hxxps://btdig[.]com/search?order=2&q=vmware+esx+2[.]5[.]2

Analysis

max time kernel
869s
max time network
873s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://btdig.com/search?order=2&q=vmware+esx+2.5.2

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	qbittorrent_4.6.6_x64_setup.exe

Executes dropped EXE 4 IoCs

pid	Process
4916	qbittorrent_4.6.6_x64_setup.exe
2312	qbittorrent.exe
5664	qbittorrent.exe
3120	qbittorrent.exe

Loads dropped DLL 7 IoCs

pid	Process
4916	qbittorrent_4.6.6_x64_setup.exe
4916	qbittorrent_4.6.6_x64_setup.exe
4916	qbittorrent_4.6.6_x64_setup.exe
4916	qbittorrent_4.6.6_x64_setup.exe
4916	qbittorrent_4.6.6_x64_setup.exe
4916	qbittorrent_4.6.6_x64_setup.exe
4916	qbittorrent_4.6.6_x64_setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qBittorrent = "C:\\Program Files\\qBittorrent\\qbittorrent.exe"	qbittorrent_4.6.6_x64_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files\qBittorrent\translations\qt_gl.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_he.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_TW.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_pt_PT.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_es.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fa.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sv.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_bg.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_de.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nl.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_uk.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_zh_CN.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_sl.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ar.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_gd.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pt_BR.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_sk.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_da.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fr.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ko.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\uninst.exe	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_it.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_pl.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.exe	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\qt.conf	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qt_lt.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ca.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hu.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_cs.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_tr.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ru.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\qbittorrent.pdb	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_fi.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_hr.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_ja.qm	qbittorrent_4.6.6_x64_setup.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_nn.qm	qbittorrent_4.6.6_x64_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbittorrent_4.6.6_x64_setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\DefaultIcon	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\shell	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\ = "qBittorrent Torrent File"	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\FriendlyTypeName = "qBittorrent Torrent File"	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\shell\open\command	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\shell\open	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\" \"%1\""	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open\command	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL:Magnet link"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\DefaultIcon	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\open	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.torrent	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\URL Protocol	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\shell	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\shell\ = "open"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\qBittorrent\shell\open\command	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\ = "qBittorrent"	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\URL Protocol	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\shell	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{11E7F66C-36FA-4E37-BB75-458E5089652F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.torrent	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\ = "open"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\magnet\shell\open\command	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qBittorrent\DefaultIcon\ = "\"C:\\Program Files\\qBittorrent\\qbittorrent.exe\",1"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\DefaultIcon	qbittorrent_4.6.6_x64_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\magnet\shell\ = "open"	qbittorrent_4.6.6_x64_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 63548.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2312	qbittorrent.exe
5664	qbittorrent.exe
3120	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
1676	msedge.exe
1676	msedge.exe
2168	identity_helper.exe
2168	identity_helper.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
5932	msedge.exe
5932	msedge.exe
5768	msedge.exe
5768	msedge.exe
4916	qbittorrent_4.6.6_x64_setup.exe
4916	qbittorrent_4.6.6_x64_setup.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2312	qbittorrent.exe
3120	qbittorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3120	qbittorrent.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
2312	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe
3120	qbittorrent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 3236	1676	msedge.exe	84
PID 1676 wrote to memory of 3236	1676	msedge.exe	84
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 1036	1676	msedge.exe	85
PID 1676 wrote to memory of 376	1676	msedge.exe	86
PID 1676 wrote to memory of 376	1676	msedge.exe	86
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87
PID 1676 wrote to memory of 4644	1676	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://btdig.com/search?order=2&q=vmware+esx+2.5.2
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeb2746f8,0x7fffeb274708,0x7fffeb274718
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1080 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8204 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8692 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9288 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9300 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9624 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9864 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9820 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10080 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8812 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8848 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9308 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9592 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9980 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9316 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9572 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10132 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10120 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10520 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8728 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- C:\Users\Admin\Downloads\qbittorrent_4.6.6_x64_setup.exe
  "C:\Users\Admin\Downloads\qbittorrent_4.6.6_x64_setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- - C:\Program Files\qBittorrent\qbittorrent.exe
    "C:\Program Files\qBittorrent\qbittorrent.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10684 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe" "magnet:?xt=urn:btih:24ce5aa3c6bbab79b29558cdbca609784641ef63&dn=%D0%AD%D0%BC%D1%83%D0%BB%D1%8F%D1%82%D0%BE%D1%80%D1%8B,+%D0%A1%D0%B8%D0%BC%D1%83%D0%BB%D1%8F%D1%82%D0%BE%D1%80%D1%8B,%D0%92%D0%B8%D1%80%D1%82%D1%83%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%BA%D0%BE%D0%BC%D0%BF%D1%8C%D1%8E%D1%82%D0%B5%D1%80%D1%8B&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.opentrackr.org:1337/announce"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1591319678722051199,7011029630347859038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10720 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\qBittorrent\qbittorrent.exe
  "C:\Program Files\qBittorrent\qbittorrent.exe" "magnet:?xt=urn:btih:24ce5aa3c6bbab79b29558cdbca609784641ef63&dn=%D0%AD%D0%BC%D1%83%D0%BB%D1%8F%D1%82%D0%BE%D1%80%D1%8B,+%D0%A1%D0%B8%D0%BC%D1%83%D0%BB%D1%8F%D1%82%D0%BE%D1%80%D1%8B,%D0%92%D0%B8%D1%80%D1%82%D1%83%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%BA%D0%BE%D0%BC%D0%BF%D1%8C%D1%8E%D1%82%D0%B5%D1%80%D1%8B&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.opentrackr.org:1337/announce"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\782d24f08ba741a49363add64c27dc84 /t 6104 /p 2312
1⤵
PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\qBittorrent\qbittorrent.exe

Filesize
30.8MB

MD5
a3bf634bbe40af828b798e05431725f1

SHA1
e5213e9d851e88219b435a319c46c594ba7da8ab

SHA256
3d89af52d78631443bf4a1e0a1194fc64e84d82bd26d8e15904495e2e5e01167

SHA512
e44599483a3e0ac9bea256bc4a9ae42ec76055b415526320f9a441a12111a9c85496a2cdd8f12a9ec94120f987d94464af1d46c2c80f12ecc3c32e459884832a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000072

Filesize
252KB

MD5
deb04fe2a35d2981313f891baaa32654

SHA1
69e5aaef4a2f447878824d905832a08a9c596d83

SHA256
93dedb17602e315ba495c99be747f3d5717b4f49306c55326f4570b43c9bc1c8

SHA512
8c32d572a8f108079263b9ab5230467b454518b60932db7a2cc855a350130d93db5b8f2cc5c82a9b3011e572d80d67e23c777145fd45e6467b0b2caafe92378a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\884f1228546fe7a8_0

Filesize
19KB

MD5
9f11f662be52c393ed07ad1c29377946

SHA1
5e887e327e8cce3aca134662bbc438e4ac99de89

SHA256
c3abf2aa61c75dcaf2d3b39779436d39c8a846c0f109b0ba4fb40f695be827ca

SHA512
49c05c18d679749aa869f91b8b52c76735a4ac0afdb03abc15a9ed551b662e4c0527c1bd747611981db2ef8366d3a15127aae3468802ff237cacf0576c8f7ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a42bc0273ae18d22_0

Filesize
38KB

MD5
b1f7f1d18205e6a9d84df103a1e28373

SHA1
8b96ea38753a0b63ad077f64f26eca402923c059

SHA256
cfbc42e753d6d8439bd9db0cc1df74768f3d1be179d8f1a9089635794f2a4cb6

SHA512
d5d12ce0fd181f91979fb200f0b12fb72db2f367afacb64886dee623b5507b4e08dbd3e04db2736f25f5ed3bdac8f6f48bfe7f95f7cf43b1acfec64df5636e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
144B

MD5
0b989c73b8e99cf15d2a4b3c6fa63226

SHA1
9af04775298e1c23b8d06fb74802a919d04ba25b

SHA256
986671ac1dc4617ebe043562680b24df308ed490c4d96182c3b4e43224ecc9ae

SHA512
63753fee2da7398de8e6929c5ecc0858fb12a2c2eaf54da047f9cdd66caafed8651bffb2251027c5ff9d820555e8cea821c81ad3aea2f7ab94c97df908eb6dd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6fd2575a95139bc6de585ddf692d05bb

SHA1
87e5d01b05bedce3b5247faaa9822a26ccbe031e

SHA256
2e55b1faa940229335c2a1407f301f10a61baea4931e4c267fb871e51fbc444e

SHA512
6eb445f32b8a968d64f4669ed9e0134222c67fdb5db38aae280d036d1c102b5c05823cc1482e5ed229001cf2debf7c5f46f3c3f125a03d58be68ada0ff7a9431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d71255d1cf15283837f3c959b62e3b18

SHA1
2084bbb2fd4b406be3a311936cc4d9253a4f78a1

SHA256
b0097d4ec1306f333daf973d5ba0a94674e0bf377ca221140a54e2d73d27358f

SHA512
cd272581d8ac463880e1e718b281ff36bb9d806468e00162af209e876bdc0888e09eb882db9e9be3e02c2f9434cef4953cf4b7778feb1e01f86f149c7a9b7881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
782ddd4420d170a4c68ac8ecc2dd4817

SHA1
d46720cf5d4b74901e63c6f03b7aa057f2f607a7

SHA256
1367f1099452dbb47e24d14b7f71743ed5b59dc32d9f862ab45617d7de079bd6

SHA512
d89bc5e82480a79d2576e8ac20ece89ff0b0021299c54b42bdcc654be1e1c74d6fc86c5cbbb734a99a064bc41d292eedc42025e2956a3c9df55e83ac56854efc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
52df30606c975ea3ec10872b1bebc238

SHA1
f488d33fbcd2a6772c9ee49c52052ad7ef6787ef

SHA256
237702609f7aab8dcf3e0d8d4678ea2564b223f20a3a45dd035a70e18d8f5ebf

SHA512
0cce4763cbf2af87139e3953b70152797f941910ad26ab37856714df8b18f8260a9099bb7890e2d7b5e1ea0dedfb3f55d940b21c22c600a6142ca82310f849e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5a9553714430ec8095b61d642c82bec5

SHA1
06d98037d97cef72e19b1ad653b2d5ee66558176

SHA256
0979214db3a6fc2f220869265a7a4fff073642a47c36bfc8b1629f8e10819f14

SHA512
41eac6f701a7c28db2ea3e0d2e3096869bbf38e762bcbecbea9893d8eb37f6f135091453d811118b86f1760c8cf7fa31aa44633eba2ad99eec3a2eb2c05843cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
57b9dd41ca10b0ec3c9150d133ddc74c

SHA1
d7336baec24383e9781dc8197219852486c9258c

SHA256
eb7070c803be2d51dd22f5cfd183a3e9ca3550431590f1c0b05e3058db6bec2e

SHA512
25acf28f76b5ab95baf7cbdbf0073768c25f7d72ee800e53b76343f53857a65838d1f6b9dec0504bdc55984d9ad935dc4f364cdf7bb83ee8cb3f6f51205e9f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
45a054b2bb02c2c2716af081c825c424

SHA1
e814b10d21366e86778054d7afc01915857fd424

SHA256
f775e3301aae2f9456faa3a38e1058f122aafbcc10d15b336f5c46114726a953

SHA512
2478ac39e72a2b5fb02d7bdc59f9507b24ef037a068d4fc28a72dfcae067ac9da3767a3398b58cd64928a8c7f36bebc987c06ff56e34ee15521d42e39ffb616d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
5fc92bca22e8d187b3628e765896b89c

SHA1
147b5dc06354ce0bb60cca76c8c6a60b9eb8d686

SHA256
52cb8cbd96fd3b4c949688dbd2ce6e00c369a7a2690a7220e249e0cc5e29a027

SHA512
920b9d3a5485c11404d57d4ac10e672d54f2d6e40d93dd9061dbfa9a2bd56f9782cb37baf2ac93aec428d305a32586241eff0c91a746236aea095489369166b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
e8446e8903c647486ac52ab975da37f7

SHA1
aeaa215cbc9a05297c26b6197579aaec8b564da7

SHA256
e5364e412cb1877f1a3e75234b804f27eb53711c45934ce627e6bdbf0593f5aa

SHA512
ceae333e09cdf5d9f93c9773c26ab11eaa2c1fcc336d7aa86e418c30b9bb6e853e131027f0a6fe190f4b11421437aefe77c2303508a2e4af89975f7c183b0201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
913B

MD5
9c4a5f653514527a7bd6d660c2196996

SHA1
2decd4414409104ebe17eda65d28cf9c3875ea1b

SHA256
d7cf07d343ff5c801eb52f9117b77ab983554c5d124d1f38d95316e87acc574c

SHA512
5b6bdb2b411a35f0c4a164b73c3fbddb41cb2af80a2bea965e036f3774ba9dfd558d196693007df4c61ee8e1ca4858ae3b05de49392ed53f2c336d76c1d1acda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
90b88e463a4796b28315ca8e502eeb7e

SHA1
458ef44845d1d7076a53bf4b6415b039e12ef042

SHA256
02327a909789398b76d3b0aa8d0173a147f3cac230adeb7645b3e3e264008084

SHA512
32f8123c2af7ac98a36a242e5b98c4ec421adfaa336c545427afecf93b6f54dfe11b51e5524b5840d801b85948217a37c9a356139547a7d8dc1d16de867613b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e63a1bf1a969f301520bfebb9379c316

SHA1
e1870ccc8c9685ab744cc00a499bc8ae3462c41a

SHA256
420117ade1b85c1a2c20c4639c5408464a8f1ac60462416d8523add04b23259c

SHA512
d12488204cc0fbc7edec9af93a31fb78e46c8896580cf78d8f3a7a0294b4e41e9f62c6b6ba17056814f1f9821998a93789e02b7a937574cdf0c0ddde3b9ba932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa369ce07abb0df7c6ab10c7ac066deb

SHA1
648120a89548101df73f0dc47c7f8db1cce5d220

SHA256
72267a77422567ceebdeb99815857ba243a3dd463cb5e498896b4f5a226585bf

SHA512
ef85afd33fbed447da7589f109bc953a52b7fbe6032ad44bfd0696dd4551b1b0a908d55d460bae28266cd326ac7747ba24fdda678e755600b2ceb3c9da3210ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
dd33b5c4552ceddaa330abe7860b3958

SHA1
929677ff66e6077192c2613c6bd19d3298ee5934

SHA256
fe010a07d3041a20e386a24ffc2a0d08e7ba0a35fa8cc98c8a431260472cf969

SHA512
f58963b14b3a759bcc4b68d4728843f8b06555c539c3004cd310f8d16894fbb1f9656cf4d8c234b5929c0623786596e98060dd3586420cd81240489e5a587fb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98aa3f2edd55b6b3028d77ef3d72304a

SHA1
bf20e19ef112c29d7f504ed1d9e00e9e99b6816f

SHA256
d5bb0886b086753e17d9d50e8dfe5a64e468ef4b75b459c51568debf179d3ee2

SHA512
65fa06edab1e6fb1e934164e25d1284e143e0a3134e513ff4e6e57cf36ca7c5a03151cf079e0cbfe64d65c6bc1f196ff8016d7bf5c71d2ab5242ce652bb0f326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
cc8813476384bf2efbd2bc9a4db215ec

SHA1
c54f4a1da8cd9d472f704a2c4e6a93e2478c6674

SHA256
5a3c0aee28b0174fde0351225beff94fe90633064c8772d2f5fd39f760b1003d

SHA512
35d208e9666df363c5fd4a717e31bf039ab073ecccfcbcc162e516818df73cec4c66d9f08826ffcfbf3e11925f447c8bda62910060a65894cd15f026d05b1a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
220fea399d663ca45d9683b9b526f866

SHA1
41fc48b7ca8b50f158db6d573d69106849911497

SHA256
c57d29b97eebc12f493e90c4917699e3b59712d963534ecff3650c03e63f4399

SHA512
c4e44d12766243f353709a490feaea347cb025fd910fbb5e26d3f6da9dcd231852e87c09a079de349c46a166fa532459b200dbdb1c5f1ecc4fcf0d0dc4377245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
44fde048e7d95032d86353e12c0eccce

SHA1
92273162fe7041dc242ef26f1e8d1e71aa7b2eed

SHA256
bac0da969a585f62f25942264a60333a94e036ae0968f42b299f431eb7b1c80a

SHA512
eaafbfdb1c3250ce3f5c5351960ceadf2cdb457968e65f6ced261c4513267411b48a2a97421ae5b490b34a2500d05593dbe27e0a8aa46551b3e9a267bc17d352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
4910a5d18cca8d7350bf4f1cc8501125

SHA1
d5029e5e2b8ecb6264310716ba58bc88866aa143

SHA256
9ea265a8cfc958a918e05273b3b39d7e0a62e91378a6c79289a67ec3995aaf5b

SHA512
221264c52803016f49082e4058490b1c6fd8f94cc75c81605a8d907b317ea3240591f6f9e73240826cd5f659189412772d0524f5da37658eddc2d8fc3d18a9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
054f108d5c18c5320241bd721beb489c

SHA1
18172500ed8ed11ea9cbd86251faecdcc8d142f6

SHA256
75d9e98cdc77eea603548a9ec6d23b779958c5f723bf1f1241749e78e6d47ae8

SHA512
ff71ee62b1a55b65d013ceb88db9da3c5fa9d415903696649b0ac8b72836b289a0c5a50c072209b512dede0e81018c2239521bd8d4920b17f7fb37e5c1964632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
29a36d3be8a774cecef9bfca4e8b4695

SHA1
3c7cc631a1370629aa496dfcb7d05c43feda5891

SHA256
5ff0203ee7fc3049ab04fa0d30f4f81331d345c36e182de05679e4f143c8deff

SHA512
6177070166b6af20f310acb918fd9004e2f9390fd224fb7987856490c4c39f3de9c784d9e5acc8dfa4ea16ac69aec76a1429dff9df70eee4a81e3ff3ad5d76cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
2e9955d37d6e98676306975a6947a0b4

SHA1
d12a2bd032fac4efd9692a868ded9178819e9082

SHA256
0c497f87794a2f67ac655e3d0b177196ea4363a8b85c851c2790e39d4945409a

SHA512
528238594d2b41476135811efd81af5ef1d73e43ce5dd55a44b36195aa8d2407b6b331ee251db9450d257a0a0e76aca5dd27b3f95e8c6adb31ed8cd1389ff081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ada3f3d01a26a0e325721c7faca31e45

SHA1
36e14919ef2842e1ab013879023c77ec5d03a5bc

SHA256
6c1bf3d063548afdd57ed66d7004d688beb928ff0d19c52b54a233f6cda63dc7

SHA512
351f6c0448bc908202cb77040b0ed40f6ff37b98c54f4d1ccdbff154d6b823330963f9b33e54c369a42cc28b96ad29b097770a6fe9646b289dd4b50fb337ceef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f54441afca2b13e3ab71e8d235389796

SHA1
dbb37c0a36e7d38db200bdc2226ec39c1c263a84

SHA256
2fda0e4cc2cd460d3a6fbe272ed666f92bc4747f4d764276a373eea10dbaa74e

SHA512
0d5b11b48e076711cf0beb0260d8e804c2dd645b2068d24b496073e6ab0246cbabcb9073656b0f15059367ca289226ceb663ada92fc03eaee36acfd0c8c09298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
0437ccb28be77bcf39249579a31a122d

SHA1
b975a2b6e04abdf9abd1d64bff8ab976886cea3a

SHA256
d075c6e69158cf4ac1ef41d405aa4c07e09a4c84f926940900b1aa52825f5d7f

SHA512
f78468e4868b063457719347ea314343a4cdc5030f3ac97f3cda82637a2f9dc89d447f1e094ad60e16c7349842aed0bf34f4ab87b0cdd9e1cc8ab25f8f090428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0dfa9ec8803e14c967ab36454a02d249

SHA1
3bf94d0e9c0d5d2286b1b9d598c053e0a9bb32df

SHA256
f245c98cf88b4bcff1c31d773ee85a5228fea2854ea2564da71bed84866c544a

SHA512
cde2ea6b9adbe6008a36e67f11d9c192512ecdcb5dd4f932f40e1c676a0dfe1d5c245d6015b193cc1f6500595f0db94399f7c5db49a89b2ceac6c74d29d8e7a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c119b.TMP

Filesize
700B

MD5
283b01bf33cbe107d61a37748d19d693

SHA1
6d362b44fec0903d1cb29e233141bcc46ab084dd

SHA256
0c6726a3a36ef5dcb181db45b1dd0a64949640635051c1165ccbcfb37a752ef7

SHA512
5d14faddb5c61df5dcad0331d82a214217476048a245424fc616bedfbcdec2ae797acbbfeead20a3ccda5f2afaca849a370d595bbc7c640bda36f5a3a2e19ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fdf89bc6e2c1ff725bd3a47d6b0ec6c5

SHA1
ccdd2d3581d5c6d749f97852bc322fd7ee82953d

SHA256
d7fcef2873dffce448664b87dc6322757b766f43c83f3c8df9710ce147f4dbb0

SHA512
b6dbae31010c9f73168cc41de420b5a6adae26b2a17fd36a4ad65b4654fccb5afc4a9fde77cb6cde5c1c7c13d64a04e964f45378b59fba1a904a25e28bb5bf35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
02e489813ccd115f4d52cb10db0b492a

SHA1
968c49938f6d1df157c19b9a567786c65c161d9c

SHA256
3cff830e0cc56d76de2c1fb4ce1d2859ca555dc9f747d681e0bdd6d97bc1815b

SHA512
d275e513526490b9dd625aa5614126837ac39dacb9b6b3bdbbdd6596ae89d5c32e60f41e7dcf87a5cf7e877eee472ba39c2196e5c65f6a8d6d2a87eb61d1fb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c345dd8f96abe636c2e5751e110f22e

SHA1
ed7c8fd3af1c3dd9fc15857dc61ed02ce86ece19

SHA256
3cfbb705b88b242e971210748b0c54c7927c7585ce91a597790451e364517d83

SHA512
6cd0693fb17713406d62b34d378566b4f8184f57caa271a98dcce7bf53b9ad124756c06f39fab84cc5ffddbfb040cfca713df1d34722eb1f6c5fcd889f71984b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
56d19bfa43cb1745bb6e4889911646ad

SHA1
c375384f074e23b6ff7711d0fbcef5af3c45fb87

SHA256
9302d73a78ede3d87151aef81c793a9562042e72d368917f9ffbdabf2e869469

SHA512
53da48bc9cb44cee40b4b1712abd58b7cf726cb0159a8a1c2c329d8dd34e37dbf588ef7ccf1e3b50314b69711f4fd84c95efc28de10a22b7364884515dc61d30

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9610.tmp\FindProcDLL.dll

Filesize
3KB

MD5
b4faf654de4284a89eaf7d073e4e1e63

SHA1
8efcfd1ca648e942cbffd27af429784b7fcf514b

SHA256
c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3

SHA512
eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9610.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9610.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9610.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9610.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9610.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9610.tmp\nsisFirewallW.dll

Filesize
8KB

MD5
f5bf81a102de52a4add21b8a367e54e0

SHA1
cf1e76ffe4a3ecd4dad453112afd33624f16751c

SHA256
53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2

SHA512
6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json

Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
C:\Users\Admin\Downloads\.24ce5aa3c6bbab79b29558cdbca609784641ef63.parts

Filesize
2.9MB

MD5
2b1240ead63411eb5b8c0340658f95c8

SHA1
c87d05d538142a8190a3420822b62cbd6b18f330

SHA256
ea65297238df19d3861ccff0aa6768c66c89ca5dc1733b2dca749c28d515a550

SHA512
9754dfdb694261f1e68142f2b4ba80bf1f8534e4b9e6d169c2c64c8d2baedf4a75f53a70c12c0c7b8fbb285371abe1c693328fcfddac378c39f33471d8ff04c5

Download Submit
C:\Users\Admin\Downloads\.24ce5aa3c6bbab79b29558cdbca609784641ef63.parts

Filesize
6.8MB

MD5
af5e4aa95ecba9ddaa3fbb28d63ba86c

SHA1
4c94d4b9c47c69bdda35577a1f9e6039568eb23d

SHA256
63527d1f244e5607c7856a7baacfb12aac0202857c1621ffdcd1dff0637f23e5

SHA512
987d70c16fedafc9f27afcbaaf3626837a8639560fa832e01b993e3ab304eb3c4d6e58c6a7963938b199708eb0bdb3ddb76b5c3cc79d446a1ad28051183c312c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 63548.crdownload

Filesize
34.0MB

MD5
c91b91e2b4c4fc170667b626c129cd0b

SHA1
08c6ab3e097cac25dcad9fa7e30fe1e39b31a00e

SHA256
d26a7a6351c08c73ba1ef409e78b660426d93ec7a61f1d543ba2ed607bee4b13

SHA512
df8128dcd8a1da7508e19db861ef3f7ca4c2c63181329963ca61dd59f01179b7ab9627940ef773325213bfd2007ca677c9d19e95ea5201f55664775f64030e31

Download Submit