hxxps://www[.]kingexploits[.]com/

Analysis

max time kernel
212s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.kingexploits.com/

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Bootstrapper (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	BootstrapperV1.19.exe

Executes dropped EXE 3 IoCs

pid	Process
3692	JJSploit_8.10.5_x64-setup.exe
1340	Bootstrapper (1).exe
2124	BootstrapperV1.19.exe

Loads dropped DLL 13 IoCs

pid	Process
3692	JJSploit_8.10.5_x64-setup.exe
3692	JJSploit_8.10.5_x64-setup.exe
3692	JJSploit_8.10.5_x64-setup.exe
3692	JJSploit_8.10.5_x64-setup.exe
3260	MsiExec.exe
3260	MsiExec.exe
2604	MsiExec.exe
2604	MsiExec.exe
2604	MsiExec.exe
2604	MsiExec.exe
2604	MsiExec.exe
4088	MsiExec.exe
4088	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
357	4976	msiexec.exe
359	4976	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
292	raw.githubusercontent.com
293	raw.githubusercontent.com
340	pastebin.com
341	pastebin.com
347	pastebin.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-ls.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\mjs\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\node_modules\glob\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\read\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\build\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-regex\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\lib\constants.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\promise-retry\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\util-deprecate\node.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-query.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\key.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\translations\es.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\render-template.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\process.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-paths.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\format-diff.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-fetch\lib\headers.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\config\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\normalize-package-data\lib\safe_format.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-search.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\preload.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\compare-build.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\set-envs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\can-place-dep.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\dir.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\rcompare.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\root.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\common\node.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-logout.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\repo.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-install-checks\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\lib\tracker-base.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\utils.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\node-gyp-bin\node-gyp.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\init-package-json\lib\init-package-json.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\CONTRIBUTING.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\validate-options.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\shrinkwrap.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\cache\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\client\rekor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\root.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\outdated.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@gar\promisify\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\tag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\merkle\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\ideal.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-license-ids\deprecated.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\add-git-sha.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\lib\internal\streams\stream.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\util\hash-to-segments.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\.github\workflows\release-please.yml	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a9b57.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA53F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA52E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAEB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBB7.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACA3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a9b57.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JJSploit_8.10.5_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 521412.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 899565.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 661322.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1612	msedge.exe
1612	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe
3104	msedge.exe
3104	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2600	msedge.exe
2600	msedge.exe
2124	BootstrapperV1.19.exe
2124	BootstrapperV1.19.exe
2124	BootstrapperV1.19.exe
2124	BootstrapperV1.19.exe
4976	msiexec.exe
4976	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3692	JJSploit_8.10.5_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 52 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	Bootstrapper (1).exe
Token: SeDebugPrivilege	2124	BootstrapperV1.19.exe
Token: SeShutdownPrivilege	2268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2268	msiexec.exe
Token: SeSecurityPrivilege	4976	msiexec.exe
Token: SeCreateTokenPrivilege	2268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2268	msiexec.exe
Token: SeLockMemoryPrivilege	2268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2268	msiexec.exe
Token: SeMachineAccountPrivilege	2268	msiexec.exe
Token: SeTcbPrivilege	2268	msiexec.exe
Token: SeSecurityPrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeLoadDriverPrivilege	2268	msiexec.exe
Token: SeSystemProfilePrivilege	2268	msiexec.exe
Token: SeSystemtimePrivilege	2268	msiexec.exe
Token: SeProfSingleProcessPrivilege	2268	msiexec.exe
Token: SeIncBasePriorityPrivilege	2268	msiexec.exe
Token: SeCreatePagefilePrivilege	2268	msiexec.exe
Token: SeCreatePermanentPrivilege	2268	msiexec.exe
Token: SeBackupPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeShutdownPrivilege	2268	msiexec.exe
Token: SeDebugPrivilege	2268	msiexec.exe
Token: SeAuditPrivilege	2268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2268	msiexec.exe
Token: SeChangeNotifyPrivilege	2268	msiexec.exe
Token: SeRemoteShutdownPrivilege	2268	msiexec.exe
Token: SeUndockPrivilege	2268	msiexec.exe
Token: SeSyncAgentPrivilege	2268	msiexec.exe
Token: SeEnableDelegationPrivilege	2268	msiexec.exe
Token: SeManageVolumePrivilege	2268	msiexec.exe
Token: SeImpersonatePrivilege	2268	msiexec.exe
Token: SeCreateGlobalPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3276	1612	msedge.exe	82
PID 1612 wrote to memory of 3276	1612	msedge.exe	82
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1988	1612	msedge.exe	83
PID 1612 wrote to memory of 1640	1612	msedge.exe	84
PID 1612 wrote to memory of 1640	1612	msedge.exe	84
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85
PID 1612 wrote to memory of 1548	1612	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kingexploits.com/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf51a46f8,0x7ffbf51a4708,0x7ffbf51a4718
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Users\Admin\Downloads\JJSploit_8.10.5_x64-setup.exe
  "C:\Users\Admin\Downloads\JJSploit_8.10.5_x64-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,4428111758755718474,9155047949266854834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Users\Admin\Downloads\Bootstrapper (1).exe
  "C:\Users\Admin\Downloads\Bootstrapper (1).exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- - C:\Users\Admin\Downloads\BootstrapperV1.19.exe
    "C:\Users\Admin\Downloads\BootstrapperV1.19.exe" --oldBootstrapper "C:\Users\Admin\Downloads\Bootstrapper (1).exe" --isUpdate true
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0ABE5208A8D7CF05C7AEDFB3D417630C
  2⤵
  - Loads dropped DLL
  PID:3260
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3D3C36003811110607D09B295A926618
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A44BBBAA6099B793C882F894349D7BD3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4088
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
21KB

MD5
e64e934e2beec31365faf9a249da981f

SHA1
b66f0b063b930085c41b90ef56322ba6611dd82f

SHA256
b7d19d9feac02275eccaa8f49ded8f0ecbb6027d0c630d29251e32a8c77c88f3

SHA512
bf48c92813e08165d8c3ce9ee890f5454342387660a907f7293ffcea77b038845713680f1a6ade34b0cb4d24243aa7d7f3bd3920d03b994e3e80e7733d462e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
24KB

MD5
9661f391f69ddbf1e8bbf879c1c69660

SHA1
60e78567cd82d5dec158be4ae4d365f45412fb36

SHA256
59fe3fa5daacb2b18c734a563d4e8e9df1f51eb24672249ca4962f3132149191

SHA512
dd61b2a9827be092d779b36dc1c4f3983e78cd42f3b6bb07d61758502ef0eedc2fa562ec028374d072e1ace9d82c2c816d2bbb742523f43cf5a6371b79064722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
47KB

MD5
dbe5e6daac876d02b61c6658769a7d9d

SHA1
af4542f733ddf3a861034f9f70bbf93950190dca

SHA256
591b13667087a67c223dce0a5908f698c9b3285b5a822bf082946df4f416853e

SHA512
5ef562f27bb91cfe1c19b00b3a8481673e5528a6a601e678af2b5b0f46c6e50171676577eb3e590ca76bc8255c02bfff46612b82a7c1798374fbeca1d830ff60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
20KB

MD5
5d55e322dfd092997e72cc4ee9a97c63

SHA1
f292f3e2c9dc373242c64d8e490985031fca0755

SHA256
10ff4d28e2fc4a07aea42a8a61bb10b0fb4734170c912424c17b76db8746b793

SHA512
595042494a811f6c02200e5dc0285fb8dec8be8021aa49496786e18a93e1b33cdfca03e2b174d745651bfb0ba0e327e53451aafd95ffe3dcdc4ee59f58b2a615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074

Filesize
105KB

MD5
19d50274bc327091020369ee3f7e810c

SHA1
a041c9a5f1f22c0b66d07912f690de15b914ef03

SHA256
2b6dfe695841a007ca3fe2d183d4f265502f05283a0180c6cc727bf3a20667ff

SHA512
c9946f608734b44a9317ed62eb3bddfa8f80af6e563b53a11d4879b676d42bf30c1898100e5511a7e5c103ca09a0f1083b039bc925782695582cf30f4e1b37c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000075

Filesize
72KB

MD5
77ea891f5800f2cca2a942b32ed3ae48

SHA1
f6d4da1fd8b01331f17a106edbd3807548127557

SHA256
877a643bb5dd46ea97390b70c802d5de33f8fefa3a796f3e2a343c8c1922a916

SHA512
a24ba1fdb6df0ba27514504785dd219e00b34fb805935c3a945a16a8836b39918391231daec409962dfb4e53457499601af0fcd0cc6da710dba837606f923666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000077

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000078

Filesize
51KB

MD5
779c7ca78db35f57789b1cb436ad922c

SHA1
f0295ca07979d804283b808d62af1a486b1f9984

SHA256
9b9c0465c3542657dbb7f0923209332620cf25b0e24e0427fe5dd0353a492f86

SHA512
157e2e80f20ed6d61dbff60d1d4a05de08994d0b5f52fda4b8c56343000d26c88a5e29bf04d534f6516cb3fbda5b923862969f275e98cf641ae474b5a11b8b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000079

Filesize
31KB

MD5
c21aa4d30cc2fd4f8f6005984e111e11

SHA1
ec6b2228d90abb4f0724c3ed23c756c1ebaaf8e0

SHA256
785c42d973209905550eea4a3d495c8938652ae27da209fbc2463d22d41af08c

SHA512
8c868e075eb798c5915b0b6fc725615003f1563dad0db7bf4b9b82f7911b454ec9b4b2a5398ce6d8f0609cd46093d1d78d5a28d280c0eec5e9640e0758d21aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007a

Filesize
137KB

MD5
fc28ea3155392ec530911b73a4e45d74

SHA1
0a399c1e1428b12ca69eafe1bddc98dc3ae6a7b7

SHA256
029b09a52da90ed7d57e446240251f82a6028ecf03e196b31f42a7fc8d76fb56

SHA512
7b8fa6e9b7a0060408d48de44a75826b700468f536771f2908a9f5debecb8027806fd3dcd74d4283c32bf4892abbf001d98be5fb4d822e3143f4a1e5dc40b6d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007f

Filesize
20KB

MD5
27a28a17041207e45e9c0c4e32944d75

SHA1
85e68e6f78201775603ff8eb89d406b8ee87f482

SHA256
f14154c32ebea98298065d61749f8ddd7c5acb94e3f85c79c2f16fd0dc12823f

SHA512
a6c21cba9096b299385e7486624474d9777ed116094203125e1deeceb4222b8b12d566165d3f3dc317b1789fa2f00f1083c9f919b679e145039b66cca964c345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000083

Filesize
57KB

MD5
f2b2ba64090c8c7cf390129956928db6

SHA1
8d164fc87acb83542fa33b0bf6a36606bd590e8b

SHA256
def30d731a7c1d3ce27817a5689c60948b914eebb64a0741ebdc47f5cbbcd281

SHA512
0a97b4f2146526e910fa71b94c734b64474552c463be62daac339edd47f3368565a6903ce2f5a8f0c7dcc570cc84d2e13038ec9683461dafdef7d4ac94e0252e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000085

Filesize
21KB

MD5
d6556465c4d3ff6f5b2ee406db3a2cec

SHA1
078d7cb311119bc759421a9d03d994b94032df34

SHA256
cb1ee69ec8273c0b4d30271d40a5e3173b8f7d63f81f3493b69ea8d2b72c070a

SHA512
ae468d398000caedf2c887b4a6cf167228fec68a44b2d06f64025d4ad3741463b9e69f0e493c67c546587283b1b973998012b9fb1586f87f7095e42fddf376ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000086

Filesize
63KB

MD5
a5cc79fbd666432c461daec09604f082

SHA1
9a3df93d85aca657c5c8b60f9b4063128319647e

SHA256
9a7f91177674363a59d898f41192d993f0dab2ce2c93a180b6d1042ea4b9e279

SHA512
f93ebbb16738cae18477a0bd833098abee3a77880b8623ae2a462ee8e209487045121700e013dd0da1c7c3f5c9f24a56f02a5cba837df4ac1f33c9f6e3522c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000088

Filesize
20KB

MD5
6c5eafccab3cf4e6b92dfbff01d675ab

SHA1
b459c7291910290b6c4a3f474781ea39ec8c3748

SHA256
bb862a8d484879925abff843e123e31149cb908092b0989fd9a27096c251514a

SHA512
2f626cca419b583e1dc84d30b9013e395937db596a299385a0f78700eee35ee39743ea8cc9d1d7176f32f0ddcb3c96b585d5fa0909571f9a883353b39ea55563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000089

Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\259973aa95a6af95_0

Filesize
67KB

MD5
39edf205bf8894dc1020dbaaf8b6e0c3

SHA1
02c928e5df19ca0d3a33997f76d3659300a6bdad

SHA256
14fee191f6770a720feb99daa8c9da3535a734370d974229b15e59d8974faba0

SHA512
dbd527b535e88114305cf9d1b97969ad44b695255247763c9a420e46b097c876f8961ce13e4f4c39b23c266233135484dffede48f4d55c784ce1620495acd9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a38ffe294479eeb_0

Filesize
322B

MD5
bb0514d99315bd314a16d926665e7355

SHA1
a27810442a177758c7a82f8be69b7158dae1bfe7

SHA256
e7742cba6070f8c238e0c454af5d04df85878c58c587dcc14709c563b359baea

SHA512
137a20c68bd50aedfdf511a5094ea12c235e2fb7233fae3c6f49942a8214aa9ecf8d67a4fecb9ea40147ed5f762ec160e0650969159e9e401ba52a379b5e7c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a04b77c3cfb5335_0

Filesize
3KB

MD5
6f36b6b8b7a397f1de48e6ab3e72a4c0

SHA1
ef77c8a2cd589fa11ab069ea41fbb82aec9d5b83

SHA256
025e6f6d0292528e63f0470bbd8f46218de1b8a84c3b72d388e7666a57db6fa9

SHA512
cbae3e1bc66dbce0dbb84e8d6e94a1217a3446151ce30146aa2380cf4691f5773f000cad3b31fce49c7390c458978c2394d4533e1ab5ae1d46b7ee896950d2e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8679d1273278b3a2_0

Filesize
485KB

MD5
fd6c5f3d73846898b3b88cae1b898022

SHA1
4dedab2d3fed85ae4471709c6ae71c6616cb4257

SHA256
b07861247775df86152e12278060bde6034ecf3be45ad49c74b46e83f4dc1d23

SHA512
4ee8399e96cfa065f201fd1b44e63f34b9d7c5bf39e4c09bbb5812466dabc1ae25043a3c7e012bdc1c98e353ba85d11f310f66fa80ee7c6a7e16f4aaa27fc814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9aa0a8e236ac098_0

Filesize
29KB

MD5
5a3d29da1caaaf9a047d7d9c37a7150d

SHA1
92886d5de24d5c2df94d900afb8ea5d6c6900815

SHA256
21f116a4037e7f76fe8c76c2d9831fedce21c3c5396227946bc8fce7c9a2c246

SHA512
400e26d8998e556447ab545155f034767cb2d94861f58f9b4feda987c01dc77735b82131c138816f3a082e20b25e9be588a5de2fc2bb3a1390888a3c3a016eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d93dfa54361dac25_0

Filesize
361KB

MD5
fc0ef3ab000fa7d08b76302bd5646e3c

SHA1
29f7a2191a1950028c363aee4fbafe77076c0000

SHA256
a1a361d7c2d2b995d701ca80ed1e5a015ffcdb2f82979d690d8d6c4e1be8acfc

SHA512
69158e7855ef662cee3b9676b7bcd2b814e3e757518ff50959963f41d7d2c9688ac0c0ce6aafd9989ff9b6aeff210269980737b00c20b98614c3e5ddbef6e204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df53bad28ea1e322_0

Filesize
303B

MD5
d862a8007686fb68c66548a946ae6ae8

SHA1
dbed8fbb2d3cafca6fa670655a8abbc268ddb8b5

SHA256
09462f09b78877d5218b7036271961507be77a6757590a13beb1b85fadba4644

SHA512
9524acbfb276f99e29cacb0924fef309e3d450cf8374655c4e75797f5e2a1b903cfb8884d660df09a0f8ecfbb3f92c1a74b97825ad0271be45f6366e9e713983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ee46582361c18fcb_0

Filesize
264B

MD5
b1e465117de28ba9d91e2d7293dcb12f

SHA1
db2110aedd8997e8ae49f500c43a5b2da8945808

SHA256
8049b4c9dbe35afe2685f94cb3f705e3ca8584a6f67f30725af43748f22c62c6

SHA512
8142e708af1ef111b30ecf4e5937bd79c32822d701915ef83262878d035d74e90cfc435727338b4207a4dc723f671312700ac9308793f40eb780dd653fbf1736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
ce2cbcc072186b438c7a86d5b23354ff

SHA1
b3ca1dae54d2d5f22450eeba75c60c484bfc6460

SHA256
414bfeff17c9102c8bf17c03f8bb6900a2a05c2517dab03bd9d34aaeb9e2f6c0

SHA512
cd60c9f1ffc20939740cfcd94585f4a97d75b779fb957a8235706615fb8a1fe2020ed099f77754b85fd74d03b724dacad32ddef4cda7ee92c6aefd6fe8f00c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
38e09cd9b4320ea7413fa379d8355706

SHA1
7d0e5c4d85aaedb61a49affe7c6bee61c69dd0d3

SHA256
e589eed7ace715baec97bc0326a4b778e84ce586e0837762a88dc7d473736f49

SHA512
b3e29276a2b20d5d358e92fdb97d0ef4989992068fbc946d9208a2fcf49795876ecda17b3ce92ce83d4f18b3dedcf193b2d32ff754b43646c316934c796f5bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
149c12b480298c4abd87090c7fa42c5f

SHA1
fe692dcf90d7e54691ff7b546e8179c81f1797c6

SHA256
0107c299c62b3e8ac662682b7860526b49e331783edd7214ff499ff37cc0ef07

SHA512
81d1285106b0f6f6ac43823386db145e80646cc7b3be05273d4f854b9ec987177e849bb52cded3efadb9a7704daac9f6ef2dd8babebf5d4822c9fbef368be18a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
e6aecf84ae8c009997cbfa8cc077ea3b

SHA1
6880e42b5e3b183f9dfe58b452d3f3473cd9decf

SHA256
b4d31d14508405da44205012e8c58f3902fb4efe40b9f605692a6821fdf99dc1

SHA512
2f4024b8ab72037123e8174390bc23bde966b3f90de96d15d3c50e3383399e3ed1aa6b780c8994bc8e31abef6f84e01a851c0d75f050ed54b9fc96ac98a19c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
6f621f53e82fe43a5575085af1bd468a

SHA1
23817cd8c528a6ead0ed8bd863d1942261588bc9

SHA256
4e82fdcfcde23442932f15c498194ac04cf31ad00f3bfbd20f9d14b1f407506b

SHA512
360eba7c6539ef3d729dcd44f2c61624b155edddb72050a07fe5e271d55a6f5237c07d01c06741e61312374b1cdfb6ede53f85e1b6a2ace0d4bbcc29448fc818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
602bae9f009f12fa423c6c13d335894a

SHA1
8b7476c8085515a49cfea0842fed6cca2a57070f

SHA256
beb12594269389675aa7a0ba8251459a220e98557d22867a7c391c69502ce2dd

SHA512
4977d84c2b2c2a1091eba2cfac512ec59da139ca198f523ce033d547bd3a440b293073493d0c31d819d2ec8a33b3aae5860c29517979db6a0ef450d9193e1339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
642f4684e72926ab8741e85c46d4f00d

SHA1
992b9630e91cade45a6062a0f5539814bc96b587

SHA256
6335a1a7035dfe51aecf9f63a489a5ac777546adaad75804ff9f53283062a7af

SHA512
df9ec4320d08110a7d1fbf73e6f60493db688436af0f517c29c7ec6d5533fb07fe651313993c0eba1669684d6b4b42254f8f39202b25c8672e6a30aaa3c5305b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
aa7bc7f7cfca74a3615c4dcf2b50cbef

SHA1
9d12d9f76cc5eb64a49b5b6fc07104564d6e04c9

SHA256
43dfa8f565bb1dd2aa669dc21ead3882ef09500f4faeae8b03efcedb5735432d

SHA512
7d1cc358669197b82bda697755df1a170edda4bc44980d37613bdd5efc0444a56578a411889974de861ab28ec4cfdc8c3ec3271de58d21582e8f079e0c0077ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afe60a74d7b9083a8fce89ca38cd826d

SHA1
7bcb39410a0c3f07a7daa4e6c871c3c6152f5637

SHA256
bb6cc47c624c3a04807b6c2aa9eab308ba69ca86794669d35929428f3453a929

SHA512
aef5bedb6706557bb2cf16ac6e28ef7a189b9cb800a63ad9b3d12ff21b1414fc1dfc6fb8ff9f6344f9e68f5e21f75481c5e37488df5479fef2cb9f781fee0057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ff11ab08e67e127de76e62d9cd222640

SHA1
378f8b6eb3cffd361eb38ad5175e2d372292e9ad

SHA256
1f142cb48a4112ab43a71a9ccdd93a681dabc9f9c038d44f53e242f749f91de9

SHA512
96121f36ae5b83039cbf8cf5c38842661a898feaf7ec366be7105c4c1ca25a8fac1bb9bcbe4bcc18cd6e52a0fa3d9ba94a132172fe3b42b842d3437ef6b427fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6fe57d37189b5bd702791b0e5edcc0ed

SHA1
180260b77a28fb8ce9f6c3d57e8351166a9483a7

SHA256
da38a8d7625a1f5b7a66d6fa4b3bb923f324439dfc3adbd20dcb132c4280c4b3

SHA512
5118dea023076b3a0d594d523a756e28301719297125f8fdd8b04f950a1dbabefb33b05a93be2da67fd3c22aac87f6fec803f09e9b28fdf9719883f5cc462eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
2d78c32bde81f4d1d0710bddddd13358

SHA1
ef0ecd8632f3bc16d02968a044717983f0760cff

SHA256
79e07a07824c12dc00a947fde3f465b4647d2368b75d51a882cb859016ffb18a

SHA512
51c6194664ed185a7b244ba44cba9c405f308125decb3517bd61631c717d35312dad346a66e1bf4555ceaf45adbeaa646575c0ca2b48b14ef2ce0ce4eb0a6fa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
a99d5175beca78affa1fe3ebb3d21cc5

SHA1
d2bdb12cbcaceb3fde0dc40a2d56d8d448c76293

SHA256
cc6d95d1e59d2704e3b7e8b48a53c85a6040052ff9cc5a997e5735afb007846a

SHA512
67233a41d8826e03ceadfd66e85d049cac0e1ce318f09e2a7f70fc945bdf65f904a2b46961ab60a08aac2641209bb7c842b393c9637632280f406374f2ef0876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8351e27abbde1ffe9418b82d5f9ea7f7

SHA1
54e6a426e7404c4651c9c011a4f5fde2d3b1eac0

SHA256
8332c16a9aecd035558f3574468b3946536453cfbc57c700cceb500d488905f3

SHA512
bdc17b8d798e1d2a4e271f67936701fdc339a14437c028df13902cf294a0b6855b543aaac3f610a9776cbcc056bcc2babd1a4008cd5996c868bee03b4cee7cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
7d4f3c7bbc72280220d90135ab4cfee1

SHA1
2fee1fe0a7a78ffaa6c4e2f8a6fe9d05aaf44dee

SHA256
7863a8a928e1ed0e7188d788c88ef4d91a0559e452abb3e2edc9f4bdbfe5eac2

SHA512
4bdf4c894e8f24d1fbcec1495425a52a9fe53aedbb0ebbff0cf4e860553e41b2daccffe7a87683db1a680670aa591170b5db84b005c924ff2ccb52d39cac512d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
aff53192a2e02d5b5642c0d4db135aff

SHA1
4a41edd95ce65f476d8fc692c4a45bad7f3c0b86

SHA256
d80316859bdabda2574594188399f9eed5acdfb957e5432f660179a4f7394ae5

SHA512
98d8fbd7275b10e0dddba7d9de1bedc1f2a8e8b26d351abcc5844ffc46faaebc4d62a151b9654913e4202bc9dd8bf1dc8f8e4c4e5a83b31b98cb76cf94e16dab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59258f.TMP

Filesize
48B

MD5
b6cf2582496103b5c7a9c0c252d973fd

SHA1
7dd9ab399feaeb33d551bd1de7fc13243642b799

SHA256
61ab25c36409c2ff6b13073eeb5145c42b4bcba136478881a007a095c2c8acd1

SHA512
2e782368448c86d6d1f4c3abf488f04eb50f39b53b4659ca1c06124415c7cc312773e711b7e4e937fd16797433e3ad7d30ffc0e7603c0470a4945da4de3785d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
38c723d06c42a12a360f41a2842f7566

SHA1
60e4e8de23286a4f8a13aae177d5667627cc96e1

SHA256
993f65dbd84759698c8b527dddf238b95af6e0f114f61fb909eb0824217d2778

SHA512
49f78b411648eba9050290e7106039d3e19bcc7f7ec5ba6173677deb4260ef9a23b84fab4bf0e06a213e9d99573af524b131172fc9d38cd6c431faf17798ed83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
2b9a5a8f8b4a2b5a31676f9a1290c952

SHA1
dd55ec70b65a3968f53245a0c3be49b2adfbb07c

SHA256
81479d9c9d40cd5939424065b9f84f917e5f7d64549018a97d6fc048cc26888d

SHA512
460f2d7645e605a442ce3429809838e14ac1e023819afa5b9ccdf1b141a26cc43cf9983bd0f1bd67fc25cd13659a100ecb5aea176f5b58e116abace2f474bd27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9fabab3030d0183f528bf81ec1ebfc3d

SHA1
af28a16f8c8d30b477d8f47e2056a84ae353e55b

SHA256
5b62997551317391cc162fbce98f4f4fc52a2c3d9818acd444331859c3dc81fc

SHA512
a2164a3a40450ffc7ce1312cb279624c6c5da04ebe2d612845f74dadc55fc42d7c050f8ec66e49b5ab403f29c2513474dbf6c6ffab536a74459c34bf101c7da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a1f715e6506ff7d07427ca6d1d334978

SHA1
71efa3339ca8e80f1e31029dafebe6343e51460e

SHA256
0034f648b6bbe87c48e95d45b77e14621b53c7c8eca5248f854bd247c9258160

SHA512
066a0e036d4190e5da4519588665f1d130d58f356321200ccd74310c80ac777378f834ce51da7c51679f8c4c08aa6195accd35fa1e474bfba987f042a540640a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1518cc92eace87a1db60fd3c495501a0

SHA1
49578072eb9d9b702aaf324da99ebaaff3be8c8b

SHA256
fcc499d4efdd6d67e003144443fff9fd33f1291e49bd41d9a212aa38a262e6ca

SHA512
b27f23566a9eb5fac80a54be91b2acbc675a2c27f0538945f006301abd28488e4708d9b42714f7770ba27b45218b7994572a152a297b24f103844053be736975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9f183e1c07f1bcc50b5102fdfb6d0319

SHA1
f1d599f96a6167a2e6edc902d368dafb1f2958cb

SHA256
d08db526fe0ce7856541850c4c531f5e135b8c9be865a03eaad1c679b9fcd2e5

SHA512
3663e58ef39449cff1b13f12195941eaa57ef925254bcbd5bb337a3642536f0a02edf7d927a0312d9c3b5d6d8d4a99c5f4fbd31b103ec4b9af52e4044ab91d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
865ffed0eca2dad780386493440d68ec

SHA1
fbb613dcaa10c0b69d8d438ab49d1acd6b046f12

SHA256
d99428cc01b4c698764c0494f33ce72ea042dfa964453b4b041f503e60ab4501

SHA512
1ccdd35d83e53452e9923119e04856f42ad22e0338e25629e07c23b94131e83ee643bf2b5cae8aa9a670e6fc5203bb61fc7a7ad2202e9b66fa16680cd6855de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3544304d63c6aa6341f54c21806eabe4

SHA1
900e47a9a5bcf605b0872a83064b36a75961830e

SHA256
f382f17f8876a8ab0af4e5fbba99e108d6bdbefe8b774453428146dfd132ca86

SHA512
dd736f94f9747bbb845c981f4c02d01bda3b17d2d687fe476e6d7f6804560b631bc4f50877783a7ab7b0f1963d839adfcbbfd5d63bd275c765940a3539b1f993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
34809ef89d567c24aa7df078dd3d2ea3

SHA1
39973e9e3225ee2ae8a30555c7f4b3d551040ffc

SHA256
81512fb010aedde605669d755c9ad6feabf214a1291499a36667c611186c660e

SHA512
399f00ac7ecc1fe796bc7acc26511d69c7b69e917e88519f28dbfcf59c4108a37cb13a8b4bf4a448fd450691cdf49a7f9348827e57a3ef82ef617068669f33ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000017

Filesize
17KB

MD5
aab2532f8363e63359dbf0c31981f57f

SHA1
a21523eb85636a0455977ffe525260a1a8568043

SHA256
a6abef5f074c67b1f9fbee679151a4c705b71f054c98f720dfabdc65786d5d13

SHA512
7b3c4ce6574b36bf0d4e05bba1063798b525744fdb37b28ad6fc78456ef7d704677795ae4dd0d0eda0954d15b3776395fa931abf82dd4b64583c360dd9916f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
18146193cae3bcf85d88c3235db6074a

SHA1
c58380bbbb90283b41c68c879112bfc9a0454a9e

SHA256
6300650e2f5c5438c3ecd0d1dc02a0d14ebdd3408e9e242e74093974f61ad2ce

SHA512
f9ba7f4e8d710682aee2bac6ca65db9a45441a8fe6ab12651852bee8deaa9285150b317109a49046af875ee3e630a833a9bc8de16a1ca0861bb0c990f9818ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cdc6201e9c06b336bad9f6894fce092b

SHA1
e950f32215c8b412e7ec8d53a6865c25f454afc7

SHA256
894242059420bf5bde03345d5843e8442bdce2cb48bd58396b1bdaca7224e1b9

SHA512
6c4559d0b30cdff72f2929b2a0ffdb8b48b1b02765e71227009ff665f18d4de16812ead764e4be3a254afaabc0216ac92eb69fa3c1ffe237b54cba5fc49a525b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c69247a58e44bc710b4613cf2b75edd

SHA1
6bb64427a0c1d26b53d0b211a8b0688b1ef8fea7

SHA256
9678b918b27a5afeab3d6cdd77545b4737fd2170048cc975b116439e424b78ef

SHA512
0072168910433b0d45fd1f811980443d567b84b6fd18f43ab8206eba63973db4285dae72de156c047861d3b06590b4d147a9a3a97004ea88c6f8eafe573c870d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyAD6.tmp\NSISdl.dll

Filesize
15KB

MD5
ee68463fed225c5c98d800bdbd205598

SHA1
306364af624de3028e2078c4d8c234fa497bd723

SHA256
419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

SHA512
b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyAD6.tmp\StartMenu.dll

Filesize
7KB

MD5
d070f3275df715bf3708beff2c6c307d

SHA1
93d3725801e07303e9727c4369e19fd139e69023

SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyAD6.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyAD6.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ca5e7b8a7dfdb80339fd0c2b48ea3628

SHA1
a2d7e7375ac33d917e7fc0fa6c5ef4c7e14c07a9

SHA256
2c9bc2c23fe014a22916a16f1507a8b4ab3fc541e8aeaaf8392b5da5f37343be

SHA512
827ead434ce3527f5f36f046d5482e9b1e8a0b90cdd009929c87178686070e215eaab531b8b666fcf91fadccc03d013273942feb68fb7c2613a24d936c1d6fc7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
bf547f41a3c1a0ea22d79625793d2896

SHA1
fa6b57379a83019ac91dbdfb3e5c2dfee3a78f5c

SHA256
ea6e41ba3d6cb5c9a0adb3fb53de49c4869038687e09b963fb904999e724ae9c

SHA512
618631418303f3acd022bef386adea9f444849bf67692aaae9adfab7779940ced3752c8336654aa2ec38d57070ef1b3690df902afb5aad51872e26019703ab12

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
0d95cb55b35cb36b52725e77ae276f7d

SHA1
11622748a36578f5e107345f890936afdfbec1b7

SHA256
7fd74eaf60dd27d40bc37a5adf3681a0a182e67f2bb563fb41421f401bb62856

SHA512
bb4a4ab00ef74fbe1ac9865d2010380000a4878317d8ee2111122f7b6560e2b28e61bb0d3a7eee41a2cbe33e15aca5f2ecebd3d951f5ef0197d05d2d2ad56cce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
43c22b4601552da29d837393f71604da

SHA1
8fbc966a86f8a437feff2962795a0882061f5861

SHA256
c435dfa56cbff6faf889abac18e782cdbe2a0910274da985e9e6404dd6a47598

SHA512
b503ed6a33c7c54bc5d445e6f31d134e260ed4e577092c9e65c5f3c150f75f3f91472d5e37ac155a09dd7dba5a1e542e09e4319cccd82684bf874aea94d18c42

Download Submit
C:\Users\Admin\Downloads\BootstrapperV1.19.exe

Filesize
972KB

MD5
90fd25ced85fe6db28d21ae7d1f02e2c

SHA1
e27eff4cd4d383f5c564cce2bd1aaa2ffe4ec056

SHA256
97572bd57b08b59744e4dfe6f93fb96be4002dfe1aa78683771725401776464f

SHA512
1c775cf8dfde037eaa98eb14088c70d74923f0f6a83030a71f2f4c1a4453f6154dab7a4aa175e429860badda3e5e0ae226f3c3e8171332f5962bf36f8aa073fa

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 521412.crdownload

Filesize
6.1MB

MD5
ad0fde3ecfc62e0ec5c3b75e15751ac4

SHA1
c9b7254bc3ba1716db45bd72889e3df901cc3da7

SHA256
c9ff34cb7d2374891dbd649a3bbaee384e41736818754dd6ba836df250bf8a74

SHA512
8b6ce18cf0737d56273f6fe1b28066b52082bd8c688eb2767a5eb7d6dbdca717c7610d0e8098e05903573a417ef0b642f0823d015820db8494114d376ebc8576

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 899565.crdownload

Filesize
796KB

MD5
4b94b989b0fe7bec6311153b309dfe81

SHA1
bb50a4bb8a66f0105c5b74f32cd114c672010b22

SHA256
7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

SHA512
fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

Download Submit
C:\Windows\Installer\MSIACA3.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
memory/1340-1604-0x000001F2965A0000-0x000001F2965C2000-memory.dmp

Filesize
136KB

Download
memory/1340-1593-0x000001F296090000-0x000001F29615E000-memory.dmp

Filesize
824KB

Download
memory/2124-1615-0x00000226F9B60000-0x00000226F9C5A000-memory.dmp

Filesize
1000KB

Download