d69355e76723bf5e434a87b26137be29b56a98dc60456f5d93f2c9a1a3fbe61398230f59054e9175c9030c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f3bc771963bbc5d052fe47a023c0352d

SHA1
f13b73fd6f3c89328fff2fef53b0945277bdbee5

SHA256
19fd9bbf8afabf34d61bd6b3e70281c34a8d4bc50aa5dcc6d4486c59d1840de5

SHA512
42c4a566de8454fe0d8e22d22c2dd53161d764f11c866c851065b13124ce6b1274f829a0c740ee1685cd24b089165fd829304acd1b29f917f0b3263ac84bedc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0870741114b5c0105398076a8ddf4a84

SHA1
6072cfa7b5fbcc3eed46a40be8c0ffcd7d0a1dfd

SHA256
eebda68a5991abed7e91c85af00fdafd51201bc0d91aff0ec7213a720f63ea62

SHA512
79532d98890083a82dfd636c0ea4a37d4bf7ac46648014e2c0675f8ace6aecee88853bd350f77923edd6a8ecae0fba03fd2b2587c751a5a711a58234cac75cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43d775c1ee6ade3afd9ce51a5d4cfed7

SHA1
6746855093084701987481b235ad1321938f505a

SHA256
27e3931666b4463f88ed80f8cc17536e356f0262c4682e13b143f9b72b0ff68b

SHA512
8d065e0548c13bf946aa47855e9ef8e048262339f09fa295e4d71240c65f457825d36fa9a7eb9a6ae5220f930f581f1404598eea095709e12cec6b4e55325d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd35629ecff2e5a1710d0045cd491cb9

SHA1
3e7e41ded1e6adc4a204d90b1f6c763f46edb5bb

SHA256
2e6e89602170a6ca306ca4cb8dfa91e8bf3a288d5af5823d202a4d07c89beba8

SHA512
efd13841902c8e2267fa1c635c9b181b29bc5110789c3a5e026b50fcfa70d60c94051f56dd160eaad2d187d3599955367d41dc2c076eea275dc76254b671327f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be5d1cfa3157d20a6a4428c2bf5d757a

SHA1
f42e175617ae1efed45eb6f7c5b41e60c3e37711

SHA256
2a4c770c04d737b11ea6869cc21c27e84affca395f6df17c9bcc8bfb11119780

SHA512
dd657c64b027ca705de8e491675511692b9947d16654399999ce79fec484666a7c4c25a81dd46d025761d481a4ce8344f2d27c05d7751be506a8653b3c61be6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
91af6423d54bfb6b66c43092945d180f

SHA1
e375b2efe641198441846be47a567a5c43277c66

SHA256
d4eddb82db88a0cfa80f66f0581065e8c2ce221b7c136be5ff678537c178e83f

SHA512
a263b563a7a504c5d52a3912a20fb81dafb3a7b78dddf9efc2e1bd14eb000ed913f6a4b1d66c503daa0424d52d856ac9c8d0f69a41544f39b5b9132018b091fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8042f98b71c1488b6017beba1f959164

SHA1
5666b78b74f4ffcd884718cd36f355ac645c0a98

SHA256
47eacd68e1e72f90474eab3588840ea61b0200f3c2b7346f13efd81e8343d24d

SHA512
239f9a1a5bede5861babd73d18a53b3d02e1016357ecf9ac73403db667c67cf5c1680b997ac6aff65ca497425a2d98cdb2383f6d4fd4252d4cd6f87c6860455f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
343c95196319a4adfac05796c375052a

SHA1
811819e8d1cd946c90e0c551f92cf1b3d30502ab

SHA256
4cab824eb97f7488c122a206b8243b85ce3990dc57474e6f6f2538b58684bc9d

SHA512
49f6c8cd56d51cd06321d572586d48fec578bad76caa1a72a64343f67862b8611c31d441932ae13d0278ac1c68a44ffe0d33e5e784b4547aa56142ae9329d4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c469837ecb0e95e1f41d380e3a293e7

SHA1
c848526a123330a1c55bd9b82e111e8b4645f554

SHA256
548b3c344ed924fef00d12b22f22542d0f9ce870267ae7768f000b2ccb594f2d

SHA512
a299ba46342684da4a43d56046b2a6b6d9a755127f8f5260539574f1eda2ec707a4042e3d8578561ed11eb370b8e1623537d02ded626733dd3f191ffd6b7e0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ffd87a097d8f03db9d256501a0ed69b2

SHA1
1dda9a80781b11141aefce4b58320c86f7333479

SHA256
82c418c89a3c103a77c60f31687e80599718be6c6bfd19696049ffae96af2a8e

SHA512
b55726dc4de39df94bb4fe7723c0ce8dec0b1b5bfb207d68d4949f1fffd8ee1553a02c6bbf1ea8d8505a9fd2498de4767136c31afe8a71f49d9956f70a5e0af0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
add403dd7902678c5f62c8b2a2496517

SHA1
e9ed678cce4b2fcab0dfdea8cbb4b4cf285e203c

SHA256
f8345d2b0da24da6dde1046cc5f404d16eac279fe891bbb94626fda7ece24073

SHA512
c85c165def5b6b64489ef4ff3165dda5f9bc8c53a439ec7f6d061fa9423e4b2fe25a78a5e40cc65026d4157a564d6d76da352f4f322a4a50b716e7341c5dab45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39dd159798c4e6c3163600cece324463

SHA1
3019259687ddb3990c40b88cc5cbbd2ab813fe3a

SHA256
d7c146e126653a393a0eae65b3b469e0f389b066634c572c7433b9aebc009ed8

SHA512
d6fd38d7952aca5a9e8e4fe5aaabdecf169fda222879062601c74ece935e1250069945067c464f4ee4602352cc993363be5d0e9a333e549373cb38b917b9e85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
420c75ff2f1203de90534f90a5267f72

SHA1
afa1f5bebe27b7364f1c002cd36d04b3fdb49cc3

SHA256
158c47b151998d98d7315255f34f933f59d3ede4f6d031f76a7dbaf680a25f69

SHA512
dfef47560982c6175c7473befc7a7a05079896ac47922d0aabf0aa2197cf6f4b1c4d5f5ed8d0761e834c0d41fe8198124133aae733bacf5365eda79fc8eb5157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fb4cc65472b8eabb80119178765dabcf

SHA1
a4c78f7116dc1709463a7a59e17fb9790f96cec3

SHA256
cbe4ded9b4344087418e7daae01b0ee7e0a3c014b646541053a23ef963b98064

SHA512
18e8d5104b3851e5e7a9eb57c0dd878d85327e9414bb0eb6a6c613a701c6c8da3082250f11330cd6fe379b7bd41364c19edb1dbc3ce5d37d0e11c20b0345c34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588dd4.TMP

Filesize
1KB

MD5
a56cbb55e8a6b6dd712700b7d0dc474d

SHA1
6660191843910c1d173186676038e72f29ff09cd

SHA256
53ce37acead2e0e38cd3158ec6dc8841d732de3b0768d3579dc118926930966a

SHA512
0f78b8228c2ec2612c32c070915f316293ad56d7b65e670f8f59a4d14272cbd331b5aff6144cf19798834be010cf3ce3d2e75861ee095e79cdc9eb6696ba7bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bebc0c4c-f8b8-4638-abfc-9ae603489004.tmp

Filesize
1KB

MD5
8bf5b3bb0886678164c5b4a4e9a486b4

SHA1
51e7c3bafe8a83d739b0a5c5c6215e310d30f1ed

SHA256
4af8ce94231ff87b08b53e16d659c42b66337094a767af2b9c9a955c790bc685

SHA512
568e9002ef1e546c52fd86fb99ef70cf6f501b5421140c8137865ccb9819059d88e1747fb77dae056afeb67ad269ba5bfce96fe5c34b40a7109fb876bcc6f3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5b39cf4-c39d-4190-891f-9327dd1cf6f5.tmp

Filesize
1KB

MD5
5c4263fd16b891eb05c034f40a7a7dab

SHA1
541d95da0e4b444bdf21550977dc04df0431f6dc

SHA256
a8be408dfab67094b9791a4f0b091367985bfe92bd0a2016c91f89aee94cb799

SHA512
c5ab21283e62989f020c454509b47d93c11ff2fef558130796351ce5d5c2c8d9478fb2450333494aeccad2b3aa2f42b5fe8ef80f0425355042dba77e87083c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
16KB

MD5
092c751200a9d3e7d33736853b64dca5

SHA1
fcdb37a7aea22ed310d1133af4e8bf285da48293

SHA256
f618eca0df898a8744b61df7163e29ee8366aa0870dbea3ceb1b318836c7a7a6

SHA512
2aeaac9dd61d5c944a13e16335ee17ed909aa47a9da549ae8881ef811963081410c0efb559b15ab5841730acb744d337c55e8e22f88f6c9dc8828c77e380a74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
66a1f9b2eea483aad43d2b128b0d0ec5

SHA1
5d4a05caa0f3354b8dcf98fd92eff1f61756c758

SHA256
4ff3e410577dbec606984363d0e7e06cf8f4b1274a0e49374dd610974cdc3b9b

SHA512
7492fe1ac0d401f1de5099d2a1e0eb0c160132cbbf122044b67ee17ae50bc5896c80c5792069d63645a5850e79487d169de2b20846af38be0514950ce0f23a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
82c5879ea3868a45b255c83d8c2c5605

SHA1
7ac8a60a8413f62ccca5876f73346c0244f5d4f5

SHA256
579ce7ae91407b9e558e789c9e2e72116af5d46c80042b5407882c6152278c16

SHA512
762c64251c40bb11dabf6753d7d62d49b991b8aa0d7c63106ec04b113a57bbf03cea7bbb8d802c97fa3fc90e78702cbe9c092e1c9afca374d2e89b5dc80317ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bc22504ff42311478c7ecf52035c2b88

SHA1
25a46720bc67c6e6d0690affedce005ba850fb74

SHA256
bb8346b733faf1b3f5b2eaad4c11c015c6761fad8490e2e993b23ef2e4c235c5

SHA512
cd26412917018265f6e851311b8293385802ce5d4eed5432f694244272ef11b67bb550408768ab2f5debebbbe1724e62f7c3923b458bf4151c4382c6763efbc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43a0e845b5987077e97251ba7bb55f1a

SHA1
37a87b50cf7e2475b72caf4cfe82efab8209994f

SHA256
a3f8655b1c3747dac80d8b39aaa090e43797b701fdfad898467114de555b6647

SHA512
106170193e7a988380f88c3044a15e77b11f0ee57c671473681fe123013e2707b546cdcc622a84076cdae514d4272f71e083443646737bc5542c563958580cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b5728b1b44807476e6eafb7246ae8f2b

SHA1
72c4cc1c8e501f44d4cd271eb7785f87669227f2

SHA256
37f02fd05aefc60d20720c4083605b7fa268e2c76ceac3ac87f271f77e02b74b

SHA512
bc91a2a3dbd95443f306931d7ee762db459a394f5f0970d49d18f805190b27665816788dce7775f303cda5cc7667057a97d2d74336aa3e7e2a7b524285eb633d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6b3df8c86a469b393c7beadb77a7ae91

SHA1
eaf5e06210d5579b0d3a4f8ee39c9859f54c897a

SHA256
740f0c2db74aa90f036a7092d4be6a9a2e70e1f6735e429704831b4af25fcf68

SHA512
166eadb963fb3ef6185775ad6ede8feec7a4c494bd82a602d1315def443345db2abb7844cdde41baa374a942ab3b70d69e07bce256a2d1e03ecac4ca1797566c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
efad0c51d978293f9d00a76137b969f8

SHA1
d87afa094ffb6f3347b4bce40cd16576c13f18b6

SHA256
2d505dbad488b395d82dd0da16c1d967e26ecff14c5c6e9b5523aaed10f6a046

SHA512
689fa52ca411dd0e8efb3d239db68b539f104792b1d7aa929f6f1d8b6df4b4a0c45759daff73d2048e6953e21c3d2d23e766eed3ebc21400c3f2ba457986765b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f37363a00f911b629561a663d5783726

SHA1
ea589f743631849c6749e4c3a5c93377335b17e1

SHA256
9212b22dfd59569b6bfbaf6a77b906357f04b8eadba5946c23a598890582bf85

SHA512
3609927de2b1b47a1458f0d29e49714962a59e99667e3603dce65e23fbb6138a48c3f1a34ae9d0f7e56a17f233bf3bc8b9016ff16f9cf26174248ed6fa67d326

Download Submit
C:\Users\Admin\AppData\Local\Temp\idapro.exe

Filesize
192KB

MD5
05d5875e19e172b49adc9d0f04ccae46

SHA1
c2f617a38218ed18ac5350416789de87ccfa4606

SHA256
c595e3530c8f93a8021ef1e23ce9031c1a989cda64dc9b51e8ee49ceec4e275c

SHA512
311cbd9eb728b42122b6d7e44c6a2dd5299c664fda3119e7c88adb12d1e42f9a347d330e1bd5999391c7fa5870a0ce6a712b7274a688c1687d666a04998bf7a8

Download Submit
C:\Users\Admin\Desktop\Launcher.exe

Filesize
332KB

MD5
26710533eeed80b2a3c068f2693917e8

SHA1
91b1f3ea0e773d844ab1030347ec76091ceaa098

SHA256
5992d7b504ae9869006bd0c8aef3b0c1e8ff0b40808d51a9c54c96c7f17a15a1

SHA512
b17fbb012cdbf4d8b89d39f26c012c45539d7ea77de2b48828bfae8e7d858f555fe2b8817ee0315da082fecf1c81e676bf8abf44014937a87ae4d8c21d5c9ff0

Download Submit
C:\Users\Admin\Downloads\472daedf-188a-495a-a657-554ae64d48fa.tmp

Filesize
760KB

MD5
515198a8dfa7825f746d5921a4bc4db9

SHA1
e1da0b7f046886c1c4ff6993f7f98ee9a1bc90ae

SHA256
0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d

SHA512
9e47037fe40b79ebf056a9c6279e318d85da9cd7e633230129d77a1b8637ecbafc60be38dd21ca9077ebfcb9260d87ff7fcc85b8699b3135148fe956972de3e8

Download Submit
C:\Users\Admin\Downloads\Non confermato 636201.crdownload

Filesize
197KB

MD5
7506eb94c661522aff09a5c96d6f182b

SHA1
329bbdb1f877942d55b53b1d48db56a458eb2310

SHA256
d5b962dfe37671b5134f0b741a662610b568c2b5374010ee92b5b7857d87872c

SHA512
d815a9391ef3d508b89fc221506b95f4c92d586ec38f26aec0f239750f34cf398eed3d818fa439f6aa6ed3b30f555a1903d93eeeec133b80849a4aa6685ec070

Download Submit
C:\Users\Admin\Downloads\Non confermato 775893.crdownload

Filesize
373KB

MD5
9c3e9e30d51489a891513e8a14d931e4

SHA1
4e5a5898389eef8f464dee04a74f3b5c217b7176

SHA256
f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8

SHA512
bf45677b7dd6c67ad350ec6ecad5bc3f04dea179fae0ff0a695c69f7de919476dd7a69c25b04c8530a35119e4933f4a8c327ed6dcef892b1114dfd7e494a19a7

Download Submit
C:\Users\Admin\Downloads\RegisterDeny.exe

Filesize
560KB

MD5
5c1ee3e80152a8df12361b71c139f51b

SHA1
35fa06078fe54ecda4180c37cf30d48ae8efd396

SHA256
33ca366fbf706bf161b14977c9b159c1452a568a50c033753c9bb459d283d363

SHA512
2582edee478cfd2d9bbff4b2640b183fa88cdcf944af96dd5deba4ae21ed336cee65f71ec2a00420bce5f4f8cbf5b55c212a9102a9db45ce43057b2a4e62691d

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
7792b30b1e3668332c78501c1734ccdb

SHA1
5057ba882750149190c82db68d8adc4ff3272452

SHA256
4fa7c58812abcab584c1f218ae8521f09c3afd83a68aed6213229a28d97c982e

SHA512
5c2d2a4cf92d50cfd77f54a6132ab798810cedf00d1695938b23cb719611535d43a638aa0cebcc4d2a8e6f2c40d9f9800ef4b08e6e36d5ee25034c45eddb2805

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
86ffadfb7aede1665b2cc6824ca7e0b7

SHA1
4cf1e686c88b44e0becc99714cccdc97bf05483b

SHA256
e599fc27c331701c45cc4384465da66c050dcfd999ee9e0ab17143bff7d8ce18

SHA512
a40e176b749502e1b8d95791d98bf11641adbfec09586189452c9c9e0aa9f52e66f125972503a9b6f82615f95bb3045c1798939a1a3b3e79b932fa9987c1d74f

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
b7578945ece6c834c667b00707572c09

SHA1
b59bdbef11571e61281a902ad61a1ddc65cfecbc

SHA256
5dacb96c8a242b9a66fdcfb7f4eaeb7c8d4d55f8aa96f0be2af54c1b68f07809

SHA512
ff104dfe12e01ee730fe330203a737b94c4335c77202c7b784e93cca78e7a9a24fb465dec4c3275d951a7ddff4072ca86db70cdcd45c9b29df8c3c3d78db2d8f

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
9b710a07f9500938d539f084d5e8041e

SHA1
ca08c29164b670aab1a4f2428d17e1734c77cbcd

SHA256
c329fdbd3969e9e827b9895a29cfae2fae0ee7706949b5b33efc41f06727de13

SHA512
efd47943e2bdec1600534e48ea90dfc8f15702e7d53886c803345424d2eede590367618b94f06b59b1a27398b2df9d16dcfd479873c151bfaef3afd14920878a

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
af18f032a3fab17c259c7c78cb026dfe

SHA1
b5e122768e0c3dbebd9e27406ad2424b2c1a18e5

SHA256
1dce8c243f387264899af499a03fc17a04087acf099db0129f7e2557db549055

SHA512
637b1bd9ba6ab3ef3f948615ee6be1f331c757c0721e424429f114050c2442389bbc10efd4c21272aec7b95379e54ea7ddec0ef26825d36125c352ed5394b70b

Download Submit
memory/224-1034-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/224-1026-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1100-1782-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1360-1015-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1452-1068-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1452-1054-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1500-30-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1500-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1508-1780-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1520-2394-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1600-1794-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1600-1785-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1692-1033-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1712-766-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2688-1052-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2832-746-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2832-767-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2920-2135-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2920-2152-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2936-1793-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3312-1073-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1438-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1221-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1769-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1754-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1070-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1072-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1752-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1142-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1750-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1748-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1746-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1744-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1742-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1740-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1738-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1736-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1322-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3312-1409-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/3344-1051-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3592-792-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3600-1764-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1762-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1766-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1767-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1765-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1763-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1755-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1761-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1757-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3600-1756-0x0000016E95C80000-0x0000016E95C81000-memory.dmp

Filesize
4KB

Download
memory/3852-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3852-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3984-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4080-2143-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4080-2151-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4220-997-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4480-2150-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4680-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4960-790-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5092-791-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5300-1017-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5300-1035-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5336-1036-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5336-1053-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5540-765-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5720-1067-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5804-1066-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5848-1781-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5860-1069-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/5860-1043-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/5860-1747-0x0000000000400000-0x00000000006BC000-memory.dmp

Filesize
2.7MB

Download
memory/5960-793-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/6092-770-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download