badrabbit | d99ad2ba440f2b8eb3ff86d4b7b6eddb76f97129673443e957c38a39b581941e

Analysis

max time kernel
603s
max time network
604s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14-09-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loader.bat
Size

314B
MD5

8df113c0dab1608ab53df4d18e925ac7
SHA1

f607ba1bc71d58c601dd08f26b9b35dde8322524
SHA256

d99ad2ba440f2b8eb3ff86d4b7b6eddb76f97129673443e957c38a39b581941e
SHA512

23e36824d2113a9ac334418211d33428fd37f335034b7ddc1e487164cf0aa950b82f9c45f5ea2d3fe8d5e12f62fad0cd1f792b580726975ba45c6472e3804ebc

Score

10^/10

badrabbit cryptolocker aspackv2 defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Blocklisted process makes network request 4 IoCs

flow	pid	Process
609	2988	rundll32.exe
633	2988	rundll32.exe
680	2988	rundll32.exe
745	2988	rundll32.exe

Downloads MZ/PE file

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b00000000f3f8-1573.dat	aspack_v212_v242
behavioral1/files/0x0006000000025cb1-2618.dat	aspack_v212_v242

Executes dropped EXE 40 IoCs

pid	Process
1756	DanaBot (12).exe
1260	DanaBot (12).exe
3300	DanaBot (12).exe
1432	Avoid.exe
5840	Avoid.exe
4864	rickroll.exe
2164	BadRabbit (1).exe
2624	F761.tmp
5392	CryptoLocker.exe
3292	{34184A33-0407-212E-3320-09040709E2C2}.exe
6132	{34184A33-0407-212E-3320-09040709E2C2}.exe
4908	satan.exe
5768	satan.exe
3200	ilukr.exe
4448	ilukr.exe
4016	satan (1).exe
1212	satan (1).exe
2084	biowe.exe
5824	biowe.exe
2732	satan (1).exe
2396	satan (1).exe
1060	alryf.exe
5888	alryf.exe
4076	satan (1).exe
1268	satan (1).exe
4272	reyv.exe
308	reyv.exe
5144	satan (1).exe
3020	satan (1).exe
6028	fypoo.exe
3780	fypoo.exe
5844	Popup.exe
5516	Time.exe
5492	Time.exe
4744	Time.exe
3320	Popup.exe
3264	satan (1).exe
1272	satan (1).exe
6056	cicy.exe
2460	cicy.exe

Loads dropped DLL 1 IoCs

pid	Process
2988	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\{FC1BBA7B-23D3-741B-5056-89006DF8340B} = "C:\\Users\\Admin\\AppData\\Roaming\\Esehu\\ilukr.exe"	Explorer.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
35	raw.githubusercontent.com
40	raw.githubusercontent.com
3	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
4448	ilukr.exe
4448	ilukr.exe
4448	ilukr.exe
4448	ilukr.exe
4448	ilukr.exe
4760	Conhost.exe
4760	Conhost.exe
4760	Conhost.exe
4760	Conhost.exe
668	Conhost.exe
668	Conhost.exe
668	Conhost.exe
668	Conhost.exe
284	Conhost.exe
284	Conhost.exe
284	Conhost.exe
284	Conhost.exe
2984	Conhost.exe
2984	Conhost.exe
2984	Conhost.exe
2984	Conhost.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1568	DllHost.exe
1568	DllHost.exe
1568	DllHost.exe
1568	DllHost.exe
3168	DllHost.exe
3168	DllHost.exe
3168	DllHost.exe
3168	DllHost.exe
3464	SystemSettings.exe
3464	SystemSettings.exe
3464	SystemSettings.exe
3464	SystemSettings.exe
1756	ApplicationFrameHost.exe
1756	ApplicationFrameHost.exe
1756	ApplicationFrameHost.exe
1756	ApplicationFrameHost.exe
2300	svchost.exe
2300	svchost.exe
2300	svchost.exe
2300	svchost.exe
5340	DllHost.exe
5340	DllHost.exe
5340	DllHost.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 5768	4908	satan.exe	217
PID 3200 set thread context of 4448	3200	ilukr.exe	221
PID 4016 set thread context of 1212	4016	satan (1).exe	228
PID 2084 set thread context of 5824	2084	biowe.exe	232
PID 2732 set thread context of 2396	2732	satan (1).exe	234
PID 1060 set thread context of 5888	1060	alryf.exe	238
PID 4076 set thread context of 1268	4076	satan (1).exe	240
PID 4272 set thread context of 308	4272	reyv.exe	244
PID 5144 set thread context of 3020	5144	satan (1).exe	246
PID 6028 set thread context of 3780	6028	fypoo.exe	250
PID 3264 set thread context of 1272	3264	satan (1).exe	311
PID 6056 set thread context of 2460	6056	cicy.exe	315

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	BadRabbit (1).exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\F761.tmp	rundll32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 9 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Popup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Time.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot (12).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit (1).exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4100	1756	WerFault.exe	157
3468	1260	WerFault.exe	162
3056	3300	WerFault.exe	166

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot (12).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3448	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlgLegacy\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!m = f401000040010000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:PID = "0"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = 00000000ffffffff	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlgLegacy\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Pictures"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Popup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "3"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\LogicalViewMode = "2"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{24CCB8A6-C45A-477D-B940-3382B9225668}	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByDirection = "1"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlgLegacy\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlgLegacy\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\Mode = "6"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\IconSize = "48"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupView = "0"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f80cb859f6720028040b29b5540cc05aab60000	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlgLegacy\{B3690E58-E961-423B-B687-386EBFD83239}	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlgLegacy	Popup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3007475212-2160282277-2943627620-1000\{7D342617-AC99-4808-8CF8-7D71D12FC3C5}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "7"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	Popup.exe

NTFS ADS 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\satan (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot (12).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 383695.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 772185.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 483295.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (4).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (11).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 421543.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 304256.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 706563.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (2).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (10).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 955472.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 175670.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (5).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (17).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 234218.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 56166.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 722521.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 893976.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 734931.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 632362.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (8).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (14).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Popup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Time.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 139495.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:SmartScreen:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 111095.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 484286.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 727280.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 673462.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 220700.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (3).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (19).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 93032.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (9).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 324925.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 80962.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 520084.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 605140.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (7).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 652596.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (18).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 253785.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 300173.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 876756.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (15).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (16).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 636798.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 32037.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 220069.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Matsnu (12).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 75306.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 279161.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 86282.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 172271.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 415021.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 136307.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
920	schtasks.exe
5384	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3304	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
5236	msedge.exe
5236	msedge.exe
4536	identity_helper.exe
4536	identity_helper.exe
2460	msedge.exe
2460	msedge.exe
804	msedge.exe
804	msedge.exe
964	msedge.exe
964	msedge.exe
5980	msedge.exe
5980	msedge.exe
5928	msedge.exe
5928	msedge.exe
4680	msedge.exe
4680	msedge.exe
3456	msedge.exe
3456	msedge.exe
4672	msedge.exe
4672	msedge.exe
3768	msedge.exe
3768	msedge.exe
3944	msedge.exe
3944	msedge.exe
1452	msedge.exe
1452	msedge.exe
336	msedge.exe
336	msedge.exe
2596	msedge.exe
2596	msedge.exe
3344	msedge.exe
3344	msedge.exe
3276	msedge.exe
3276	msedge.exe
1156	msedge.exe
1156	msedge.exe
3364	msedge.exe
3364	msedge.exe
4800	msedge.exe
4800	msedge.exe
4684	msedge.exe
4684	msedge.exe
2776	msedge.exe
2776	msedge.exe
1768	msedge.exe
1768	msedge.exe
3292	msedge.exe
3292	msedge.exe
5920	msedge.exe
5920	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
4232	msedge.exe
4232	msedge.exe
5640	msedge.exe
5640	msedge.exe
5152	msedge.exe
5152	msedge.exe
2988	rundll32.exe
2988	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5236	msedge.exe
3304	Explorer.EXE
5844	Popup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2988	rundll32.exe
Token: SeDebugPrivilege	2988	rundll32.exe
Token: SeTcbPrivilege	2988	rundll32.exe
Token: SeDebugPrivilege	2624	F761.tmp
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeBackupPrivilege	5220	vssvc.exe
Token: SeRestorePrivilege	5220	vssvc.exe
Token: SeAuditPrivilege	5220	vssvc.exe
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE
Token: SeCreatePagefilePrivilege	3304	Explorer.EXE
Token: SeShutdownPrivilege	3304	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4892	Conhost.exe
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
5844	Popup.exe
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE
3304	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 4920	5236	msedge.exe	82
PID 5236 wrote to memory of 4920	5236	msedge.exe	82
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 1876	5236	msedge.exe	83
PID 5236 wrote to memory of 4452	5236	msedge.exe	84
PID 5236 wrote to memory of 4452	5236	msedge.exe	84
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85
PID 5236 wrote to memory of 3792	5236	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3064

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\loader.bat"
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe4,0x10c,0x7fff6a013cb8,0x7fff6a013cc8,0x7fff6a013cd8
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4632 /prefetch:8
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6928 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6796 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7092 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7484 /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7488 /prefetch:8
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7508 /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6432 /prefetch:8
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7888 /prefetch:8
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7872 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7616 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7848 /prefetch:8
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7424 /prefetch:8
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7572 /prefetch:8
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7844 /prefetch:8
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:5920
- - C:\Users\Admin\Downloads\DanaBot (12).exe
    "C:\Users\Admin\Downloads\DanaBot (12).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 300
      4⤵
      Program crash
      PID:4100
- - C:\Users\Admin\Downloads\DanaBot (12).exe
    "C:\Users\Admin\Downloads\DanaBot (12).exe"
    3⤵
    - Executes dropped EXE
    PID:1260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 264
      4⤵
      Program crash
      PID:3468
- - C:\Users\Admin\Downloads\DanaBot (12).exe
    "C:\Users\Admin\Downloads\DanaBot (12).exe"
    3⤵
    - Executes dropped EXE
    PID:3300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 256
      4⤵
      Program crash
      PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4908 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:1
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7048 /prefetch:8
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4232
- - C:\Users\Admin\Downloads\Avoid.exe
    "C:\Users\Admin\Downloads\Avoid.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1432
- - C:\Users\Admin\Downloads\Avoid.exe
    "C:\Users\Admin\Downloads\Avoid.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2656 /prefetch:8
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:5640
- - C:\Users\Admin\Downloads\rickroll.exe
    "C:\Users\Admin\Downloads\rickroll.exe"
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
      4⤵
      PID:5992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff6a013cb8,0x7fff6a013cc8,0x7fff6a013cd8
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
      4⤵
      PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff6a013cb8,0x7fff6a013cc8,0x7fff6a013cd8
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
      4⤵
      PID:2572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff6a013cb8,0x7fff6a013cc8,0x7fff6a013cd8
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
      4⤵
      PID:1596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff6a013cb8,0x7fff6a013cc8,0x7fff6a013cd8
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7612 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Suspicious behavior: EnumeratesProcesses
    PID:5152
- - C:\Users\Admin\Downloads\BadRabbit (1).exe
    "C:\Users\Admin\Downloads\BadRabbit (1).exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2164
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2988
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:852
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3668914645 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3668914645 && exit"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:920
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:35:00
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 19:35:00
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5384
    - - C:\Windows\F761.tmp
        
        "C:\Windows\F761.tmp" \\.\pipe\{36F63104-D8B5-42B3-961E-646A75A8610E}
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7868 /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7264 /prefetch:8
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7544 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7856 /prefetch:8
    3⤵
    PID:3732
- - C:\Users\Admin\Downloads\CryptoLocker.exe
    "C:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:5392
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3292
    - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
        
        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000238
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:1
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7460 /prefetch:8
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7224 /prefetch:8
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:352
- - C:\Users\Admin\Downloads\satan.exe
    "C:\Users\Admin\Downloads\satan.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4908
  - - C:\Users\Admin\Downloads\satan.exe
      "C:\Users\Admin\Downloads\satan.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5768
    - - C:\Users\Admin\AppData\Roaming\Esehu\ilukr.exe
        
        "C:\Users\Admin\AppData\Roaming\Esehu\ilukr.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3200
      - C:\Users\Admin\AppData\Roaming\Esehu\ilukr.exe
        
        "C:\Users\Admin\AppData\Roaming\Esehu\ilukr.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4448
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_8e769e2f.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:812
- - C:\Users\Admin\Downloads\satan (1).exe
    "C:\Users\Admin\Downloads\satan (1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4016
  - - C:\Users\Admin\Downloads\satan (1).exe
      "C:\Users\Admin\Downloads\satan (1).exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1212
    - - C:\Users\Admin\AppData\Roaming\Opos\biowe.exe
        
        "C:\Users\Admin\AppData\Roaming\Opos\biowe.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2084
      - C:\Users\Admin\AppData\Roaming\Opos\biowe.exe
        
        "C:\Users\Admin\AppData\Roaming\Opos\biowe.exe"
        6⤵
        Executes dropped EXE
        
        PID:5824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_6dc1a110.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4760
- - C:\Users\Admin\Downloads\satan (1).exe
    "C:\Users\Admin\Downloads\satan (1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2732
  - - C:\Users\Admin\Downloads\satan (1).exe
      "C:\Users\Admin\Downloads\satan (1).exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2396
    - - C:\Users\Admin\AppData\Roaming\Qadynu\alryf.exe
        
        "C:\Users\Admin\AppData\Roaming\Qadynu\alryf.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1060
      - C:\Users\Admin\AppData\Roaming\Qadynu\alryf.exe
        
        "C:\Users\Admin\AppData\Roaming\Qadynu\alryf.exe"
        6⤵
        Executes dropped EXE
        
        PID:5888
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_7b279aac.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:668
- - C:\Users\Admin\Downloads\satan (1).exe
    "C:\Users\Admin\Downloads\satan (1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4076
  - - C:\Users\Admin\Downloads\satan (1).exe
      "C:\Users\Admin\Downloads\satan (1).exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1268
    - - C:\Users\Admin\AppData\Roaming\Ubmuar\reyv.exe
        
        "C:\Users\Admin\AppData\Roaming\Ubmuar\reyv.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4272
      - C:\Users\Admin\AppData\Roaming\Ubmuar\reyv.exe
        
        "C:\Users\Admin\AppData\Roaming\Ubmuar\reyv.exe"
        6⤵
        Executes dropped EXE
        
        PID:308
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_d3a6e664.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:284
- - C:\Users\Admin\Downloads\satan (1).exe
    "C:\Users\Admin\Downloads\satan (1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5144
  - - C:\Users\Admin\Downloads\satan (1).exe
      "C:\Users\Admin\Downloads\satan (1).exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3020
    - - C:\Users\Admin\AppData\Roaming\Urreym\fypoo.exe
        
        "C:\Users\Admin\AppData\Roaming\Urreym\fypoo.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6028
      - C:\Users\Admin\AppData\Roaming\Urreym\fypoo.exe
        
        "C:\Users\Admin\AppData\Roaming\Urreym\fypoo.exe"
        6⤵
        Executes dropped EXE
        
        PID:3780
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_23b6982b.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7292 /prefetch:8
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:4668
- - C:\Users\Admin\Downloads\Popup.exe
    "C:\Users\Admin\Downloads\Popup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7732 /prefetch:8
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
    3⤵
    PID:676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8768 /prefetch:1
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9060 /prefetch:1
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8840 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8548 /prefetch:1
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9108 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9160 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8216 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9084 /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7688 /prefetch:1
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9240 /prefetch:8
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6756 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:4924
- - C:\Users\Admin\Downloads\Time.exe
    "C:\Users\Admin\Downloads\Time.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5516
- - C:\Users\Admin\Downloads\Time.exe
    "C:\Users\Admin\Downloads\Time.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5492
- - C:\Users\Admin\Downloads\Time.exe
    "C:\Users\Admin\Downloads\Time.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7980 /prefetch:1
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1
    3⤵
    PID:128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,14770928455687836261,12890282656143936337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8028 /prefetch:1
    3⤵
    PID:3404
- - C:\Users\Admin\Downloads\Popup.exe
    "C:\Users\Admin\Downloads\Popup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3320
- - C:\Users\Admin\Downloads\satan (1).exe
    "C:\Users\Admin\Downloads\satan (1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3264
  - - C:\Users\Admin\Downloads\satan (1).exe
      "C:\Users\Admin\Downloads\satan (1).exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1272
    - - C:\Users\Admin\AppData\Roaming\Wezus\cicy.exe
        
        "C:\Users\Admin\AppData\Roaming\Wezus\cicy.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6056
      - C:\Users\Admin\AppData\Roaming\Wezus\cicy.exe
        
        "C:\Users\Admin\AppData\Roaming\Wezus\cicy.exe"
        6⤵
        Executes dropped EXE
        
        PID:2460
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_352d2929.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3428

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3692

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3704

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3864

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4004

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1756 -ip 1756
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1260 -ip 1260
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3300 -ip 3300
1⤵
PID:2736

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004C0
1⤵
PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5656

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:5056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3168

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3464

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2300

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
58756d99d2376dcfbede6057dd25a745

SHA1
76f81b96664cd8863210bb03cc75012eaae96320

SHA256
f5d0da7b010b28a7fe2c314724a966c44068a8c8fa7e9a495e1284aa501067fa

SHA512
476e35c3da0cf223e773c2d26403c12f8c8d034273cca9e3c4cba9359f8506159c2a5267793c8bd9982b636191ddda62e9119593f5599053894c7027a58acc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.3MB

MD5
af79d4fc626118fef6de11536494fa93

SHA1
fc93dd671ef898efed28b91979d53796dd4d0570

SHA256
f49a2c6412b03ca7b938015269cb915e199f9a46fe64a0a8844124b19b3e3a5e

SHA512
265f2f13b01cb0692ddf93997c51361304c6cecd9955bc19cd49c562cfd81bc92f856b87f0c8164f035c62cb1507154eb2848d4ac82d429fbb35f3bb843ab207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
43KB

MD5
d9b427d32109a7367b92e57dae471874

SHA1
ce04c8aeb6d89d0961f65b28a6f4a03381fc9c39

SHA256
9b02f8fe6810cacb76fbbcefdb708f590e22b1014dcae2732b43896a7ac060f3

SHA512
dcabc4223745b69039ea6a634b2c5922f0a603e5eeb339f42160adc41c33b74911bb5a3daa169cd01c197aeaca09c5e4a34e759b64f552d15f7a45816105fb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
27KB

MD5
da9335cc11a14227b61d8663d09ec33f

SHA1
8ff0398d03e930beaf80697ff8d28a0e47c0bd50

SHA256
f0b14d3cce2f618df61a2134588d44964ec9b35fbfc7d9388e3facf9e3d41933

SHA512
ea18ce7caa4c59069a1546ce390bee4f9f713fef8bebb6046a43d7344eec3c0944bb9bde2386ccf0b997cebc5dca12fd7243bb1ed4eb9acf30987ef12a9a7716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
62KB

MD5
0a3487070911228115f3a13e9da2cb89

SHA1
c2d57c288bc9951dee4cc289d15e18158ef3f725

SHA256
f73027dd665772cc94dbe22b15938260be61cbaad753efdccb61c4fa464645e0

SHA512
996f839d347d8983e01e6e94d2feb48f2308ab7410c6743a72b7ecff15b34a30cd12a5764c0470c77138cf8724d5641d03dd81793e28d47fe597f315e116fa77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
184KB

MD5
c9c341eaf04c89933ed28cbc2739d325

SHA1
c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

SHA256
1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

SHA512
7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
47KB

MD5
213af7ac1aa72e2c0c316743695b7cd0

SHA1
c93bf2de82958073a23b3a495356118ef718cecf

SHA256
f5680671f5dc330f962eb3de4164654e2c17284ac3a109f687ddabf104e25ce4

SHA512
d0e11f42a046682805d18a0a133df1c8c4272b94117de503dd4992c34f93e516b7decbf77496f45768aeb1a95f1493f74f5ff732e9b42efa6bff1b47e9b0c1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
232KB

MD5
b57ccd217d1eb303ed364904beefa153

SHA1
5e1cf6017c59c1aebdf3f92349f715e48d0a886c

SHA256
6017cf1dda925cd438a5bb42fac546ed7fb1f66cba5dd2bd1de77e554448591d

SHA512
64f3afab2a80184f4c52f06e2e1435d88216a04693bc3f3e26b372f2f9469c033768d2a10a251b3e506cb18bf3876b6f8bb9c1f73fe8a8b96f80c34dcf395ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
17KB

MD5
074e969bb4b56acd26091b19784df7e2

SHA1
0b8f66fd70f29859ea25ee481ff33f93bb84d512

SHA256
405893b0bf0b3e87141e7048e1cb6665ca5593fea1b159ca0ce90e77d049c51a

SHA512
0e7286126446b64efb16d8891ae2a649e4ccce337510eba812294e78b78d3d2680f4504bfcac7a8347e809c2e3fd905215ed711f60894b25a5beeff252372c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
32KB

MD5
dbb3b15ca6316c746729b1f4782cee84

SHA1
4d52df6958cb4f30d22340850c08006b8e4decfe

SHA256
b918b04e25423a0a6723f8cc426e5f4435b4639b8112820c4dcc3614f9f002d2

SHA512
e8ad7ccae5126c7e19955dadc076e5000b21db4dcef319e8e4fc310057aedb4f840bbef322c711e7e25599c61b87e8b075db1f619c4df15e41109e5f744f8afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
32KB

MD5
64c10f93926b45f7a374e33c90fc244f

SHA1
6bc05ab8a76324f7aa0ae98f58a549ba1b94c3ba

SHA256
2083c8e8acd6ec0180a8d7d12e1b03fdca7dde9d70a8e3409dc503b0d2536b47

SHA512
2f3d3bb311738f70cff15ce893b9b4c6dc7c9419fff470e0d4a9e0d7f79e6660b1c3d7111f3717f3a74a25bb4a74ead6c5716899bd9fac22b97981f6faf493b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
18KB

MD5
115c2d84727b41da5e9b4394887a8c40

SHA1
44f495a7f32620e51acca2e78f7e0615cb305781

SHA256
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

SHA512
00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
18KB

MD5
fd86ca09a092068d2affb0a6c521ca38

SHA1
c940feb75b6b38ca5623da91cf1f64c196820ec5

SHA256
a0efaf92d671a9f96411d911f3fa2df217919970e9dcd961d6f3fdb7852d3379

SHA512
341514b580eb88fe99a81214ae90669acd2c0ae40dfbaa0f53a15933e95237ba7a2c74bb24e19da8e66781e1034f58150f1f06fe2e675bb9e5148c596105af5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
20KB

MD5
31c31559409d67355390aec6f8aeaf60

SHA1
7838c951e423a713ae6b31f9ea272c51a5b8777c

SHA256
7c0c23f717e2dea3af02e7cc788df0d2fd4ccfea681e5481ae1837ed9792cb45

SHA512
4d07360afd18c4abf1f223f5112c79a50a59cb4bb6ec316efad6c647076ab9286814c8414811470fd36e5a41085cd59c17819dbe63ed8165d627a92f7259bc32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0

Filesize
2KB

MD5
e75730fdfbcabbe6a9a8126a2c36105a

SHA1
7a172618fe8c31778a5a6c17b125367456a6068c

SHA256
bc6d7a6adfee8a1f95574f96091f99ea0668c65ad21329019eeb92cb7015fa64

SHA512
83b5cf33c40e58940d93b1c82d8eaaa79b7ce7d049331c5ee0243aa0c784cca58a42340425c2d297ba23da7d43d3eea791a914c0e18e79ddf7727d00fc8bf94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\08fcd4ce80cfdf0e_0

Filesize
68KB

MD5
bf35ad7e4742858f771ec70654efc228

SHA1
bde3906c57d582800fb796676045b6a8a61c0085

SHA256
d461d3920cc406ca947a8ccd9fb35f7b5646a9b4e210f323d4bf8d19506a53a6

SHA512
12e3dd2f68be125a297816cbe253ebf577829ede09643f4b08e59b21a6f25049818b0a2c57bce85b0909dc54661f2065c555a7b144d2f71488d49030c2c536b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
5KB

MD5
7760edd25a31edf1efd330f074ce3168

SHA1
0b070dbd18f5e7b81b2369ba7796c2909454702b

SHA256
403ef7be00510dc971e99683064f8c3c0fb02557d12d9f5eb28b8463ffd944e6

SHA512
d0e7301e2f3735b71667af53b5411bdf2b4f68a44fbeef97af8555484ddff5bd08462ae781d3c2b681bb498789fc7297200d3272acc971031307dca100254bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\10889463483a5cb8_0

Filesize
8KB

MD5
bc0a8f133d2a70634054b3db25098a06

SHA1
6bc912b5991279244df254b7e0cc8e58084b9341

SHA256
b6a27cc57cfa045723fea83d3be6ce89dd8b977e580c078ce8787bf9568eabf1

SHA512
c9052fde0bfaabe63c021c3a3bece8f55c0f7f65c0080f035a76c9b811ccec99dda00a3accbdac071946cb9f07c23b06c9844430cae123168982e998a5afb9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\12087cce3c4fb9b4_0

Filesize
54KB

MD5
bce74d8ae92e4230edce9a3c86cee78f

SHA1
7f77accc69310e63fe48bc02b72a712791793a17

SHA256
54d8f0476ce396734c993015b99cbb0da0aac98d87ad3fd06549deb9b436ba93

SHA512
c8e2062b2a6e4b477b645735090e400c43336ae8c679899cd4c1c6901ca965c172967d178e11414557509deb2a138b0812e150999eec71656d6de631c233f0dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\12d3cc5505705796_0

Filesize
262B

MD5
ef9c67901b361d878f75b5b5c6df1422

SHA1
008be51becd38bdb016eb33a2ff410e3a64a1258

SHA256
a5d1605bf6977560737235faedea050ddb5a515f7ddae117251faf6bbded1a9c

SHA512
eba4eb6921d8868265d51590699b0eb53383e05244dc76430c0e80e48235a044a074336491d651e230644ced520ddd1457eb54cf3e14f6032b95c785c283227c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\132bf349d66eddc8_0

Filesize
262B

MD5
9d7ca981f2066afa3b725a26c60728bb

SHA1
e9c0daf506ae213c7602cf1cd76186511557a897

SHA256
82c948655bcbfbb89f2461a89a5f29fc41c1e2fa7f73151aa83cdef8433c99c3

SHA512
68e1603f2a8e012a37211116e78909fb3ad5e3e4e0e1c332a123fb696b47485e6bfb34372e8dea0e08b4cea07e4717e075d0196a3f2c30d62e24f2ccd3ec15f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
11e330c32ca1d20bc8e32d9b3e8fa36f

SHA1
57c70e2ebef70419b3f87d63483c84eb044ddbe6

SHA256
fb705a9ff216f75047f3dc55d3fb1c5844555916520b333f97afff3a89b881a1

SHA512
44f426bb2fb4d1278c9cbdec9c2845202e4f4945404ab632c744aaa96245214f85710b460c35649b7ef88d51d80f90636ad11811497541609c84cbd3fc4e6728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1927a26afb9a8b4a_0

Filesize
2KB

MD5
b962fa0e1d8fc90b60598c5b255f95da

SHA1
299c7f0d7376c79ded162e5a2e5218db1bc120b7

SHA256
abe87646aebc1ec6453023aee4b3edda4e17fa353834f887156f908da1f1aacf

SHA512
94452fa2949adea83ba7125515159521d685ca75b6d5f379116d7473026366827fd5d8296cf2f066e42c6e6d7c79ac1f0919c1f7285e771883a7323c872ec81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ba208775fb5fe09_0

Filesize
4KB

MD5
9089cad61c25b91527e94df1d39c2a4b

SHA1
1efffd81a4ff5fb43ad10ed69e4af3a4f0143d37

SHA256
d8333706b23aafc739cef6f781c1d9f5859c5e2802cc7c9dab77d7867d3a294b

SHA512
abf26e2269f7157241bdbbc64e646e25d1ab96c6b556b93379bec18699e5ba7b5dcb00da740eb757152c0199b984dd1eafa30b0179b03e6155d9f367b1aad13c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1c90dca226a21e1c_0

Filesize
116KB

MD5
cb469024275e0244759cd374d58d0e2c

SHA1
6966af4ec80d1822081309a4d528440ad6073d89

SHA256
8dd07ccb13f9e881a53f5da709e22d7d6321239c1dad3da89e19d05fa61cab26

SHA512
890dc49ec468fc8e7318a1a0550fa55ead55f64c1226ce0ac12ef12b5ada91210ce6757defc330f5dec38ab763a60601b71b8219e2628818c932396c0a85b32e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1db797eaaa9e8f52_0

Filesize
303KB

MD5
ef48023d935fffe69df5e0432f0f27fd

SHA1
a4dcd34a536167542c834d378f9e1576ea2fe22e

SHA256
2a321b082a894ebb0f718ae12d9706f18580bee135a40fb79d3fa64b2f940db8

SHA512
651da854399ff24319d82a3c3b86812dff31a2b79ca8088c81c895dea6203ffffd2bb40aab39e83082ca99604e44b5e96de7515ce5addc1ab567195f397edebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
3KB

MD5
2ba0ac1bba267d3f0f6fc856682cc15f

SHA1
e0dd2fa20326e696851f9dfffc521b757d10e7fe

SHA256
1311342ec453f5be33ce9deffe6b8fba28f162f3219c467f81b79e2b498146b7

SHA512
9160548bcc2f8e94e28f1c597589d8ea612346e40f4a798bd69db479683271ed3a629aa043f9475ccc1a41183054cf2db22d93a4ec538f042c1d26388c005775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3557d97bacb52931_0

Filesize
29KB

MD5
5d886f38948234a789b7fce3c54cbc5d

SHA1
f671310b62831d8793c0a9a694e1f5a789a486ee

SHA256
1e57cd35f783a6449cc32ca13094167ab0b7dbee0564ccdf6f1f62a1a854ef99

SHA512
32142d3a5f2e796c1bb6313f431db232af62ce30ae5f83b4c0999fde17c5f314d07e4f2fa3b73b7e77e50b5b7f495dd8be40f61a674ba8b3e1cf60d628ea09bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f02c4494b1a18ff_0

Filesize
5KB

MD5
a8c3c3eb4b08f8a4beaa73a5ed5c0f94

SHA1
a0552861e5a551f84e173b422de208397b36e58e

SHA256
ba6cce2f0df926f3dc0ae8ff0bd084080ff7a0bb2920e3e3096e938a37f6d87c

SHA512
7acbb82db905b5abe52cbc49db0b67f0b1b6dcf6e7700047a83a29a92f6cff6713b277574fc0cf60f5ca0e06ef91f70657002c572d42601bdbb8ddfae4c4927a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\43b50a61d78017f0_0

Filesize
5.2MB

MD5
f90caf210b25f0b6f8d22ef4d6067307

SHA1
32e891fadbea0879cf4e7810f2abd73f1be1eb97

SHA256
ddafe9727e6bc2008d87b4fb3cf5af3fdaf8b32439ffcf4611efd081eb01eb46

SHA512
5059e2c94f630f2f9df64aa799f14c16964c60cfaa66fc600abf28a2bf9d8d67dd428fbec4e7e1490395f8a3f618c8606f901f8ac81d7a6f56494367d3c54c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
ae7ba93f698968bd9db2d8cfdd20d97b

SHA1
bf8e350ae47fa1ec6f2da3479850e3c820ba950a

SHA256
405354c66ceabe4c26b4ee02a191428cd3d387f755b7882d4a805f98a5f464ef

SHA512
8caeee88d238a31e8dbf844c2f24509f13aacc3673d778f56b525b972e9f76f69472e379600ab2d5823670aa3ef015ccaab1348cb4d2fec2fa08301ebac30e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47d4e623e47f5bdd_0

Filesize
262B

MD5
29bbefe4b47387aba08c5f580d8d0621

SHA1
8f29cd70c2a6d690b06f52478a694d026c816b4a

SHA256
91c831d6f6b98527d3f36c0944178d38d9fd07c4a3c77a0fd00ef608d4e3ae1d

SHA512
f39bfa79e85c500c552c74b18455d95cbf02cc1e4202f46bb615b307e8b5bc6dd365b4c7c6ab7476a70e9bb750217ddf4209c18f66730cb29e6645b54113fe6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\493b96205c1ec74d_0

Filesize
262B

MD5
b8c946e79dd4177f152ef881742375b6

SHA1
f6dcff9e686cf2ec6dea841e1d7cf1c86dbc9d91

SHA256
898a92c6db3b69762a7280fddf86c5b221bd88fee5b74b3ea8893d064edf2031

SHA512
edf382f5db0a20f5a1fccc9a1c98df3a90518a2cf692a1a0d17d82d7c6ae18bd6366763f0922af663635629c403ebad90adb6d785cf29ddf3ac3d3b91befa1b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
a75c78e70144fecb3e584fd1b11ccc7a

SHA1
fd0a0ae0c080e0b12a213e2936673875bc7cad90

SHA256
52bdb0731974a1aa1281e5b78fd091a877863c89e4e5b9c3b486e65e2a5c51cf

SHA512
dd7e2555d1846ea07427425aa5439094aab815452e4dce151b3c6b937e3831c2684780b43f55a0e01c5626105eb29f66af8846f7755a7723dd3018ecc436dcf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54c70e8d154012bd_0

Filesize
36KB

MD5
12d5c5c3dffc2f468275943911e6ca27

SHA1
457388c5d910718557e3e41ba96aa8a217a0834b

SHA256
fd2e581a986c6f25c379f2da0bfd78e49e6dc94b2905982a164afbce80c90d44

SHA512
d77a945d856726afa3859fbe25f98e8b0c5d4cdf102db69fd117014dc8e9c5a8c364840f599d43cd18f917cf611c45c43a45f1699ed85f4b5e288208e39d1379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\580fd9376c2d4a3e_0

Filesize
9KB

MD5
0493f4803bc1bbb8e2a76415a26b3529

SHA1
0a167ab1b084d3f5d2152a0fbf7c2b39505a3b7a

SHA256
010b196e23bef32afa20657e42ee0336f0a8888230043d7d439f5a04aed7ba94

SHA512
3f263073df97464a9bab64e1ab00f3760133fad187ed8a3d8ebcdc0cdc22406b6e4c4c686d5f61a2687b30bb7202d7cab81e0e5b9ae096b6b6ea72193f13ad68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a994fe24b451732_0

Filesize
15KB

MD5
aa0ee7fc41d902ebf25fa5e9f6a7e7d3

SHA1
aae8f2ef92fedba53adce99d7cedb885dbb0a47b

SHA256
5465777c1dd90c8000f83f4592f6dfad5eced6333c48670ca34fac024a28f61e

SHA512
22b7b4fbecb35c6e25aadc4520d988313c661ced4a71d68736b861c3724e5bae123c7809d8bd2bdbc5f2c54b3a6a89b7f8a92b1fc84b15af9ef570565e2ef887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b2f11f3f15a5775_0

Filesize
5KB

MD5
385d481a9e89809d36bd01ae2573d1e4

SHA1
9373eef33d8a012d03091325d70bbdf7a977a082

SHA256
b7938598c65bf1e8ee4b1229732802c007c6263313ab7f9ca8866e808499b857

SHA512
3ee9e38584547609322e1a3d439faa2ea5e3fbc63cf78486acee29f31a6e4c59aafa0c043210c57cf7fa752faa5b6c58ef262f3c90044e30e230e49e7d41ce7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5c375fe6aa157b97_0

Filesize
180KB

MD5
bb868c57efde3e5839e93d0facfe6fda

SHA1
68e32f06b584caf76efe4539e5d2e915b746da80

SHA256
5731e0f5c7f3d0b2166eed1a6ed11384f8cf60550de39344378e7e296b72b30c

SHA512
3a99bb68b9824c81821f407ebc9e9d1566f40622590f627605059e6b5d1466622a284b3ee517d6b3c6e2c21ec334195fac7ccf49e1f4465fef3754b5e5ad2c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d0c04f9998369cd_0

Filesize
26KB

MD5
99966cb5741dedb570e4a7fc76b4b61f

SHA1
19df4864087da3f33eecb8fdf22977a09fd03af6

SHA256
0837b30dec4902db26849acd114161e566e31198bd0541ce4270a667385093b6

SHA512
f5ae37796e107cee133be595648fa9b8dd57e47ebe5b93912286eb2d30decf6e53eb4e26f18bcae61e2ffcb86e54a067a5087b5807c860bb8feb7cfc07ec410a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0

Filesize
1KB

MD5
d14b13f31910f7bade952365d2e92231

SHA1
ffeaf6a97a9d61cccbfeb99f78800ec379e7a471

SHA256
5aba2c2a2a4a604faa7ced03ecc0fc99c320616c3258ef10c1a384f64cc5944d

SHA512
c444f7c1d6070abe7f5a770d6fc1c22f2df0b7e8b7991688a5c4c124ff03676367f1647bbfc9f64742b525e4da91fd838b775846569b0e1c61c159bc9e077c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
2KB

MD5
2c0c348ccf423c1954f965fc3965a779

SHA1
df034843f851d61c36211dd6fb40ef5a80cae197

SHA256
e3313ed014c3ad2721209749a2066d59ef182df2fe4473e73791ea582a0373c7

SHA512
733a45016172a6de1204d4ff204b9467190f65c1664deb4dd313d554b14076f4fb89812ab2da4cb417c9c21aeb4dcc5393946f2f0df25bcc1e247a92b71075f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0

Filesize
11KB

MD5
ff9ceace7eb465552a360e1cb7550cd0

SHA1
79090de24439661d11009f8b48ca09dff9abac53

SHA256
375344adf5298953c5f96febf3417160b3c039aa816267e880bcecfbed34f84e

SHA512
390dd42b068a6d30b6beb578ceb2fb0b41d526b886075c7bb32b2a983a9e6e2a4e7f797d908c24357bf438693e74570d25ef49a23429cf7413e115c7d91c3c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e23bcf4dbf5c221_0

Filesize
43KB

MD5
e6d5ad1da59c7e306e36a3142eb88b26

SHA1
91b36191403c827bebc8b88eb8cab7d249e6e789

SHA256
f779558e3e7c0cb1b4b48e2b1a38fb604814c6a49469a39ba9da744dcd6da369

SHA512
0e1cb51cc27b80b7db8e78fa9564564a27b7a778d7475dae6b2bd2e7b3d0742a7833f70aaafe0d1e918e767d35d476311c95929ff11ff7b1bf773c3b4e80451b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\83d6d3a772bbc707_0

Filesize
6KB

MD5
89e9dfbc641c224d8200f6c4dfacd8c6

SHA1
0bc892f0874b3eb7fe5ce77cfcec3e057b5620f9

SHA256
cdbd8a48d19f7fe9cb07538f1f7cd12604b782257621f533a77754be635e91b5

SHA512
fecff8576ed8c00a52e90d67f7a83ecc3b0d54026e2a7b135e0ae16aba94e6cb49dfe716c9279ff6db0ac56b02f32d9a77fb441512ca95ef98d57760a4590c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\850edf9ed135c499_0

Filesize
291KB

MD5
6ff08529f41d055d6d1872a9b108c0a1

SHA1
42d6b2411ea27c811c0fda7da215d20015183877

SHA256
937709723e0eab02091c464f2739390e9c881f95feab8e92e7004b791d6ef48a

SHA512
94b0986c048cc3bf4bf58608d13200c36996afdadb4e7ac02b5d2f011d526ea14e09409dadb5fdb0bfbd96b0155356ce0f2b0940a54f821b7ac4135b6b49a16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ee73a31bd0cce7d_0

Filesize
22KB

MD5
dcff9c9640b38af2e8b0d078e8126ce0

SHA1
3f0792993263985b4d726ccb44790739cc329226

SHA256
7fd9d9900c935eae408c6834ec8ed0cec6c1afc78493fb4767fb406bd89dab7b

SHA512
a0b7fb3cf710b6eb2153848042cbe0705203fcf6985bbb332b139c39508f7dd2b622655aa0336d0b725e4cae7b57c3b42ee1471b0564db11999cb272d43f4039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
2KB

MD5
61f075210dc6454616d55153e77a4f91

SHA1
5d20b2fa33455bc5d6dd2e28f5b8afdb0a77de73

SHA256
ad91d325bf124ad82ba8d120a2482ce374e6ef296faf41e4378d5d18ff2962e3

SHA512
fbedceb96d6c2eb40c644adedc1cf3390d822ab59855b7f75e30cf33167a928b14decc84d08cfd456f0727c3e14812db48f1aeb40d8fea2e1fd8e36d2ef6a4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c0109f54c03223c_0

Filesize
262B

MD5
ad0c5c74bed3ede1beb83424b9a9d1e4

SHA1
08eda16800b3424eaf0b1ea5cd15fe82baae7066

SHA256
a8d7dff78dbde4d552afc34b0a9c2adeb4c94e7ade2a6fa07ba4736c6e9786f1

SHA512
66c5a16ed2fd8e4947310fdeb9af6c7ab9929108a9c5564ed10108902a74634f6ff7df1c85a44aec90428c0201ac4081cb13b65246c7ffbdec2a67192ed2d747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
a81407a90265b5617f395c82d181fb18

SHA1
1a01630df91a752118790850eac3f43f0494f9a0

SHA256
ed6e120735895ec66764e9fb6aef417578d431a5a32e87abb0cd3802a5c2ceb6

SHA512
ae7f770753709ecfc1a85aaa1d8911b79c5619126f46f5a8ff0bc8024c753b56f26a566fa754893a8f0465474ff866130236da8cd4a94b1d784d59fd7726e64a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0

Filesize
48KB

MD5
08913fce810ed6f6bba246b6c929564e

SHA1
3f38cd7406ebef8a465322b70904a68a3f98ed25

SHA256
c74b4cd27590328c5f31996d0cfa86c27bee97bbf9cc7dbe545c80d82e25ce44

SHA512
aa74f481a5949363defacc064624616b1f1969a3ca123f8fbdb61fb921f15d93997763b27f80aa41df9f5184ee5b7578f95483e7a407ce3cc50d6ffcc1ca2550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a0de1e0d697bfe47_0

Filesize
175KB

MD5
1be50f09b8df50e9afd0b6c2d54da5cb

SHA1
e44bfbd1f43fb635d5885956cb903f22aef971e7

SHA256
46343cd38066ce5f9eb1bb4fecc236defe23096b6f44e567e63f59e57e98e96e

SHA512
70342e6c77dba0f58527a0e69fc29247fb202c3e290e606b431a6915517390f0a56673fbbdccacf3f564f89d0db2073b83c03114038c7331038d250688addda0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a267b7c21d8b8c9c_0

Filesize
19KB

MD5
491e2b4aef758fcf207ac7d327fa996f

SHA1
189391da09e46bd0a86202113a13bd7f88bd5669

SHA256
67a94f7bdf23ff7c571d4cfd40149bfe149022dd13ab8ae0ef212ae7e1fb1cae

SHA512
55170e285f20c01df4943d566bb7e4af48148a1d3993547a67a01b6ec3b2b14fee14244b97980e69bcad681ca753262bfd689df749548883e2eaafcdec563d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa20c296787a3f88_0

Filesize
3KB

MD5
63368da8132158e3953da7dd8a7c3572

SHA1
a2dfe9c51200549b410c8928f76c5e02faab97e2

SHA256
ebae06f2d8700d7bb16e30e7b17cb960903eee75d76f9e5f93d9b3cee2eb50e5

SHA512
6cb69b1046a0b41439829c62d0b572d7d7af1e0f6fbe0a753b9d0aec857a8cad0c23b21e9f893f0195b521f7f03506099109240bcb3760cab14a21d853afb98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ac9b40a0411376f7_0

Filesize
2KB

MD5
25fa43918c7bc6cb807985281b129b9a

SHA1
8a46ba43d70cbd05b3e0a63186a9ac2fb2f160bd

SHA256
27a245b2d91602ccd1f8bfedf4c388120ad519947f18f413ee6570cc025024fa

SHA512
a663b81e11811fc76db01171d4f44856883453b2aac24f1eb54a4c4e47db3beec4828b188e03a4b5d2f2b310a3d20d8f937790a6c64f913c7a9ced2d0df0000e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae8d0b05a4b538df_0

Filesize
262B

MD5
9fa930f9d7fec6a1c7a0cc1ef87f68da

SHA1
0a87c050255b9a7c2836147d571cb6871cc83f6f

SHA256
c78f1541077162b8c6393442ac56266e6b8b7a32e6d4add40d76a116abbb16f0

SHA512
3d86d731bcbe8ad188f2d0e3c2a21fc27474bbfd28df05b282c680a8fc4d6a97947c0c61c076864de6d96877b370bf6515ba75e4bc1cec61490265abe94ab496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d7d09e2437e8ee_0

Filesize
5KB

MD5
1bb72bc6a08d9ad3975b1c66bb255a70

SHA1
d0df31c935d8555a25ea78ae2b059583be92e40c

SHA256
7bca722406d479906861c636e492d2f365b8b2cde71c6da4b13e860d64458831

SHA512
cd73e09d4e9cfebd9d35133287c995c883e771f29a159ee3e72604756fb1bd64482502522119ae3ee92bd5bab68bd3cc9d2b74d08b55620a5dc379231175e214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bdd8a4f7267aaf50_0

Filesize
2KB

MD5
ea7867307e9192c2eeb9b0e794fdd2d5

SHA1
533529b40742d4d3492115b836d31b99f16c55e3

SHA256
a14305418dff40c41b6f6c1969bfc71239666d0f93f565ff537ee71640960c5b

SHA512
a9c59e202235704775e661312c0768f7232612e65ecf8cf9a8c9cf6d2cae5af097d7554ed922aef508541f9eef6e63dddc2f9c553d0775dab68b52d39fc5455e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bfd9b5c29c5c8524_0

Filesize
1KB

MD5
a00b5a5b32a84356669d761e433609bc

SHA1
ee8dbf113a263f498bee821a1032f8dc0da1cc8e

SHA256
03c582d60743cc600f1f98cd4aa22e9fc12b2cd3cb36866ee99697ec6a0a2bda

SHA512
b48cce08fd1e306ca12f3f90314e9051bba3cf6fadee237119949b10979f7eb9cbab2de65411dd447ffadadcc84a70921adfa80b6a900f634bcc4e16542dae2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4545010b9c4b344_0

Filesize
12KB

MD5
3a5beea725ceac6b1129b91be0ff33bf

SHA1
7879ae29b96fdab97f5f015c2eea262610ab2221

SHA256
67a7342e2eabd9cf7853b92ba785ecb493de498587753eb0defdb5fac85eafd1

SHA512
00c537036d7b0a5d959ba52a1e23b8ad462284fdac230285afa5474a6c71a679c8516ec80f3053dc1a7c9d1a05344ecc67202b3ddcfcea448fe5d33a930b6ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3dbb3008455b523_0

Filesize
262B

MD5
13fd9c9b173a5cb53236d6835f0ff0b0

SHA1
477af6e82f6b5b9b4256c1ff529a4edf22dfb297

SHA256
15ed4ac46012f1977f151a05eb90c080e8a45564ed658fb2c03d5689c92f0be3

SHA512
5ed840933ee20262b9413126727ec59a9e71d1678f3ec698281cff14c3e15ac03adc3dc17640731f05e58b3321664784c1485181de2965f7e770c01fc3eaa4a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0

Filesize
262B

MD5
4ddd795fc25781c8aa1e074680769b30

SHA1
256fa0435ee935034902854eb0079110ea6aa51a

SHA256
8d429fcb2cbe177178bd57cfb96583312da7b2ac58f11e1828adbfd2662d3fad

SHA512
d957f2423b0eec0464a7987b926b1cdd80ebf369e2032103bcb3a38b76e0b45126127da0430350db74eb94a3d31ad92363423de5cc7ba3eee5f94912ef91f811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daca09b4eb185a45_0

Filesize
11KB

MD5
a1a634514f2b7b5af11ac4f2ade93b89

SHA1
3cd148aa8545834fbe9306fb2eafd2e2ffd6cd56

SHA256
0d314f499f4f03d89b89bae549b18316904307b91975a7f439f751ecff681cb2

SHA512
a87846a6a8587e4e11d5aa2e5629205d5f0b554f1b8927c0de7da35889d5ec9c754400c0a7737fa63cb15bf787f0415830ccf9eb3eb6a0dd26289d449a8265ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0

Filesize
3KB

MD5
2e60f90d15095515a6cbea9ed9060c1c

SHA1
a28032f8387543b921ba9e5bf133ae371fb94290

SHA256
b49d0d08e007bd375ffb635af38b34e14530ab0eadd23465b482feaceae74a3c

SHA512
411174eb83fa2c8c53ff2e72a41185b512c63790ee81f9b0c7745bb72efe5030c62cced974439e02ea3c64b98a3a1f95625c292071b978b1085f8004eaa13e93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dfe07f2c15075c28_0

Filesize
33KB

MD5
d95a9004699b591c478e306825399d7d

SHA1
2d9b1e592425d5b9216bdadcf1c79d2d62048c87

SHA256
7d927dde08af42973dd1a7b0abfb83d1ce82dcd06ce74853b34534ea9dae5ee2

SHA512
455fc9566d43985881a17aca326ba5f4ef550b6d88a8c976e232fdc2f052870a0e2aecc49dcb7606f2dcd314f11c81a83e926439c8f47bd9abbae996246eb3c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e239929a95f56ab5_0

Filesize
2KB

MD5
bdbc23e2b59fc29de97d66892d308017

SHA1
1a10a8e697b6a373f783f91a87766d271003fc1d

SHA256
64f1a5e25b2d367842b9b138ac8a2e23dbf7ac9c814155ecf2fc253ad3fd392d

SHA512
a1e116a880b4e77786836fcf607760c8a0d1993bc6c40d28f1d79d2dc69f12c94bdf95c37b7fa7d73a38422dbf4269facad12fa1ca9f1845dc9efcf967df0188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e504183595893c5c_0

Filesize
4KB

MD5
57a5594e5a9123962971c860cbd4dc65

SHA1
a6d55f7f212f468825cc16d1ec1afadc4fe24081

SHA256
b8f6dfb84451b5753143a1b42737e74365904508fba344cd6c213534a14876d2

SHA512
0fc0c66f122b10090612535d14b37be00826c51e1fb6dceec7800e9b56596f8cc9524e4f58c914049fcd517e59b2068aa4886dc27dcee1795f901f0bf7d5a632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
40d22f4a7ecbf9dde5b43bffce1f3f06

SHA1
0440a8ccadc2401505684caef6dfbbb4ef7049c4

SHA256
21f7e3eda4aba439a840e82590ac04a1f7da0adb0879cd63785fb416522ba648

SHA512
46878a2f3ffee58953627c568432b59e736c43316abc486022d23807819169d678e5a76a38e6a38f098548421cdc154e401863a642e753a662a10a92e79d3424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edb3b6840a8ddc0a_0

Filesize
7KB

MD5
c1af1324f3d1e8c3c873c49396b9737f

SHA1
76fab89cacd4cb1699d86fae411ea11bd742d6fe

SHA256
7f4fc75929481f5051f0c2569b81b07c6fcdbe15fc7728d259f68aca861dde7f

SHA512
773647262461d2b56cb010a9079eca1d427777960dcf96105cbd9dece79ead4212cd221e00a03cc49d271c57296bd8deeaf2e8d7a3b3049fd472a704a3355b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
c8e9e50a1f7fcfb9885637ae69295c33

SHA1
bf707a36299137f76e20516c1389cd143da3edbc

SHA256
d10508123b82d477def2aec453dec3cdcd6dba0e613d668b4338a7180b25b03b

SHA512
d0bba95a1aefdd7baebc3be200da5046c7ab353e942cf9d4c093179344e608d43cf8a99b84f1c3bb886d1e78353d038494b7b29d5d89eb4c0952a692f116aca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f89251fac2b69325_0

Filesize
3KB

MD5
f3c8567736a37d0876f75cf48184cbdb

SHA1
00e5fa2c9f532faca07a275c901e11cbf05f593a

SHA256
cbfea491468264a818e766e38c35fb2f706a6d263c1a515ca3d36b13ba7584cd

SHA512
8469448851f18f22050825267616d990730faf9eace8ac842f0fab80d464529b5c90b9515b7cbe9d6ce53f485ca686b02b97389d1fb326676e7fe23705b2e49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd8c03ae33d6972b_0

Filesize
436KB

MD5
d0da9c54c6f797019924dd105c21f18c

SHA1
a14c2cdab0053960b2a10e6b5c550f013eed3f01

SHA256
6a03845b8348c2fc621687a942ebc1ef005fc07312575821777212d0a38673d7

SHA512
25393eb5f4bf1c445be068aee8d38b767111618fead42df3593befe35329ee53176c052cae7d3fcc434f813dcc096739600a1d58730a2539dc174c634040998b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\feadcc6fa014c0d1_0

Filesize
1KB

MD5
9a8475f665203155861dcdb156d4eb25

SHA1
31e00517f5e7e5a0218e95243fbcd5e98b2760f2

SHA256
ad172b1dff239db728262665a9a5efdfe7afe1826e9a7e67355d4c1ade6a8121

SHA512
5b6dd8f97c6a4a8b1f7c7acb1ae932bda2336d8a091cbcc19ad1c0a82f2e4cba5ea2e99c35aa0ce82e4d6d1085376b65be21f80f7b6a5275bfca28a3460caa85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2aab3fd489879504db46ee5fb56a70b5

SHA1
204b08418f9690b0a72db82095605ba9a6c42808

SHA256
b15a83e27253a163cdecc5f4178fbe4d0c0948b65e73ccdfd3ff537b04fa1fdf

SHA512
af075234a806325bd1fac7232c1de26c8993dde610fdb865d0dff4dd7fcbf6cde416af58f4b277efc12841353af47f75e6693feb8eaa5069240fd5e4be4b4185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
761288ef5f721a28f054e045f3d9dead

SHA1
cc63e6f93c7a82b4bbbe6b31a17c59051e4f941a

SHA256
1ae89c29cc83ae2d20f9594a22509e1fcb14b95b51da12d4cf9397f275b7df31

SHA512
28ce979842252e759f19ea9b81c3573c84d1cbb95fdec2cec0055c083395737e498ebeb7ffec945d810bbc8fca3ff3346644d8e1d91fe5694f9a5105948a205e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4471e32569fb7b67ec4d28cad8f99f0e

SHA1
42b40197004066d445ed3472bc40fefea2ac5f41

SHA256
febfbb02748e9417a4c2580a349a3454761e6f28403318f93e460b879061dc7b

SHA512
dd975c8e867ff4f7cbcc1b737710295b7b69bc4469692da1e19ec57dd46b9e437dc89278d3a6b0b6f0e9b87ceb90ee73eac231565f2ba6ea5fff3439b7e27423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
ba294e3fc53d577d1f0131356f0cf2c1

SHA1
50cbd0ee3a13d5d00f14ac8aef389e38a5f7e044

SHA256
d3e2264ba41f2c2f99f7c31f2edfd13122ed36ab538b82f6719cea7b45cce10c

SHA512
d8341230a21ddde0964714ba07504337c4b156f7ac6ec77098ed216334363a4735f0576e438ff6d82659db30b919a3cb02a4e6ead239f49a5a79d6cc63d356d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
5de41d1eaf72a1de98b4f2312b7909df

SHA1
87ae6767876bec434011145aa4a42bd14ca4dbea

SHA256
cea83e260b1702c464211c79c0c818e0a62ea1e5761a817f1a4fccd34491881d

SHA512
800f700edb669cef81868ad5f915672c1d310fb768a97f2e43d12497c2ba2fb0ab09be22ff2ff9091400fbdb8c588859336af3c93306b6acc9d06cc6b44af86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
591427fe2ae24e73e897d8d75a598fc4

SHA1
a76b42e592d75a2bbc5582264a170d5090466a11

SHA256
59575d4c75ea0c0460784f830f82c4ad053efd7f797ccccf18a38922ab1a81a6

SHA512
2116ba906723b1a8b670e54f39074c2b0a5d7483fcf617b5c9c033fee099dba1dd57f31925eae8e23a4219882863e06bfd8af1c120e4c3bd581aac339a9c2f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2fe77a26e467a9b81e309278fb68b08e

SHA1
b0e4a9dd73fbe6301fbc595ccceb4b6b06cd5ad1

SHA256
6d04807d15c4e3f61b01cb93ac6bd5b728bda6c560cfafa5eb81aa3f055dee76

SHA512
f1b50a10df1373e84ddc4db8c0c4aa861681081618e92cf1ff0b07d0afd19d8f2e1a2b6864777d3de7b86d8dd480995ccb388191448f4c25048813d8a86e2b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
b1ba4f260a9f27bf2a4dacb86ff247a2

SHA1
912aa487855401f65cde236e136bb88a49f0872b

SHA256
df089b000f9571f72b882f4e0be5fcb1ce15c09e2b6ace885d70cfbcc4ce44f9

SHA512
a1372fd6b0598cac44384d4689109745a15854e7123d8879f99abf1c028c4efdc6f88836cf9bff50623c02020dac94d0ef4c547872e938b25e2e5e0d83c7be92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3aa1464beb45d53ded042beae0275397

SHA1
e1203145fcac46c18218764b305a5a3871da6389

SHA256
db0ebe819a44a8097002ca9a66c744a42f986348fd5d9a472dae9c4626acce0a

SHA512
88303cd48b2c98a5bd4e271c8eda7b0c11114becc7837ab9fe031c5d2aa1d1210aa1562b9410407d6031b7ec97ea091ba12873457eedf0b2a7d61cd2a8e2b740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
936B

MD5
8efce20cf03675a70edb67e7491ecee8

SHA1
de116813b1397ab8ca031d2764beb9be801819af

SHA256
bc744aaa0b17c27548e2b072e086e1ae0078b57e70b3e67c37ca802e04542a35

SHA512
a98dbefa5be29eccf06232948f7b637ab76ff1d7fed9ce9820bbf3a92b53bc0c3fb9ed10e74a7a170ef63165b7ea27d0c810b7e33af6885c7a103d5f04f79f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
19cda0debaddd833e7372073d9e7083a

SHA1
5382ccebd12d9bfb847698dfc069c722f88755a9

SHA256
ba30dcb74e50220a34674c620afe26f570012499eb0ff6a181c6e520be80ca2c

SHA512
b3246f1f73d7be668a60d61c058c2eb6b5ad4f6a61ad5b1aac30b9c39f62620822b459617c069ed173f62f6492a43d0d4172a25dbb8bf157859e4837fda3d3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0f602ebd97d77bdd000c8bf30d45cb4

SHA1
e1755ce4378c8248aef034061077a5d2f0cb289d

SHA256
13317cea9c11bb3556aef99680bc2d19770c9ba704a401865808ba815b944604

SHA512
6307f2432d11b156e8823362b3d2d0c92b597b5998cb82b4b6213c8961fe1323047ba8aac7acdea17ff671eb590f120d0970cd491ddc42e2a71c30970fcbd4b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4391f4d45c94c8d801a3b9dc0551948c

SHA1
e541bdbe091795f7201149a24c7a27827e339249

SHA256
77511dbcf7d6e7fe89a43b80d49e30c04d9263ed2598fbb118a10f924e8be36f

SHA512
80c1ac4964a48bd68a4938b65a53d696194eeba2c3a3f559ca136db984b5aa01b10a1d0411dbd43eb452fc7faaa0c770f0364605e470db139c4cb1abc4d76010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a7ac060a2fe5795d996f0b3a0055e38f

SHA1
c2710b66085f1b417ee9e4c0386c115570f6ee27

SHA256
b90621313442aebea31586285817f84806fd131c9d8368017e898692c50cd783

SHA512
5a3b05863c8fb49330c6904222306a47ed6af076b129bb4b2381dfcab9a9e6a3e69ff2b5c05e7d8b82faba4c780cffca501f77bc21900c63150d40385f030a19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2084a09cb506bf6803f772085f88bde0

SHA1
66a94bcb52bdda1db210f2f48b50d6ac82ac56f9

SHA256
08054bbb6e30ffc309b19676fc6192388b39f2cbbb4432f05a554864562e0ab2

SHA512
ac83be108f50fb3c2e5dc69bb751a0f66244d0459a643b138b2b85b28d51ce8276d90a3d2e7f239e81a5902e1dc22820b7feae923a572ad4bc5c252cbacdcc46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c514dd36d9e102d7a42ed5b2149755af

SHA1
f0c1efd4b537961638bab1c26a1ebf046fbd98f2

SHA256
239259d319a7435b4618148d66595a676f23579cb17d040b2a4ccc11e97420f7

SHA512
949881d76037a544020ae0d01c76d81b8f10aff24d05bd6e6d811dc26622e80fed5e8d78717e0434bc0b41d18ac730c08ba8f8efb4075eb362e833caead6314a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e90dd5182b2496fd5745ba6dd190936

SHA1
e1e86893f0ec07d0fa79697a826ce41f3c688344

SHA256
8088659c2698c676cc2e743b3f423202622765b333761760a09ceeb4a6889f3c

SHA512
b5d080213cdfbe3a1460bccf7157b24fcee4bdea2dab5c01a3a5ab70fbf2ba837b39ff5843858e3fbc9e87229db8338ec69361fab65d323aa9c74907aafd2764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c41032bdcb88237c3c546f3868c22f3a

SHA1
9a0abec0ac295956331ccbb1eeb0a299db410a7c

SHA256
ccb8e2f5daecbba0a21f53cd78049e5acdecd381c38b767004ce3387f6c22d95

SHA512
0175f703d63dd95c6e3f82adc0462cb5ad1584cef2ab9edde940ea998987411c34ac97b2edead4e3999a430f19b26b6295e4d1acddbee07b6eb13ef5c84e2aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2506c69086279e0a34becb44dfa11379

SHA1
88eac5146e647ba6ca41ebca1e7eba523f1e1c33

SHA256
6db93e7af592702a043f76d4129fa5730d7ca4c0bd6e95a8405a13cfbd7b6d6c

SHA512
dbf1f4a9d297e9d45cb594ab7b745213c1618a481a8cb9b3905b7002b2f43b891412402c6d5f80275483866bf6e8af001e040d3c8081e39ac451f99efc77d6a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a93658e1fe91b0131969b97710cd3dc0

SHA1
812a821982c58481088937f9e479e9e5d56c2e72

SHA256
32bf3d6d29a62aa712e2ff60999dd58eb53cf7709393b00ad2b5f6169a96dbfb

SHA512
0578fe27098884f7d7477039ed19c46a5bac8827683c7307e6939464f2c22221377c5c8af2d439e3c067997999e1f7952cc03ec78e44e443e7454979501f7c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
664f14278131568e0db0fec241754ee8

SHA1
fddbed3ca7872d10168c240bc53c1ec64c91a3ee

SHA256
0af38c8f51c1a34c1d0d6e0f01f4fc9439143e114d57ebabd933d02d1b60c058

SHA512
bc9ed107a3d0a877d22e587fad6dc0bc3978bebbd74c0ac1647cf8d2c0587e510cd7af1841c05b2c0668451e719e7906e13bd64f6d95ba5c2c7a04b12a52d71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4286ae1ba048b095f410e45f5e41e42e

SHA1
fdbec7fad9c6441f28740111bc38d189073a1f39

SHA256
ad04d98091ea7cca912650314dc290244c785f063140974d2c0ac6326403376d

SHA512
4b607da3756793a85c81f70dd037b1fb6487ee42f374d29094eb5c96d30c688592dec737c7549dbd703c1b2a04df268961c39c047d5d5053b8e9ae44294b262f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
63b52aa0d60654446e95826fd5fba6a6

SHA1
5d1bc7211612036126aeba7c8bb2caff6a69c639

SHA256
f5fd247ac3ce2ae82346e8dc4a38821c1572dfb1daeb6a413627da148f4a3e6f

SHA512
df2d2e3a964e8b2da2330cc222739f8bef90fa0bf148d6cfb49d9139ef3c63bbf16d95ba4a84428fd335ce9ffb93da6fab4a6a004d4965d6e10616cb7fdd5fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3084cd081a38e0eb4f23e05e07ab8022

SHA1
76915b6866c121a88e07d8d4953dfd867cedd8fa

SHA256
55dbc6fba6717ec3e1ebf438487743c1496545d1c864aa65611ef6e321c4f8c1

SHA512
25d7062548df89a96967f0d8ad3fc81c84721793fbc402c2c73a9a0b4f78b027203f8f8c87fb969e9f6a0e89cbe479c549fac1fb95a58a6df89bbd01d35dcaa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88192b3134b2dd848f98546d34ef5682

SHA1
4b71bd6154ea941c53bcb4da41d610e072136f87

SHA256
6bced66228325aaefeb3d7b5d0f3f1952767cc34e2105234df3e18b4119946bf

SHA512
0020d6be7f7eb66f1a8d902b0e8daa95c28c223d18bf396b748b6697b5342c78097720fa07052d6f5bbcf23b670643d5f722a44e3f15318ae5e12853c35ce587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c563d0e9b1f10041fb0d4ffd73e6bda9

SHA1
ad2b62a300676a1b6d48f2cb4aadff6e9b593e84

SHA256
4f7027fed068ba66b913a2720b443b039b5fea3f7c88ce8ec52362848364dbc0

SHA512
2b036f381ba85a71da0bbfbaf34e41765851e1b768f98127a75846debae4447bc4002d05213be9c8e5af57e2c410fc49e0d2c5a4a75500ab3de60b9bc65c7413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
af4f755a89d4e4a37ea68a257109e200

SHA1
455311e47e2fd8403904e154b1062f32b69291bc

SHA256
ff9d6880da4bd0c55852274c94d9fb3eb8e3306189a10dafbf5efea3780140dc

SHA512
91057559901f1cdb3529837fe24603ae93f80741b81307b00a17cfa76318dce5fb0dc882bab6196506f3c37d0c65845c3d4bd92a732c273d6d84574a58217681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e16aaa9b0f93c59dd365e3a20f209ea

SHA1
f364355747dfdfa118c8be7926487866eea097e9

SHA256
42e4042063078b87f12d6555e12cab3c35d174a3da02beb4498b56bf424f3bee

SHA512
de0dc189df707af931bdd4bc42a6aa748dd790358b672db77d43af60ea03624b8c8b2f248bc815cd08282d1fb67bd645049830015554a2452c0ef1d3a734c956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
93271c6ef39bdf65fb179e601c5b7efb

SHA1
636fb4feeba74fe37843a901218716697e38bac6

SHA256
97789171028b2ca8f21d257cd64d2727ef041e307c197a006c98f0d695e16d8b

SHA512
1b9b5343fe1e6c4b0778e683f8705fcebddc6d15ce8a6150442f2be6f44991f7e113cac21c81f7a96690226640f8c43e1c0417356491a2af547c6e7d4c3e1f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
39c9d055e173dbf4c3fa5adead580f65

SHA1
c35a4392d486610b901533152b7e09be792df049

SHA256
b799e536af7fd05feab84ccff7444501fd59a31036111e920b52d8463a29a787

SHA512
046468d5ed39ac3f5f413f6e234bdf651e280c38a5c8e3ac36385f7821698a377950fa8da1385d4acd9e483c7902a285c25e614159148723a40c09743d2eeb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\0503fc58e6cdec65_0

Filesize
2.4MB

MD5
a33f61f82a408206dc142146d8ac8db5

SHA1
c38e9cc5b01f170bdb8101be831c246bb4b7194e

SHA256
235db29c6546d5526bd5706ad14ef10561c1cc30f4ff5485207b20e5ef423a73

SHA512
eca702f4d3988f0a0ce55d8671cbba0d1f5a640c73731401b6376a9f07e507672e761162a7714a87a9d72ff817018c601ccab72ca195f7b9f41b5b5296d9bf98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\1ab56c1a0e22bfce_0

Filesize
50KB

MD5
e6de93420e2cd0ba4815fdc9deff8ea9

SHA1
4cf434bcf55ad7c4b4a290356587b467b16409af

SHA256
289dbc4cf0607e7259da6f8624f67f228dcdacc8073f06e7797adf8e74733565

SHA512
4b5557244e7be07fd3f452641c1901e3f4a50eb557c105dac98fe08aa9285382129cc1be48ee81108eb3ddf330c7bd400f8ea443f1478d6f575f99635d5f682c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\1ab56c1a0e22bfce_1

Filesize
99KB

MD5
e07058b41dce32fc0d2fe6eae1800c88

SHA1
1ef6f9ec4576be58be93f9972b43147183390a2d

SHA256
17ba8f1ae20e695a49a1dd6f30dfcfd2dee8c3ec3309cc4e05a6bf48aa6d7441

SHA512
f552462e2d11eff19f82d46405ee370d415d09b2432977831e0922f48824088c38df633c781d791cdc867b0214a97d7e6a7ad5d0abe0e4d4ac81ecb0a1479ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\3663f791edebdd2e_0

Filesize
2KB

MD5
4f407da7102084140a894a50353969f9

SHA1
288d0f114b209cc49549f4f78454db439977e304

SHA256
61874c41b7f755ca2a2c4f833f9cdde5f57ff9aad43525c92fa82f4366c58d79

SHA512
a68cdc73fdc1406e1a23199daf858403e75df94b6a6ae35ce0e830a4b08d8b6d0b39ebea1592a480599ac2865d26aec7a2dead60bb9950d78b15bfafe468e6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\37ddd14136433657_0

Filesize
10KB

MD5
ea0d460f3da0a3bf76f2353ad03a17bf

SHA1
b9dd31967f88049bb69510204eb3cc30ade8da50

SHA256
7a5d0385918b74a8ec18ca6b30a935dc462b95d0574dddc0ecbddbe7bfc058b1

SHA512
a9f2dfc9447767cd0958736e98a009eb62fcdb9bdd3547e11f1d7bc6aad1c0ecb2fc4473eec15b98bf5946f1974ef489a37a9ba1fa4cbebebc25b59f902aa4c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\37ddd14136433657_1

Filesize
21KB

MD5
a3436902752d92ded2ffd68b3c21d07f

SHA1
8f76a184e73797717a5443340a6e24d287354360

SHA256
e82093a8410c62aa28afb755f0ba655fec8c36daae2909eac3bf526e264676f5

SHA512
ddca3f8f9f71d27c87c897e94c34e6237baac92368b6cdc4da4dc97d78d540be8c963dae23d07fdf83ab6cdfb07f38f867262e9e78677078fbe533d7cf40eb5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\3b6cb30acc2952aa_0

Filesize
6KB

MD5
0edda5b20b37ebadb039fe8f40ff640c

SHA1
ec0176d53e9f0a440657f6823709ee4d34a0a7ff

SHA256
6a588f6c79ef8016adcd716a29fc43b5fb25c9880615002827240d8a4bdebadb

SHA512
b1a9493a547255d0d22c7318d97022b57831a6743b4b115302ff2151dc731e94e6b9db55cc8ec9431605530ba4d904b5cd2210bc206693758939f430bce824ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\3b6cb30acc2952aa_1

Filesize
9KB

MD5
1817c51f3e3c9d059510bbee267dbc43

SHA1
b71dc6599d766c5ce88b25f4f44646aca757932a

SHA256
7e5d4688e1fea387c7e3a5e9bd0538e6c927ee3fd2ca3735dec46a3bf7c05fb8

SHA512
536cb0d8d4333032396febc825a4d6b6de64aaa96a9894f0104fd87aa6b47569e51ec5b3e1dd5e1c041fa65489d2c4925e9b2eccb969440a22e706389aea7add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\4298346c36c4f951_0

Filesize
1KB

MD5
948449b7f4f4a9906d22ba95d202c8de

SHA1
d51020d4239fdc7754a4a450bd388cfcad9e0c03

SHA256
fb362cbfdeddb63a4ba47abeccdb1ad3399fd3dd4c14bc03ffe797f10cc42969

SHA512
c85eb091ec556224c6b1d014dcd4fe3ab4458f3323dc328451d83d23f54b3c84e96d600731fbb5d9f8ac7ac79b90aca7de6f2fdd6f12204f5051583ef7060b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\62368d27383376e3_0

Filesize
2.3MB

MD5
eaed9d66431ed67ee48125668223f604

SHA1
a1bec948dd524dad8692554ae1bd03b1970c7cfe

SHA256
9779343c54805d90f90b0c440af4da41796215c64f7d2eead29b2cb909940180

SHA512
c1b0176944d0693f15b81679fc25b3334dbc0c55e7c806daa33b0c12064d498b8059fc30325cce566d744f3dec536abd411c9a93e954f8fcad2a202c17f55b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\62368d27383376e3_1

Filesize
4.5MB

MD5
11be6513483c875c4bd72557675fb5fe

SHA1
2a08168a7026c706263522768ccd14954812de7b

SHA256
b44be3e0feb2cd17b68c122c70a550e06e64477cb8955886cd2bebe1fab2ac7d

SHA512
d50e882bededec7750d95d1eac33e03926177b0b0adbe948117a146092936ed972bb04d04d1b0d95f8b68357f5f67676a00f8c4b894f41cd09841992da832973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\6a4618160ca2ef54_0

Filesize
77KB

MD5
c96193fb4b704d622f0505546d583c8e

SHA1
b668be34c09d7bc5742c9cca19db0bb12deb5cca

SHA256
a984eb2afad322154784e67cdce0c956dad5158270c773a8f65020074a4e7f23

SHA512
6a3fbe98bae1a147c19d23fd60763f4b667f44c38279251473ff65b5ef1a0605ca5d966099f4a30458df43d3a6ffb009b53875aa8cedbf623f95278a625ac966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\6a4618160ca2ef54_1

Filesize
150KB

MD5
89cad28c0325d4ce92f0f68b1d2e865e

SHA1
0fa534b12224c2df7e445ff21c53bf27d367383d

SHA256
37f8db4c4fd9c41e2c0ec2e09c2af2a8d2a7dfeb5f5d37d0d1a54683962e68ca

SHA512
96d790f648c44bd62990404620c9698f19ca405f7ecbe696b17556c6f322199a198eba2d14831eb5a0ecfe4e5123eab88b4d3d3e55a89c0e6df64752ae925a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\7de807b86e64cbb2_0

Filesize
379KB

MD5
ba989fb30c1e855ed4dbfff9074ea90d

SHA1
08686e330f1cfbf59510b23cced64bbd8ee52a7e

SHA256
021e06ab44534b703663eb4faacc7a45081612cc988f5b6103ee2f4c4d6546f9

SHA512
a06b09d385118f433b000c4e6981bcc3bc33d7a409753a990a91412bd27202499351a67dbc25ad5019ee64b7233a1cda4b86e666a565a7a1ee3412d61813a49d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\c6c72293730ff76a_0

Filesize
8.2MB

MD5
11a44c3fca67ccd5e0b471b06ead894f

SHA1
b7adb67900b6bce7473d41a2f73ea6390d39cc3f

SHA256
38e4b91c223593bf7be4884d42c831b7bce164104601832dc02b5dcb5aeb9036

SHA512
df2216bf4f2e5f3e2d5af29a4e8698f80b48fa049d21e788a9806434be348fd4403aa8d0e35522ceb9dfd361f88869af82cee127c4531e143fa5444bc48b1b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\c6c72293730ff76a_1

Filesize
13.2MB

MD5
199a828bb3983c0d4cd90af792b7d183

SHA1
ccda5eff82e314ca89ccb8e713feef1c711339d5

SHA256
1efb782aec52b8b018dc3aa8f3f61705500f3ec57348da9c303b807348198db7

SHA512
909825ec680412c148b39cf813fc0ccbc068eaa713bf6b4d1189a118c982140a5d4fb9cab1c6ad0b07703109b68eeff58b2c8171a97ac848542a9cbd97c0148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\d961debb9e642c38_0

Filesize
3KB

MD5
322bdacd73f412ffdc1283b6f4141ca2

SHA1
100f60f33c98fcb1b2f0dbe933da79b7d9c934c6

SHA256
71e4524f820ca480eed88402c9b7506043f954fd99c52b218ec5be7befda6557

SHA512
e9172f869a2e7e76c154b0b0f20b02d012cbf78e53efce3e3650252bb838a236bfc4f95c6b00c996983a25461ec7c5925b49c48fc7e095d5197ae3d7ed225c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\d961debb9e642c38_1

Filesize
3KB

MD5
cd96ee66affeb94753ce8b7c918a8f1e

SHA1
3328eb1e777afefc2ea1c9b2248779174938627e

SHA256
2d9c2b69d60911d1107e8e8a1b92e148310c466a7d388b9d5962dce36f93fe30

SHA512
8713d7786f54b92412428ca98f223e1894be5613604b4c385b81382fd5051bda039a37cc4e35adfd7075be20c21982a5e6810a94abe5d06627a30ebe93430ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\e00dd3287821f94f_0

Filesize
9KB

MD5
0e0d5fcb2c1c144e3eeceea6594f203e

SHA1
8ff1227f5d649e30e6ede2a7c810700a300d442f

SHA256
2296ae9e10961f1839ba3b7d7ad4195bb4ac9cce07be1cd74fed3543b1b53d23

SHA512
913fc0b9fd87f2c27d21625b18b96bebad74de1271127299ae80b215ee41e235ae8037072c1c78fe3745f30851035c2d2ab0a6b2a0c6ceba6c109f583f29061d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\index-dir\the-real-index

Filesize
624B

MD5
cb700b9895077c50a415f7aac8a79e00

SHA1
61f4cc2fbbea598b310fe56660d9585c25e3bacd

SHA256
ec506466c42f443cd8509e3da2a20c47d488bcb7120eb79ca760e1d09956b430

SHA512
61c110a85427ebd9b82be9ad2693521ea12827e3beea8c20e38aca847ce6e84ee12c4828a3db4802f34c79b082ae4c0663d5f14827c7ed07a7652e94e071f511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\52cbd3a4-7ccb-4810-a5cb-0ed524c16473\index-dir\the-real-index~RFe5e3314.TMP

Filesize
48B

MD5
fd81e20308716cbcdd29494fb8bee88b

SHA1
018ee10b7396643ea6d4b169c5d3131ee2bcc453

SHA256
790f3ea23341ab520a88c0ee68a03d2576a94f2bfd31936602d55f624e88763c

SHA512
5b7658b6a6965de83ca7ef0f61a58aeb1b572996aaaf24cf859c05f77808895db444929a7d432fb510e098b6d607d808909dc789b9600179f52439fed7e03a39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ad0728ee-c313-4917-bc18-3c9df7b66f8f\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e02925f8-ffcf-4391-8807-e6ad43f8e0bb\index-dir\the-real-index

Filesize
2KB

MD5
f81684bf7372a2bf2ff2d939c3a9637e

SHA1
cce4901a6be307f8dd6be0f3976474a7612c888a

SHA256
1c5f20cd3daa400c267b63a8cabf827404064af864b2dc1aa9c878f6084fd1d3

SHA512
f46f8a12e7ace41717d667303b7660b81ab12f04482288735751a9bca51d594e6c697b83a5dd510663bbe5f86b58655d4a8ffb556769b18f54f6787f60765e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e02925f8-ffcf-4391-8807-e6ad43f8e0bb\index-dir\the-real-index~RFe5dcff5.TMP

Filesize
48B

MD5
3fb72cb7f2e16d2752ec31a64c447588

SHA1
354e9f4fd025ce624bff5d086d7c768c4415ebef

SHA256
45257d8e46e965e2a4bc9b4eec232cd9069dcb748215e9c17cfd6cb530c2157e

SHA512
3bc303ccb03eb11de69ce5152eee35cc9aa97ed2e2894767743a601cf915b2dfbce2c25b1e576704138d3b620b3a7301ae40897d90d70a1ffd9be2a201a9b1b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
4c5e360a5bbca47bb88fffc630e5b61c

SHA1
13d9be05c0ba9ddd09b50820eaa5051319ac2cde

SHA256
d54b371c1709cac7d71b17ab2ebaeeba162ac13423d5030cda676ec2480faca9

SHA512
e2eab8e7731b918a954fb14228d420adacd634e248264d2673515a4a6073efb5f1ef910e09a8452142ab46acab9181a05fa9570529cd1d97fbcf97bbdff3e5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
42e2d821e452d854edd129d365f4b00c

SHA1
d70f3f365853f7c98bf84156091bf0f279e5457b

SHA256
8240214e14f5f75c47e5c3a08c69838a272b8e8d90b5f8544a97d4e62235b267

SHA512
336e9f1d6ac7c182f69a1ea066de6d04007d21bbf2e1c5510aa7bca89676dd3855eda7fbe5065ff35ea67389c26168990846b17a2f1732225029064fb2a9c83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
d7f1454710b16af16efa49adb5a5664f

SHA1
d619fea930159c2b054b3045062be2666011e345

SHA256
9b5b56e9be5d5145413e81d74e76bab491549414168e57b941fdcf7615e2d380

SHA512
a7b52d329e82975bf2ba5929066769de616b5dcb2180aedbf67a3419388a1ad5efbd8106db193dc1dfa5655686c57e7684e94266acce277b75e876c4c0d25a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
a607c55f97c04cb8af8e2ff887baff2d

SHA1
fc63fa13a6d34e10356aabd6d47a4cfcae431e1f

SHA256
f63e99cd40de6c255372ba9fe13e042b1ad6dd466c408255ede5a88e62d72560

SHA512
01c53f24cc1814bf11bd8b5440676b29d6b008b280761a5ab13ddef7608abfb0e491fd8f14c417ef62a12bd454fec048295d433dcb1eab430e626fd4db8335ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
1396da28f771e59cdd5c98e68399d1fe

SHA1
6694a33ee56ef1779daa865d9ed4e8ce302a0845

SHA256
eab3ec40586d8a319e9ef3eb159ed887f07dd9c93b21f62beab03b90345a4981

SHA512
e551662b78ab2a28ce43898176d1040580b9c91bebc2b9f905bdc8b125893bddbfccd6fd450bfd7519bdc0e1bac7278d43b8d4d486ad91a736be13eab8c63cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
fea6ae124f2639f5bd2387c7adb26a2a

SHA1
e08b5061a07b4e913b663602b00b075bdfce08a9

SHA256
7b00e2397a0690c88aee83915fe6eefccb1c2b785a1f03da8656a4d5a0348e2b

SHA512
d5c0ef0f233595160f146f2c35b8698bebe3bdc806a434f7a428294ada4c0b79623d490b0a7589ee9438b5cb20b8eb186f5703a3ea2039ca3a9c4dbf1166f7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
1a579ce6c43d5cc6c563c5f337165a3d

SHA1
85b0693e0711553c9f55386266b3584a5b35a5b2

SHA256
63bc2a281658a50f8e09c2d8e9c8e41b6976dd16598abfa9f0b752ee5a9c2b92

SHA512
ec8257cc631f2933bef31c648321e00eec7945f8a52a3d26dd720fd57a17142b97a55c43b3938637f97df5727fd19464de091f71138c1c60a0272248a3675687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
b0f7b757bb383d07849cb9222daa18dd

SHA1
a77a72ce67fb710f561f11d87ff936138b41be9f

SHA256
8030626677674495d15aa1f4e09e48d92e50a758defc1b606beab10128a2e51a

SHA512
261cc9d8b2338dcf18b8d8c643c53909f04ed4ddc98550db0bcb2d3c6da3690f72fd6c409cb75fdfdce5420791f35312d10f2e1a5e9e8e4b0f766b487aae9711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5dabc3.TMP

Filesize
89B

MD5
b1ef10a565a5863f7e84243ced0078ec

SHA1
b51efe0e7c53bf3514cd7f0d94bb5d59a5d71d49

SHA256
ca7cd5ba1739cf2834874220a1fe0fa38bbffffc6ba1c2622f46ac6164e66053

SHA512
892b17cb1e6dc6675a3f81fb6802d36e4ade696947e5e00ce8e584e47d39fc4e9fabeb9c79ef8671d4190115bf30c643c32e72af0198677c2af27e8986fbe3e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
9ecec973329655c537ae813c93e087da

SHA1
cc1cbc3dec77962e0f43a0c8a6e160633a33bda5

SHA256
3664ec0e304cc4fde968544fc15807614c17e1fd443cbbb24c4a2ecc76dd2fb4

SHA512
71d75ce5971c2ac7ed995b5f38652078b97387baa4b7f894d35687363e5ec22f14727ca5867bdb9fc61c538a0ff5e60c1695e8bbe2127c69a6f1df8f5f5bcfe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e2578.TMP

Filesize
48B

MD5
93868dea28484030d61569d203d27251

SHA1
af5810141bb013b65845b91d6491484af5745239

SHA256
c8457926d36ef4864b82b394aa9398d89ccc939c7e31ba44886be9b050e59459

SHA512
e2df98b834950a508dd20f098c8b9231b27c1bc751c2328c96de7dc7a374c937ce7681708a5b56f631db33f323c9abb1b1fc2f534292adb92a43fbfba2d5d99d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3dd939eae24802d56860fa6fe8ef011

SHA1
1563d4c8f622ce0eb98d0e82dea40ca6e0cd6a76

SHA256
0c09c9129f8f575fd7179f429c2f3d6c3a26585d108188b32c7ff417766c7d3d

SHA512
d8803329b40ddaf8d8084844b309809fe8481146d1149177d6cf0ed8c987a67592b342d3c0a51a9d7864bfd6e8869829f2c984768644ba587fb51b8b06eadc30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce3fadcf60e7358a271555e2076d2be3

SHA1
72716c6b5b065854065163a4d8c169958e831301

SHA256
25458e1662124993f808af4b3d2e806a5956de99ff1487e52e78331dbe607bb7

SHA512
4b416d709328dd5fdc72044bfa57ea7a1b6fbbead7c2dd20215e41f5b74d374d5b49cd98a5eb2bcfad3f08ee546b6f75029cd55b2fc19f408be243e877fed96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
587af50ff5a246e598d322b4c7763ccf

SHA1
218dac475e799a14f9f5461abe90dbe9593ef546

SHA256
d2e4e83fec9f3911c6e03ed601d8cae3b388a55efe8b3ff1a26bcf8985412c5f

SHA512
b92286d8148f8a6542b63d214b4f79114d3d27c0dfafa9767e7d0acc1162fb114c5eca59ba6d5faa2858a2137aef39cc612a12845043a293c4a02a866a1ae837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
347c9dde845ced85b13fc6e4c8907949

SHA1
4ac3eaab5fbea7d00d9391b33f2924110ad7d9e8

SHA256
30d60d345714e7013df41c9c447a7dd0a35a404f85145c49c0356107637b27cd

SHA512
bbfd7a70a239b2468578d5588111f9a70fa83b4324b379106f1ef9855cb5f43a7d4a7fb08beaac81279a272dab1e257d5ed4bc548400ee08218aeaa2a4277d30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6c77581511b13072d58c6fae6b58e0f

SHA1
7379877cbb9cdff168e32f84f2432489d9f34ebc

SHA256
97e4230f4e1b8446637d7465d22da045de4c645ee19bf7108344b496029924b1

SHA512
c8ccebf7beee36545075584c6ba1f1b21487229f7482061d0d2e7633bd9c5e61cbdb2ab3984b6f906ea3b45d5d1b7deabc8c9469386066119c25419bcd427d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
54489008eed31584cb277be90dcab7d8

SHA1
8980a1a54e74c025cb33072479fb651d4804cb76

SHA256
a2ed417a8056986134004940cab98055689b65fed84c4ea556c956ee8ca9683e

SHA512
c65dbdcb8f0d92c808de6a71b46bdad243f7499dcba0af7fb594d55a40f18783253caa170839e694012943a1124337f7f99d8027e214022a283e7a959a3a5f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
29afd61b42dd8bbfa80655c34b6759c4

SHA1
eb366514d56f7290be981b45f91ac2d6adb6707f

SHA256
ac2c10569e7d16d86e37892a9c3636389086b14c5b33fc7df9d7a3f6a491d894

SHA512
7ab3be6f8e7c7935012ac56b16fc650c195f7fc6f23d8b2c5125d5c53cc85cfec842d568ed9a6825ab18e99c4715d89f13e53ef7c779c286354c60326190875c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
575ff39792b26f44335c5cb0993c2871

SHA1
eaeda3f2017aeaf62c1fa3861a634fe39d2f51b0

SHA256
aa1dea685a400b2820b63d4eabcaa9b84fe58574e067622cb053e69617b90e19

SHA512
186056a75a668eb0fe7b193f1e912da5c3ae702a4e7e917f55122f85c3f2c6f67dc80df21f32cfa54894571e93e6f2e16189f56b5d233c33ad9da1aa1576c2df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5feecfdc8a31d06f92b345295599b96d

SHA1
99376cdaf7c13a4f1419125d703859fd8a83c049

SHA256
b51ef1d4be9ce7017b4bf323d778a3acd284de0a297fee345997c332ed0e75c5

SHA512
ef748558e1fb387045ff02a629fd0b3d101bf2676080d20fb68a7aedb2ca193d365b98b0d6e7d03a1a44552d10c11c739ad603f2e40107f5dd2fddfc2f078add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bde510a5c9b185b35ac481f3f918a1a0

SHA1
4438beae199006219871378f27ad20a0ba7e1fae

SHA256
6b1e5357ca5c27875a778383394619d126873d76a6d5245652772b7d39f48b42

SHA512
f17154866cdd2247689d8e69b848b69d73acb5550e6a143487134b5953d28918152c9c3e96470be5ecbadcb3ed5d2be6f61f7e9bdb46e008a69def5fd00c6df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d5b1da440ef7012d04e7b9246830ce6f

SHA1
ddce3631e1436db27a0a7e1392a755706b2d0e26

SHA256
9e00c28af9d0b59a41085edf4c1de0587a5a5d8bae43c91294bfc1121973cc35

SHA512
e6ad882896ffceaf17ab751a99dfe7feb7388fe9329816b33314a1eddbd910698679ad5b9543e8a10e4d2037da426a7cee850145167bb5b42eb3a7b4dd4865fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3912d719908e550c6c89e9201f9d4a33

SHA1
ca4c308f04ab52e2ab1833a6c02bb70308477699

SHA256
0f8d34dcd7b730b9e1d661c8708a0b2e0e15855cb07c84fde1af58ef94b02853

SHA512
5a7e064f3576e33f0c03bb7e9e94790010c83538d1579404f9dbb905776593f892c0d5cc805b3e272fb6933c64b30d927fe083e05d95f1bd7ec258291b7d569e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92d285de71deb9d7c6f0213a3d1c0993

SHA1
862d46b68bcd8e2af34edbd22b94ca27e53144fc

SHA256
41f39bf482b78fc55aca292b54a92ca97407848cef4b39347a2eab2b6317aa84

SHA512
b34e762770d3a213afcd294240a7af1d69c2baf29ea42859a15b2a0a1d2a2cd397ea2d4d7f5bafdcd97b1b48b6495c49a54f53d9513346ee498cf5a849ba1497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c986dab743df9146437b71abfd9b3e1e

SHA1
4c19ed83f680619332aff9529d9694756f2224c6

SHA256
fddd3d9aeaa674d352095760269bd43a7180a1952aeb48751a7805eb66e8b3a1

SHA512
5453f53d95945167ee8cc671188da58414a341632652ad1a14c620325ec61fb6ebf3ff1e15283f134b35b3903978b97e48c6d4ff28f53dbdf555ce5af7c34e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
73fd5ea6af885d032af967e493de14c2

SHA1
23d65ea0283225c605df6d55e043a18dffe7ecb0

SHA256
851064434b527661402f8d9dae2dae7f7b219737492b13fce663191d081e0161

SHA512
76ad9af6f71bfa926477f0e44254626a4be765ecc6eaf0da6b19adbb7b1c926f77279329ab9b92eec36873542b09968ac0b8a082c288bb8034a5eb37201c78dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8a19080546630eda224b8a4a67108208

SHA1
6c02225373ad9897946d66d738f10d0287f7ba93

SHA256
a3cff135f9bd28b2d4709ca7ea3981b737517423743e919f2955ae3fb867204c

SHA512
67086e8c3763e66e481510483301240bd87543b1038776f3332698736d69f4213565d70defadd337072e652f4283131d3c6aed27aa25e850e06a9da0d0aaea85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d27b757f64429a04509e6f4b723e1876

SHA1
66c79bb419f3d7d95ee0cdac860e4b2da38c0930

SHA256
09da3b6d2a3de0931dafc0f44b551444a6b880a017b76d994b52bf7f9081fe06

SHA512
c4b3018c9ae3f62a66794f6a81d6ccfae41d36df0ab53628b1ca891064b32fc7d73e59a0286afdcca33afc51262288b2585752817c02276c4ba7a0f7718b3355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
679889a44561d8f675e1d2d59898f3d5

SHA1
b0d915dee8590371dcb80556d61479a1b7893ee5

SHA256
8a07bb5b1010cf8149175d95180cc870d80e616a7764920c92d75b3cc62fba61

SHA512
8177f84b0766daaec50755f79dce5444e653d2a81ceb8e2a2c3304e08c439184790b1e885735277f589048453ee09a5ff4721fd88b11835414d062e921cc5c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6bbf286c3f6575af9ae34544e7ce5b8c

SHA1
10a42820515a38722f84a1af1de7411fb7c2f760

SHA256
4940af206165a2643e4ddd839eca0458bfa75501cd616df532bd167ac478bfc9

SHA512
f6f0eea50134c4706d0faa63afeda0cc3049eeef89ce48d9aa038fded47f3e49e3ccd633cd6b08f222b406d28f7bf437cc22b269a38e550fe1f214c4a89b7f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9d16357f5d2c0b9ce4656a223f5c0ed0

SHA1
6cd07246f3891145dbd0d3959d1e38b3496a1878

SHA256
9f47474632e2644a4426a9a161c2a7391d522f70383b019e242cc85066d024f9

SHA512
bb847026c16481219b54d995431d04a1d177c1b516ddb11a563a9aec60722dcfd9e83ae5b302a6f82bc47a614f63b9bd1dfeaa102da4ccee9c69ece702493ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d1ff6f0d0e88edf3fb4c5e920423293

SHA1
ad699bd0d3de8b721bcb34af234a9b6e68c87757

SHA256
6ac981015bda0e27725a6da6f79f88fb255d907222721bb059073360cb17411a

SHA512
beb8d848aaa6834ffae527f11d3f857369e26d71ecd93bfa07b3fd1776968446e01ef8513117a41e97d09b71b54a87a25d715c13749d9537ed94bfb695051c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc08058b7ce300bd480175e30787135d

SHA1
b41371d24d098b5768dae41aa45f1fd5e7da33bf

SHA256
07ff4ee3ddac58e9a653c8bb2e1c58d8b2581369a27cf77c0a7e51650091281c

SHA512
3b542b99592a765668f505fa06d784e5a4b8b66c57421ee8544a511ba567523af355ea67244a7a0cac24f16f678ead7c8b890776307ae4b39fe7b5d49eb3a2ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c2edf81aed4940e2a61e482a1c04eed7

SHA1
02e4ca93ecd025da29814b57466e186f696d2d64

SHA256
be3c25be61bb41ff322b5ae51f95c94ba598828855a03f0a16ea83f56a166c56

SHA512
2e335006fefc9ef21684ba53a7ddf7e86adc897048dd8fb1aa89781b63ef4d2a3d414402ddcf56bc27a9e984cd9817f23d3aff300bef90b27f8d4d0c7f675878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f260661b76186f29c1702ab7ae622eb

SHA1
588c72146be76dd97909fd32d3c927c04834e3fe

SHA256
522711c05b70a3bcd4f8e282816c44615976a02733f8a9f8b6f4e5c19eb6d13f

SHA512
b63da53208d38943dede869c3f903bfc131d8ba934dfa6d9d16b5554c5c8950ffe2862de268baf483dbc5e80bb01673971052b978a915dc9d5f51245708fb677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ef96c3f90dc3f928599f453299c470c

SHA1
7c8bf3ecfd033101fcd9fd3e54f547028f411654

SHA256
675b77117dad7f5d6d150ac814cf28b54caa97b6e0845dde3bb96966322b5491

SHA512
8b07bf171a40fdc56289f0da71d806b46964e3a175079bb439900f0362979c84394cf43aebb4107a9377afc1b3eadd5cdb30b269b8977cd542ca4e99501f0372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21d766cfcb02c723b5893342232eba38

SHA1
6121811a653a3145cf15b9e08f2de1c0cd843dd0

SHA256
f703b00c9af465cb3c504ac6c7c45b8cd12b73accf244204198a30ede002a09b

SHA512
5201b3afc609be508fa2cca55a414db12e1b554d2d53b4ee429c1708731f50e5c9e0c35d38cc17e9936d6a544c83a6bc68f86d34d8c4a206aa60d15a0a9c0437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bce64d044706331dac0e740448c043ac

SHA1
81dd7453306d33ee194e6e648cdb3f23575265c5

SHA256
dd726a236b5245e49dff594dd160a0e9c5b0f28bed83b309bb08bc1819ffe3d7

SHA512
e90bb9f749d8b26bddfdc6684d3417a326874763d3457d9e5326940d81e3e2ebe7f4543f2bebe40098b19f9b34d4b22924295368593d23c4806cbc0e356bb486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8fe0d4fdf450b8b4073f431a4e9e98cd

SHA1
43e57809e3f34310d2fa4cc983d9991679f5ede0

SHA256
f6542f5670022fa748314792adaaeb2492d5312f0432a1a0d677ca1afe5b11a1

SHA512
bcfc7aaac7360fbebcd657f26a28f0a40dc2232871d86927c36393085e40350b8863ec95c3aefef4d09ac2b9bcae9d44227ed0b5ece25d37bb3414176ff6be76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e4d30c34ec152d225eeac2f6d4b29e2f

SHA1
5f27634383301c16cb8caa2d95340f17250ed467

SHA256
82c55ada56e20ab0fe88f643da541991a90cf32d2f182c98c69712b144c9075b

SHA512
b7a0ee721268803e1864c0bc1658101f41a8fc50ba40328a704d57043368ed79b87dea3315f09eb2f2e6a6de1e76d4afabbd7d9b971e05dfead2da277599c63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584b0e.TMP

Filesize
538B

MD5
8de6e6466dd99a16a8215c4569f5b4ce

SHA1
7ed1938cf834ef359d87ddaecb87c23c54f10c50

SHA256
12de8813829b16adcf3286e0762f9e1fe2ae8931a27f391510a04cc8df415ee0

SHA512
27279fe224eeb472c7caf2aaedf63e710b8212829e2a65890c6e492572686f782b08ba0559c7450c610697570d50b08af39a254c91ff4df78d272046c9e05d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca227de04976c1227a0ce902c37cab5e

SHA1
62630c70f3584cb259979fae8f207a9171479c44

SHA256
5e73ba3449a1bc946fd1934f894151f966a9d03cc67f5ea9ecca15bb71eaa718

SHA512
c5159d5928542bbf11c9590aab217102b2d80f236a29ae781ed0bb4087170b0d6888813ab45d183bd42db1e7efe080bc0707ef4e9cf9ac1b278a279b3eda7a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
48a50351f689e46dafc6dbff9b017564

SHA1
dd8050efd0a1c16f3e9a8c11b66b3d81b1106456

SHA256
e6bd46ca012c9b39ab0fd463d5a60eb75975aa50d891929b7ae52b2e66baa6c9

SHA512
2d3d298f4ca32fbbc403d49717004573796e3851c0ec79001954b22dc4cbf22891ffc0cfe45b764f65c41c69575a5d4ffcabb15b68b1a3013f736bbdb530d7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
44d5106e34c70f166ee3e98e1d0e54bc

SHA1
6e16fe697b49bb1e724580c67d2e6af5e32ffccc

SHA256
b9b93158c85a4c52af79e29ccc9d718e757512e9a242eb67cb6f5df24f7ce624

SHA512
e8342daa56bb33432330bbe03b0965d07922d16cf5a1d2139fb9448f8a491dfacd15d34985cb71b0a020f7fd5a162278559463b25eec2d0bfb4659c21bd0b1a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c93aa8f7b825e5c1514618d43146337

SHA1
bf5491304c46e2bcf7fa62be9b43636bd6f45366

SHA256
6c967d826751424767912da5f676c06704472a3800a10dd429f96c48440def65

SHA512
51d1f51bad409776e788f5f554ec57792d91d9fa6d52b4e975b63b6b162958d9ea7542a63401790f7041c341161b14e7b580ec1a7feeee1cd0bb8a59f3b21ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73d4d744c192910b91c2d256b6326a3e

SHA1
f9175e8be80b783e229a8cc51d3b2d2fd2544c45

SHA256
d18dc56b885f37b30393148854c016aca28fe4ff24ceaa32d476de4dde3a7b62

SHA512
c1bcf6773f54e89b17ce71041a95d435e7331e7cd92656f7cfc88de5631280430e332127bd3c0aab55469aa47a7994e87ef914b3d84546527e84a219ab3cfc96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b6d6535afb02b5b9ec934e34d194474

SHA1
9b59347227ac2e8b7cadd3ff72e1b9ccad39f4da

SHA256
f459c2da0bed3da0001cfbc15731721d5c5d3622806c8d6c34a586f6454d3378

SHA512
4b598f404e495b581baa36b8100124f35f030324c141e3a4596c6cbae54256ff9d2afb62d1b1b76fffbd70c69ff5eca186b947ec49ae8613bc57fa93ed149ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4872b2dacf22c71f8cd8acdd9c8eca37

SHA1
2c475e9b3244650ec22d72596c91792a9e3ddcac

SHA256
899bf3f398ab138461cab33c076eeab502373d51162bcba9088def1a83cc3b30

SHA512
2e994106fde1c24db8575a2b8182f4424f729eacc0d74120047ba8da2a3da69809410761f1e0cdc470941e20284507639c8654e2d70dd0a8e06ee3c20244107c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
439902c0fbc51511fac991211801efce

SHA1
f7468a0f3b0f064dc4b9687dd36aa3e2be1c3aaf

SHA256
3281a3b53954bcedd88dcac39991881fb753d488fc9e5fd2283435a8971945d3

SHA512
46fa2e033cdb14c8aa744ae74ca1d730788397088325e243b03db971cd6db0afaf3c3ded98a0afa0131c5fbb0515b512273fe23387cecbc2abf10975931e09b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c38328491a07d89ecacf8e3ef942abd7

SHA1
3e8a0c5436b59e88eaa138d9aacbe677815fc513

SHA256
70aab711fb4d16b2a1d0550226b241892379b3143e36af2c9cf41d06661e2b52

SHA512
d097bf56ebefb78cbd822cbe8cfe5d80218fb8acddfe90ce67fae5bfad88c21f4c02ca06719232a382c2511a119d774bed099def4c269d85d7c07a99b00b8c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed7a44eceea79628183ce15e16c9c1a3

SHA1
5315710c137f778ac7aecffe3616bedc6f6db749

SHA256
be19b469906359b81e60a44ace3d2fbac2b9a903cf69b9666934dfa76debe5a7

SHA512
99c8c3054bf31909d3b9471f42505f783e0982d607ac17de0867fc1f021f90582f563cd9f750c61ae18f5a04a66f97a052b6190e2b203db568998d8d84102492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8793e7c38070f0bce0e0e3021a3ab426

SHA1
0e6c3a0233601e452da468e79bd280748551892e

SHA256
a858e49fb97fdf2676e6f531a4feb30f177b13bb912815ec799ff0b26c052b57

SHA512
beabf1741704ab255c3095ce0b104bb123bd07df616f31bf4392a04fd557c5e3154023ed743562d527e07113a97b02ef115ae7beaa1a3b6b57b5c09a566757bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
cc6b3e88ee51b9822698508f9979c585

SHA1
b23f3e7d2636604a9334c0e17baa4bc4dbfefb5e

SHA256
3d4e3833ad1a5ed65cac0346c7bd5b7e08c53197e4319f3aabcc81e6aa24a1a0

SHA512
81a8220312b6d0e0019e4bbe0f093d9c6066f62e99788219d63c0c4028b66009640405d8c89da0e85aa8fb49411d7ce5775566ea4a2a01eb5ca3741c93d71892

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
2a001896b55e597963b2c108269782df

SHA1
1039cec3a3a320e53fceb8e26acf6518afd14588

SHA256
2520406e4377108e6dd312e9d0bce57ebf440f059e33a85cc51ca18eb22931ba

SHA512
77b3aea7ef0378aa3b5e449904e77a5d2dc8e4ee635732c8dbb408374c9448b5d8801c7648cd290c9ecf97944e4fcadb0e41e8971e2e415ad6bb27f4fb94b15d

Download Submit
C:\Users\Admin\AppData\Roaming\Qadynu\alryf.exe

Filesize
67KB

MD5
0774b151c1bde50299777fadb68fabc6

SHA1
5039fc0520d058f387f783280014f39b4ae8302b

SHA256
9b22013ec3d7aee309e37694c2d872bd1fb173ee8762bdd5c834e087caf2af41

SHA512
b66d840a03b4dcf36464f00d5ef28070cb4a2c76c8eb952b32e70fd48bbeccb8c6ea4651fe41844cb5a9b47a403942d7cbe8fabcda07a16c45f3b6f41c6b47d4

Download Submit
C:\Users\Admin\Downloads\Ransomware.Matsnu.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 111095.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 421543.crdownload

Filesize
129KB

MD5
0ec108e32c12ca7648254cf9718ad8d5

SHA1
78e07f54eeb6af5191c744ebb8da83dad895eca1

SHA256
48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

SHA512
1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 484286.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 632362.crdownload

Filesize
111KB

MD5
9d0d2fcb45b1ff9555711b47e0cd65e5

SHA1
958f29a99cbb135c92c5d1cdffb9462be35ee9fd

SHA256
dc476ae39effdd80399b6e36f1fde92c216a5bbdb6b8b2a7ecbe753e91e4c993

SHA512
8fd4ce4674cd52a3c925149945a7a50a139302be17f6ee3f30271ebe1aa6d92bcb15a017dca989cd837a5d23cd56eaacc6344dc7730234a4629186976c857ca9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 75306.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 773901.crdownload

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 858581.crdownload

Filesize
373KB

MD5
9c3e9e30d51489a891513e8a14d931e4

SHA1
4e5a5898389eef8f464dee04a74f3b5c217b7176

SHA256
f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8

SHA512
bf45677b7dd6c67ad350ec6ecad5bc3f04dea179fae0ff0a695c69f7de919476dd7a69c25b04c8530a35119e4933f4a8c327ed6dcef892b1114dfd7e494a19a7

Download Submit
memory/1432-1646-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2988-1835-0x0000000002250000-0x00000000022B8000-memory.dmp

Filesize
416KB

Download
memory/2988-1843-0x0000000002250000-0x00000000022B8000-memory.dmp

Filesize
416KB

Download
memory/2988-1846-0x0000000002250000-0x00000000022B8000-memory.dmp

Filesize
416KB

Download
memory/4864-1707-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5840-1653-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download