crimsonrat | hxxp://google[.]com

Analysis

max time kernel
1797s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

crimsonrat gandcrab aspackv2 backdoor credential_access discovery ransomware rat spyware stealer

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Extracted

Path

C:\$Recycle.Bin\LDHFAH-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .LDHFAH The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/8bf228656fdf7330 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAHKd/9uXf0KAyAtODZl3B8siyZE4F2QsiwdSCGJgB9rw7VnyddxwNstyfQCqmtVMJmgb44U6VhHwT+O/n5ain3pVXLSK6TCMVzPQ14phlePtc7Zj/dCKBAXg7rGUOVGDcIB3LCdhmUsfMMzenhNFCixUFvzYAtYP63TQP4GcrQJiAj5BnIJH4oNImMB8TtBJswu1Yn19w4lCeOUSq9yBGyOvqxkmC5EkeP7wYMUYkA1biQJzWUSqokAMcYApmHNPLWWi8gXKyexLVSDdKkG5+h91brliqo0DJ0A6mHotgIxJHx4O56DgsUErv4iO4kYTMYILqqM0u7DYIyCu7dfe0JDW92uUL4XN/ovgexunooVI2uIgDG00AvFhGcUgTnx/6xAU/qoqqAypVfe7oR9HtAnV5hg6aQ5Exu5AsKt/8iRTxVGM7TA/z93/Us747NDOEmhRM41Rx7K4DLP9lVHEU/aC2L/CQJ2ZnLVEHzCusKk8Mlf24ErO7elVlWD1nAYCRTmz59auBd897dMwt1aFEqhIfJOSMiEW6N5egRTEbPDntFIWSKSnKEYYWj3sYc1/I629Lt8uKfACjzSms+EcFXaYM6uEiHm5mBsL9nN35ikYepL1sOIJm50XBBac5i4KJ90gtM5xLgl2J2kuHhernzYetjXY7WGcIgCCqPeR5mjYnh+VUDpCUPBskKiZgsYKoYqt+sRzSHNt8uvOfrStzTILfqdPl2Orj+VNP5npnbBDC3OHOt5DWpohnE43JZ651DjIcy8Hd2ixT0dwg7atCF9opJnmcogHmqbT6fu40zcw6H6C1Vy4B0jKc49ffZ1sX5rsx5eV2/uzxU6vaDSeMutg0stIsLJWYgUCOzdPSDACUbToNyaXTBkSJ3m0i9iAYOTe/Gyu7q1ywZqSABiN2tFFFlWFAR6wet4GJAvoQ5DWq3MRcWx9t9ApfqCiUsEhMEVhAXTbPNdTmN5e9p3UpoGBs0FRucnJmDBLLTOpsDWu1f7wdcd4KjHEtF+mkJOq1t93odhwwYU8pkoO3nl3946pRS9ZmE7fUr5PLujnmLsQudeu2wZiwqsbUn8bQh/lNXj90w+8kBC3grQ7nukuH3IGMHIeBXhri8sPJF3nagwQOr+plBhFCKvFccnRM/alkUH+hHniyB4B2VpXPMpMpBoJRwJs+sYnhkLoPAmkPEs6vIRP40x49hRnMCrW0z6dz0W2pgd35gubllRzL2Q4EBcYAmBM6TMXkgyC1Uak0n+I9n+AIY8TIFQQmejDV1Mq5nZOOqaMOANoKXaXDCq1me2msIl6efxDnPIagNEmEX3cSTdhI4IBonBN+9M/FdvKQaEncV8WHvLUM1C0R+eXhcrdabrDSa06mq+1odguM1VpmIIdZqrTRLw9qywVZ9FLQnWskcglaOUa9+zJlC3ZWpSlioHW2Rveus+2hUodEize4Tn01doBZj6D9neOA8FnrjYbB3k9TQFoSlUuBbsXNuMGitTlj3GW26yBBSquCCbR6kQS/TyF+JIm7O5pbOjbF4BbxUHeKSg3m+LRw8dOvvRcOb082AVRmBD25AsoF24YBTiF45FfAzIfMpdwDOaEKLrwWAIWU1cWhhMefoWKWgtsRcqww9mJjHpu3g/1yg0Fiy9fQ+z1he2wiLOSpkZ2kLG32R3PSj5LpR6C0wR4lYV4FwHeglG5g2lnvi+S1xnQxly7KCbnGYSYR/Fjm7Y+DrseDnWyR8CNNCeZTjK9IaInCmNqxoNJpl8w8cf9aID3UDvfgD0RfCv71a52v1IatCO+3aJH04Qq5EATTtnQXvLOfyIeLTeErvq5jRlSLCMXUJ+llMdTIDgzQM/LhNEFhChBM+f9vS6hZmbrdwxed4VPURMyu4roT7qAuaQ8eWOxcGuR1Gw1WI3mvMC/E7vSCcvNy1ihE0S7j5jUief5naFytbZ0kP1GxiTMX1sHnVqBQhcTWtBbY2xeBkQMh5N+751ihe8vQPNR9OrwuNHO0GwZMNlueecvJty7rXAjK0xgSvcToVyl0D6wlDHvkAU0cfRKR2HxV1emBzPBvFgakL/gEVEqBHhnR/2s+hSpAnGm0KIX8WxOr+DNp1Kkt9ffmQ4KM4ZzmZ05koLMKxsQ++EcZnzfINEq9BWmf4DBvQ4lH0aXwAOd+FpLfCnrRLa9G/4PkGMfIYsiQsDsi1FC8k73YGk00Yxb6zFHK8q/90kp57EkB6znUesCEY9KyaisEAKrGS0= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDk9MjJL5DWAuiVt+DGRWPIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJddBfBnJqrMY8R+i3N7HJmdKR2kfUP4/y+/NmLLfjWaP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8B1fOlWDmZ7qt4A+w/gT+wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/++QRe2kEznTbCqfrOdcnPBOVfcolLq8b/gmccCeV7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/8bf228656fdf7330

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000023e7c-2328.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab
Renames multiple (327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b000000023e93-3347.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	GandCrab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	GandCrab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	GandCrab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	GandCrab.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\LDHFAH-MANUAL.txt	GandCrab.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6fdf74dd6fdf733c317.lock	GandCrab.exe

Executes dropped EXE 24 IoCs

pid	Process
2052	CrimsonRAT.exe
4748	dlrarhsiva.exe
2480	CrimsonRAT.exe
1044	CrimsonRAT.exe
4604	dlrarhsiva.exe
1256	dlrarhsiva.exe
528	CrimsonRAT.exe
3164	CrimsonRAT.exe
4628	dlrarhsiva.exe
3300	dlrarhsiva.exe
852	CrimsonRAT.exe
3896	CrimsonRAT.exe
1724	dlrarhsiva.exe
3196	dlrarhsiva.exe
1492	CrimsonRAT.exe
3696	dlrarhsiva.exe
4376	CrimsonRAT.exe
4608	dlrarhsiva.exe
4872	GandCrab.exe
1932	GandCrab.exe
932	GandCrab.exe
1624	GandCrab.exe
2536	ScreenScrew.exe
4388	ScreenScrew.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\P:	GandCrab.exe
File opened (read-only)	\??\B:	GandCrab.exe
File opened (read-only)	\??\B:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\P:	GandCrab.exe
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\I:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\U:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\I:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\R:	GandCrab.exe
File opened (read-only)	\??\N:	GandCrab.exe
File opened (read-only)	\??\U:	GandCrab.exe
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\Z:	GandCrab.exe
File opened (read-only)	\??\B:	GandCrab.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\J:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\N:	GandCrab.exe
File opened (read-only)	\??\Q:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\A:	GandCrab.exe
File opened (read-only)	\??\J:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\M:	GandCrab.exe
File opened (read-only)	\??\R:	GandCrab.exe
File opened (read-only)	\??\Z:	GandCrab.exe
File opened (read-only)	\??\A:	GandCrab.exe
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\J:	GandCrab.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\N:	GandCrab.exe
File opened (read-only)	\??\A:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
134	drive.google.com
379	raw.githubusercontent.com
380	raw.githubusercontent.com
119	sites.google.com
121	sites.google.com
135	drive.google.com
376	camo.githubusercontent.com
415	raw.githubusercontent.com
120	sites.google.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\bxmeoengtf.bmp"	GandCrab.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File created	C:\Program Files\6fdf74dd6fdf733c317.lock	GandCrab.exe
File opened for modification	C:\Program Files\CloseUnlock.vdw	GandCrab.exe
File opened for modification	C:\Program Files\FormatDismount.txt	GandCrab.exe
File opened for modification	C:\Program Files\UnprotectUnblock.dib	GandCrab.exe
File opened for modification	C:\Program Files\UnpublishAdd.rm	GandCrab.exe
File opened for modification	C:\Program Files\ConnectSkip.wmf	GandCrab.exe
File opened for modification	C:\Program Files\EnterInvoke.avi	GandCrab.exe
File opened for modification	C:\Program Files\RestoreMount.tif	GandCrab.exe
File created	C:\Program Files (x86)\LDHFAH-MANUAL.txt	GandCrab.exe
File opened for modification	C:\Program Files\LockShow.vssx	GandCrab.exe
File opened for modification	C:\Program Files\RevokeReset.png	GandCrab.exe
File opened for modification	C:\Program Files\SendFormat.vsdm	GandCrab.exe
File opened for modification	C:\Program Files\FindUse.gif	GandCrab.exe
File opened for modification	C:\Program Files\GrantConvertTo.xla	GandCrab.exe
File opened for modification	C:\Program Files\PopUnpublish.wmv	GandCrab.exe
File opened for modification	C:\Program Files\ResetTrace.vssm	GandCrab.exe
File created	C:\Program Files\LDHFAH-MANUAL.txt	GandCrab.exe
File opened for modification	C:\Program Files\BackupRead.M2TS	GandCrab.exe
File opened for modification	C:\Program Files\ConvertToReset.snd	GandCrab.exe
File opened for modification	C:\Program Files\WatchClose.vsx	GandCrab.exe
File opened for modification	C:\Program Files\DisconnectMount.txt	GandCrab.exe
File opened for modification	C:\Program Files\ExpandConnect.vsx	GandCrab.exe
File opened for modification	C:\Program Files\UnregisterTrace.mpp	GandCrab.exe
File opened for modification	C:\Program Files\UnblockOptimize.m1v	GandCrab.exe
File opened for modification	C:\Program Files\UnprotectTrace.dib	GandCrab.exe
File created	C:\Program Files (x86)\6fdf74dd6fdf733c317.lock	GandCrab.exe
File opened for modification	C:\Program Files\ConvertFromMount.vssm	GandCrab.exe
File opened for modification	C:\Program Files\EnterDisconnect.pptm	GandCrab.exe
File opened for modification	C:\Program Files\SkipShow.avi	GandCrab.exe
File opened for modification	C:\Program Files\UnregisterHide.M2TS	GandCrab.exe
File opened for modification	C:\Program Files\WriteDisconnect.pcx	GandCrab.exe
File opened for modification	C:\Program Files\CopySearch.temp	GandCrab.exe
File opened for modification	C:\Program Files\RemoveMove.vstm	GandCrab.exe
File opened for modification	C:\Program Files\SaveMeasure.eprtx	GandCrab.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	4872	WerFault.exe	224

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autoruns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenScrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2024	timeout.exe
2888	timeout.exe
744	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 981928.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 4250.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 519872.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
1132	msedge.exe
1132	msedge.exe
4568	identity_helper.exe
4568	identity_helper.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
3104	msedge.exe
3104	msedge.exe
4572	msedge.exe
4572	msedge.exe
1108	msedge.exe
1108	msedge.exe
2260	msedge.exe
2260	msedge.exe
1700	msedge.exe
1700	msedge.exe
4912	msedge.exe
4912	msedge.exe
3080	msedge.exe
3080	msedge.exe
2888	msedge.exe
2888	msedge.exe
5084	msedge.exe
5084	msedge.exe
2424	msedge.exe
2424	msedge.exe
3080	msedge.exe
3080	msedge.exe
4820	msedge.exe
4820	msedge.exe
4732	msedge.exe
4732	msedge.exe
920	msedge.exe
920	msedge.exe
4872	GandCrab.exe
4872	GandCrab.exe
4872	GandCrab.exe
4872	GandCrab.exe
1932	GandCrab.exe
1932	GandCrab.exe
932	GandCrab.exe
932	GandCrab.exe
1624	GandCrab.exe
1624	GandCrab.exe
1560	msedge.exe
1560	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 58 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	2296	Autoruns.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4372	hh.exe
4372	hh.exe
2296	Autoruns.exe
2296	Autoruns.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4184	1132	msedge.exe	84
PID 1132 wrote to memory of 4184	1132	msedge.exe	84
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 3820	1132	msedge.exe	85
PID 1132 wrote to memory of 2224	1132	msedge.exe	86
PID 1132 wrote to memory of 2224	1132	msedge.exe	86
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87
PID 1132 wrote to memory of 1676	1132	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbcbc46f8,0x7ffbbcbc4708,0x7ffbbcbc4718
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=932 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7920 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7988 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7996 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2052
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:4748
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2480
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:4604
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1044
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1256
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:528
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:4628
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3164
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:3300
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:852
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1724
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3896
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Users\Admin\Downloads\GandCrab.exe
  "C:\Users\Admin\Downloads\GandCrab.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1676
    3⤵
    - Program crash
    PID:1108
- C:\Users\Admin\Downloads\GandCrab.exe
  "C:\Users\Admin\Downloads\GandCrab.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Downloads\GandCrab.exe" /f /q
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
  - - C:\Windows\SysWOW64\timeout.exe
      timeout -c 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2024
- C:\Users\Admin\Downloads\GandCrab.exe
  "C:\Users\Admin\Downloads\GandCrab.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Downloads\GandCrab.exe" /f /q
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2792
  - - C:\Windows\SysWOW64\timeout.exe
      timeout -c 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2888
- C:\Users\Admin\Downloads\GandCrab.exe
  "C:\Users\Admin\Downloads\GandCrab.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Downloads\GandCrab.exe" /f /q
    3⤵
    - System Location Discovery: System Language Discovery
    PID:404
  - - C:\Windows\SysWOW64\timeout.exe
      timeout -c 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1156 /prefetch:8
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Users\Admin\Downloads\ScreenScrew.exe
  "C:\Users\Admin\Downloads\ScreenScrew.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2536
- C:\Users\Admin\Downloads\ScreenScrew.exe
  "C:\Users\Admin\Downloads\ScreenScrew.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1000943054363983754,5945439111311164216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3676

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1492
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:3696

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4376
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4872 -ip 4872
1⤵
PID:1932

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Autoruns.zip\autoruns.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\ee58d3eeb0a54323863f9b91509749a9 /t 1100 /p 4372
1⤵
PID:2808

C:\Users\Admin\Downloads\Autoruns\Autoruns.exe
"C:\Users\Admin\Downloads\Autoruns\Autoruns.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\LDHFAH-MANUAL.txt

Filesize
8KB

MD5
89970ffdd254f9ffce0df4cf779a8d6c

SHA1
1f4a084a8b5a815381847708040c5f54c0233f52

SHA256
78287788eb71e71e9afd624c3b6ad7e08e854fbc33c3374ad1fb1672796ffcb8

SHA512
bbce137468f2f82484a4910a5a994a32fd0ff03aa0297ff810a3d523eb0f7fc515e259bc55f4b97d3a8a55824d2c2c46db5d08803b404d8d6e34e7923864e5c3

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6dcdaf15-b237-4c64-a480-83b74142c8f2.tmp

Filesize
12KB

MD5
f50b99d6fdd3456ad7a6f1e04420f371

SHA1
2dc4b9f047a9ffb3e1a146aa42a15bae6394a457

SHA256
4ebd2e5375690002ada65fb0f9ec27b1b8533badfe4381936d2083829931af30

SHA512
2827dec3b0fa8d8b50f2e5efe73d449df348922a3a888c0d7325a0c11b88fbfac367e13afb3e3176e0723689ee3409d5d2b6b591248e07c7b00b1479a6d6eff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11555d71-b706-47a3-86f1-566b14646ece.tmp

Filesize
10KB

MD5
4655866672e405b60aeebbd474ae0597

SHA1
2df3b24209be443aff61255ac1de01196f56dd1b

SHA256
5e64ec1103e041f727a6c80d10645ec75c4f04c4c883273735456945eaf4fb47

SHA512
a32540abb4dbe51e015ec5f74d01d0cb514ef6d0852b04a0fad3a679abe6163152cab67d3f93791be85a7305b510c6fc45bea4bd76ab80de4f566018c2341b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\175045cb-4537-4b91-9a3f-c3d1e8b43101.tmp

Filesize
7KB

MD5
e772863c44ab933db54f3d7b8da1a8c9

SHA1
65245a8366576f68f08a4288ad2225481db888d9

SHA256
930f1b12072bfb9c962c186f735b89a1d58f9cb77e8fabacf44c1cf6d8841902

SHA512
0b9b53d196c2b8f8e357ef4222af35b80978074d46e372ebcdd6c72687524b84899dd10dd85db7eb66777fa375ed9218aafd22f3dd543ada4927f7387aa37667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
38KB

MD5
d4586933fabd5754ef925c6e940472f4

SHA1
a77f36a596ef86e1ad10444b2679e1531995b553

SHA256
6e1c3edffec71a01e11e30aa359952213ac2f297c5014f36027f308a18df75d2

SHA512
6ce33a8da7730035fb6b67ed59f32029c3a94b0a5d7dc5aa58c9583820bb01ef59dd55c1c142f392e02da86c8699b2294aff2d7c0e4c3a59fce5f792c749c5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
67KB

MD5
fb2f02c107cee2b4f2286d528d23b94e

SHA1
d76d6b684b7cfbe340e61734a7c197cc672b1af3

SHA256
925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

SHA512
be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
37KB

MD5
c67ee59476ed03e32d0aeb3abd3b1d95

SHA1
8b66a81cd4c7100c925e2b70d29b3fdbd50f8d9b

SHA256
2d35ec95c10e30f0bddbfb37173697d6f23cd343398c85a9442c8d946d0660e3

SHA512
421d50524bd743d746071aaad698616e727271fdf21ee28517763a429dcb6839a7ad77f7575b13c6294dc64d255df9b0a64eb09c9d3b2349fef49b883899d931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
37KB

MD5
c130e937317e64edd4335e53b17d55a2

SHA1
51bfff9dee11ab5a8c43198c0d6178799ed9433b

SHA256
46025a134ebdd6c6464ff422818e60938fc41af735f7951f4febe29f57612a49

SHA512
68e5fa69101a7347028ad30d7c004dafabcbd8f8009df90d0471b19a36741075d72da56a2b1693c2067902630584bda5536f0702302db5d69f407424d4a964de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a

Filesize
20KB

MD5
2766b860b167839e5722e40659620a47

SHA1
47766dc72bcace431ee8debed7efcf066dcd2b59

SHA256
725a5e52a501bcd107624aafa44a857c00d02286fde07be774afeac2efed68c3

SHA512
a97f77977518ca755e9460cac34e0b5358ba98b3624c53f0e1ef7b947e62a6f3f99caf2852fb3132c822525d88b67b9c1ed778b3e40083d9df36028c85f73ae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
19KB

MD5
a65f7f00889531aa44dda3b0bd4f4da2

SHA1
c8be192464c7e60d4d5699f6b3dabf01b3a9d1d3

SHA256
0dcf11ca854f5c350637f7f53cccdaf95492dbbf779b905138e26b1ec1dc91e3

SHA512
6f48f0f7cc1a35a9068c1284579db065e0fd4b2651355d68a8ff5ae9df86090be3f6e5ac4589585166829087c8bd3c37431a7066358eaced0cdb6c5a0d544fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

Filesize
17KB

MD5
568f867ac41d3e2fb0a39b4e5aa2b335

SHA1
3ce36e229e8642cef02fe9decc84ee23f409b413

SHA256
86a625287dee58fec499322a390a33e33bd65f99bae9479b9c4a1f3279acebd7

SHA512
badb4a434ed850834a7b188703366d68f3fc5683e8f09e7930e1c714059378e1018b596f17e452bf514ed237970d02d6d93d2305990975031e5de568619801c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
58KB

MD5
2389054bc92fc6a9b9d21997feabb1cd

SHA1
d46b4bece5021bbb060dceef4273475b879c75de

SHA256
5c38b4d4f6b902a99e4eb9cd922a2a2a37b549388bb4dda0b756bf6d5887d6da

SHA512
5525a4228fe65d25f0084fcde29dce0b97b80126e36875d226549f379e56ae52c0b2ae12752b188fb9715812d14d740f1ebf35f3ebb5c1b4e3b564836ed30b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f

Filesize
38KB

MD5
ac4fe833d49c8e4a1663a899fb6b424e

SHA1
20de74e9f2b41fec8395092fbeb74a514610535e

SHA256
895e500a649753ead47cb347eac8de2d1e80d73e762dde04c64fff0c5abefd03

SHA512
09feee3f925e4e493b2120712848a1f5c2b8402299417b66e9acea5f56775b129db538df98c9e1880e21ad3e605f46f2eb6966b41cfb85a8259482360945e37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062

Filesize
99KB

MD5
2940076ef5b451648e126653123622ea

SHA1
46adb402ebad36dc277bc281d15b4b9643c4cb6e

SHA256
2766045315b53c22ce78b0c83624a7f52000765c55061a9deae19ca67897d664

SHA512
f695bdf186be90f1df6d303bf5beb5bec9c71a069978fb6adb23b68c893ef7ca0c5da2cdc32d39cdc9a8f0bbcf0050abeb3cc02c75a2861d9434591ac8680922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063

Filesize
19KB

MD5
ca73096d241a63e659343bb1175f6c3f

SHA1
0b95ffa70bbc837a9a9fe1ba7f331aedae1e8902

SHA256
a9e19c42f1330c343b458f807cd1490248adb5cd795407f58289a8e6c4f5e66e

SHA512
bf7d5d7d2916b6f10b71acb08fdac75cd659b2115c419eba4d3ce5d8cd056e387cb4917fa83f0f470202a3d21a23ea9ab707f9a388419571b803df79eb7f3d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064

Filesize
19KB

MD5
9f35ba270e9ea92ab439941460109ef9

SHA1
699dd11d06d2d5925cc91c2df7e4fca4acab56b2

SHA256
344f84869c6a5fea3a0ba409a9716b2d5e83b27bd295603d72bdfd6f8af98f24

SHA512
8660fcca9cf7ca63ccedd93e9606b5362babb0d2b7525248d2530a1656043aaddfbd71d4e21cefbc1669f97efc2e54f6f5e60a2da51084997dcc56f02ef4e750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

Filesize
18KB

MD5
7d5eab356faec5b5f4d54a6aaa773bed

SHA1
25b586f3c878feecf21a0e7456990d9882e818cb

SHA256
0d2392b48ec59632d23269b239b2153ed66943717a0d3711628fc2dd52a2119e

SHA512
7c7649ecbfa3deb35a6f08134ea3703a639f957a254454f228f4ded47b6c5a73f03a34b8368d789a2b92aa7a9a979c9aa1fda64fd5531a404d3b2f8997dc54ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067

Filesize
63KB

MD5
b470641c453d5e71c3d924ab3b79a455

SHA1
927594c292bb654e40f1154a40c9948647a9b9dd

SHA256
ab60625b7a253e84b7631e65c2a5fb70563f9e60f2c9faf93af5ccdaf38cf8e8

SHA512
b8173c986ef7bf4b2890aa9bb5a8c4c099dee5f47bdd1ab361a13a1ac47d97cdb26b711ebf8dcf469fb9da777e7bf4e3710a0730b7328c8d74ab3062ebd770dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ad3da63b93fca116_0

Filesize
8KB

MD5
1db322977500acf8c6cc9d48a9844566

SHA1
70917b5b6db5919e7589d45636ecd35c136a72ff

SHA256
a4ed67c9114fe2852784c491ac7ae22997aa76c49669d453d060122bcfa59132

SHA512
6316b915378d600942b6c929cc283b7c190a89a7306faf5960fba3e9182b48c826b41d849e27213aa4c0157460d81f7fe05a16ffbd93a1f226a5d266e8302996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd7a595c72c52aea_0

Filesize
47KB

MD5
a7f0555babf7da5f71d24f4464377b50

SHA1
0585ceeb3dbd7b979e1d691633bb65fb4c5924d2

SHA256
74078282e48c771cd9a285c608d78006437ae848e3c96d1cdd4a7a483c44913f

SHA512
10be3549826499343ee32cad5cfc51ecdb18af045f84efb76555ef1d6eaa0ee37cf24ee40315d4f06d28a98d32110fcb149df5c24ecd778c0f3c6cb147783d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
c2d7594b6b93cda2ebb53d39665eed3d

SHA1
e720ba2c1ac06b93e954951c97dbdae71f1a220a

SHA256
18cae3cd9d36f2b7c4779e8c914b90c2ce41a3b648854ad582c262b97b623e54

SHA512
689f9df7c48eec6d6b252344a0e5f42e0dfa458a8e185f60cc17f89c7e88c915a03c4c73c3cae12a9c8e678405f4163f36975941e6db64725410b790006f9f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
84973ea218c610235532fa17502b610a

SHA1
33de95fbc4a721e63794b51e665da50a9babc3dd

SHA256
c5147e0d604d36a1a6fa4526d38884218bc13db654fc2c2901f42c1e29246300

SHA512
7802dc06a291dbbe4e52b650c2fb6dc855d6464a222e8959d9e85f99fef8aabff8c73a8b25edda2654775c17c3fa49b57c36f4f000cbb2760f1855436ec099dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
aa95de4cfa0c97185badc65ece2b8342

SHA1
f58f5c6f9004b5c49e34f7494859c4b3b64e68d7

SHA256
45942b23013df46f098978a9592c816c23404a9559a6cc2cdbd070e6162e5247

SHA512
310d1a7f571d1109ab0342853e633b0b89ce77049942d789b39caa7d459b68654e76817c13a920844ac1cdf4369c6974cd5307a750d3d2387a1a671d0a74655e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
6f74bf3cfacddf09d917ba20a590a660

SHA1
7de852023d01dd6aa11fcd2fab462347550c1495

SHA256
ac3ae83056e95de1eb68be4f74c18a81b592bef96c1ac8637a7cbea10d0164f3

SHA512
b9bc5269f31790a3c438167849bef1d92571e9d37add64f1c0de107533de2be470e5a45d0f183d332120506780341a2a62f26ea9e97ede32ff6fa696977f4e93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
74e190ccb688a7a5f827e29c0766ea37

SHA1
5b5a520412e9a241172221e27e52ca75205ad8c3

SHA256
f7b9e135c923911b34612b0e3512bc2d7b0473230e39c11335a551f80a792e3b

SHA512
02d2c57e76ff7f76f6b348c094d78b1eaefcaef8fd7ad3649edcff0fc1f3ff4b01e53b865671253d9cf824fafd86dd1867099622d25b102301f777e6519935e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
385c17e0a4bf367c852e9ed9f48a54ae

SHA1
191111e82a6f79883b317e507dc1ef4b78399a7e

SHA256
5232eed710ca527509159562d669cbce3d640164bc643a936a81f5ceb5e5a481

SHA512
8d826f4775c868ff955ea90dad5f6aa74575fdb5ef43c0def7228e3bc8d8b05db860ef666675b7daf7abcfa5a6c8d1dc8f2931cb3e9dfae75ed544beabadad36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
46a3074c1a863e94e542fe9b3bf1872a

SHA1
16c157db94555fa472f2390b5cb378e9cefc01dd

SHA256
4a09533417e4545dc4bd8937b659bec8d16e022dca10b5b52f0d9ffbb3bf8b6b

SHA512
7d517687882b3f9d1c005f69d941c66c0a0d0c032c65206090617f2430e01e158a2d5c60e20a19716650b2ce5f571b25f17b861e92a80ecff73eaf0b58ecd316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4c072491a5f7f86206bd2285b40749eb

SHA1
8366f050e89f7f63f52522d65686e54f100cb36b

SHA256
a3b49bf13778c279f0b404fd2014c735b5bd052dd72d2338680aab76a8db278c

SHA512
ad8e3aa5d978ea409d158181b59719fdabb1c9ac7e9db85178713ce0173087ee5ae5c89e18222b87a52424356eb15ba43e769a326e4db52d3e0b9efbd7af378f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
85c10c4ce9699119e97950fca99ca4bf

SHA1
53f7cbbc34d924ff58a374c382ecd6736cdcad4f

SHA256
a766fbfd81c860e6a2780267d7e8a2f7629afc6ab34bd8129f735799b0279d51

SHA512
6a1ad057998987488c5992e3881af12b240f7eed04b2da874598538a0ee43286f22128b39f93275cc58a9117c3812462666bdd8b63f175bc337f914df62e20f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e39fd04dc9932816c7da333aa47a178e

SHA1
e6c6c9a7fbc9abe3af1412560644827a3b7f3d86

SHA256
6dcaede4332d52318e982b6fcc9a3c6c2e62748ebb70e809b11d5ce51df6df3d

SHA512
c45c7150d449b85dc700e4567b35f658b3ceaaf399e07983268aad2e6a5d47240ec7782b97d2f3fe8efde24ed051eb455f9d3cb96177c6c0dbc592860747f8e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
339cdedf9d14d012f1f6a218f0ab572e

SHA1
3e52323b29cdc2304fc234dbc42b6999dc409637

SHA256
4cabc7c91069333115d1a4acbe0ea2d0a56f30e7975ab75285966e721ce76859

SHA512
c66b93a1071e3c26fc591ecfd2be3a858d7503563302fd1005e8e04c85c5169f6e0a329938c2f81cf522675e1158707698cd7d5023ea395e1fadc423da7d66b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bbf95a9e5c11f35d850e43a4be0cfd23

SHA1
7cb80f1db18790c269d189bc845a804f80c96d64

SHA256
c67e3bafbc9313e74f9ddd1e156bc14657fd321ce172b0db1c133a3cd950d2c2

SHA512
c2f1a4a609b24a223cea03f19435ee446d7004ba3e10b4a1f2d46627435d1e49c6498a25ef9cd776bb2a9d2463d884110720af642b04aff5d9198acaa95f8342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f8bc971e39609958c1632398137b9fbc

SHA1
4f9d40f6eb5f0b865f011befc99d82685e3f8e20

SHA256
73de9edc6454a8d770eb3524720d5d8c8246184213708485b85785fcb0c1408d

SHA512
21183adc3fde8b600d1003cf776a931ff90437b01210d67291ef94e4c55a88d0205c5ebd353fdc1b4454a394e662716e6992b29f5dff0a70cdfdcef88561a709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
3e95e2aea4e07924b4f14e5786afa9e7

SHA1
aee4d2137f5d65011d52a5e52ee8a8e8affeb20e

SHA256
92d6730a4d8ef0dd21e899c844cf5a8c259d41a0ee56451decf58cd68671b575

SHA512
1b4c107f5dc2d44c90ffaf7341cabb3c20793f24575eb6fc0ca916e91fd84abb733f514b7c785d67eb55d191b1edbeba39b20c575dbb15993d61b7e6fe067de0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a8296bc377121484cbe717a574042f2d

SHA1
23b4473f97533079ea9eae712ab49cc79cbafab9

SHA256
6352d6b766ea539696bb3dc48be2ebbc085030b98e744fd45cd8dd7f97b49cb7

SHA512
b4b0cc8867a3fd24e2e2da5fc0a9d00e346e1845b5d7cb4610f16f4ca5ba601204e389a2a08957137ec0e899b496dd8558b621e8715691971d51117a6111ecb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b104e89c7ff1f55981da24e34895cccb

SHA1
e3fff113067c5374999148932e2971a2b245997d

SHA256
0c086db3abd8e16db61b8f3a2ee2423aeebe3bb56c98d497270af008366ee468

SHA512
00483abfe830346604d1adab8d75a92a16368ccdb75dd4251a757936d188991c052150f1b6facecc66b917da44ad781f21a5d2697d0ba4a92e3f085400527ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2a50894478de16ab14208cd24361511d

SHA1
fa78e2562680cf2faf6421a552538af28f35f706

SHA256
1cbef175d86c45b0f90d4da8b0dbf108604319569ead76496adb859a3d3758da

SHA512
ae5e69feb40ac336148cf13d88a44008e2a6005955dd135703a6e918df17c47f95f7847d923544b8b3337ad1972230ddbf9fdea245d910a410c45cef301f156c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
f2784da05e757d4f47e75673fcb82695

SHA1
f2d539069f964997c61608d803367c4b8ab42492

SHA256
503d04993956814b3a1419528cab892ed7bfdef1003e8f5e088cbc4abfe4ec26

SHA512
a4b3d1fc08b5203a4a7c11b487d8179d3105b60ac39aab26e06ba3805a64c64b28acfea5053fd86035c0dd7cb4d65abfae186d7c74cfe74453627c0b1a32f62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
31badf7457619f3b58ef039bd44327d4

SHA1
14df1082c371a2ffba3433b068571f6983393453

SHA256
9f8245ee5ae2cf3503a1dab04f503432f3d622001688677afc92424ad8721527

SHA512
f5ccdd64568b5a60ae43737b6d2ca867665f4d85bfefe1ee98bcfe7db85ba7ce9c62fa67d1bf03d0802e8c68ac51b8803199f3b6f324e9b991ecb480b45ced3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
fa11d1ad7f399c88cec5f55047495f0e

SHA1
f8285cc054241b542ed3173969809f8b841c79ba

SHA256
6753fc4737788bbcdcb0acb3595540fa50025a033be4c8009c34b35514632183

SHA512
07d30c2510673f549c7a41cd74cf16e0ffb50bbb9b25d843c60696b2821e8dbcc02e67c316c0a848d261ff3a42b35b33a23fdbcd6856abf3397ecd23e4038231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1d2fde7274187abe9cf132e6ff0efd67

SHA1
5eb020d4f4d899f4919beeeb97de93dfe3632ee9

SHA256
21e21759c9d278e47e22764f6f00b061c1e49b5d87df1e70c74c8820c7c78bc3

SHA512
a0f704b458910c7e2d9fff2a3d614d9f54bf1794d3206e9c1cf74d674cda37e11f5de18df50a7bb62a86580194d8f5ff7e02a0b7a69a8625c11312d7ff44128a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
dbf0ac525f1010d03794ed4edbb54b57

SHA1
8ac03e8c4ab60f9825001ddfad40915b4f2c7701

SHA256
5885a0203bdef01f71c4a4c3d864fe1f5a883a725758a4de5c79c79837cc02e7

SHA512
35505e8edfc5ee584dd479c8049ec8dc363fd548116752a82ddb88dc6c3e3fd738c7ced1311c7c1380331f5581bfa5c8a059dcdae4c84ceefd1b49efc650d98a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ce387bb99abb2d152c0d22ca2ba9e61

SHA1
788218b8104924e0132d43872fc8543b56a1d1dc

SHA256
49fac78e6cd91c022b656bf16c5acfda17f1cc052de329d2d66cb961e63f5bdf

SHA512
5511fc44956def019e2506c9a80e01a2fed0252b4dd00b172416d40ef78f5ef39a041ba670b57e44934aab5fa8786c58cb5668af5138d068815528eccfe8e1b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ef810ac1f46300518b45f49f6a988129

SHA1
c5d9da4f55f40c9fdf0232b9a61f1aac0e0a7409

SHA256
5de898a6763ac3eacd0015d383bd5ecc4d29debbd22c3fac5c414d16b8ec5acf

SHA512
f05aa7c73d384a6c9799ca4157c2ffe133abcfb1b85a80af721f52e208d81255e809d9650c520349a1faaa025da93d3563e9c4d0fd13d701a2cc4873ea8f9a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
493c0a47a6b87a10c374762d5869a2f4

SHA1
80295906dd782cff7be159c9df6c36b9d3653c2b

SHA256
846899b71f7fd85dca9250564fb82b4889af11dadc2a80df9935215e8768301f

SHA512
84d703f139ae3c4a5a2e1fba4bc88dd9eea677c4df2db6f1e83afd39ba050e4578ad27b9fd7a5b04b68affabc2c7da9c87deb60cbd31eef496a3cf622d57c648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
abde0d87f0bd53e66eb7db3dedf7cf7d

SHA1
2f75d700132e90a9528a9cfd6d1edff2decc12cb

SHA256
ccec92426fa3c3fd95564b8d21cf0dc3b01a53d0d9c57433cd16d2c87ab7d65a

SHA512
576528a64e6ba7cefbfa72f6e4e3cfb1799f76bb491872719709c0fde8b3c6e69a239a7a62c3a755c77564c9d858f05f331e51a7ac6001232a3b8edf2afd4f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
82337fa22c72598a57ee49467d0ec7b5

SHA1
8053a11b6110b4aea7eec37ec26cb0249f4ba386

SHA256
623230dc9fc0d8cff00dbce5bcba6f67def91feb2cb231b5d3504f769ff6c471

SHA512
886d0f63c97bdbd824b2564f3293dad58536d6b9e74dda919e87c3420e6c165fc0634a98f358f282c42de377f13c2273a8d228a9c37bbc6275e288f9912d36a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
fd5c7d5cddcdf6c420f0f62507cefca7

SHA1
e69b735c13257f12dda49f2430957fba37819f90

SHA256
65491ebb1210b1477e2021e2cc0a809123b9754b2bb55f9fea91acbfdf96dd12

SHA512
dfbdf09752b08bd954df0f4b3d0c04f12d10d24145b41b7a0898a5dffb78f2d354c3a5deaf0474134988f8413adb6eabb2442d604245d9277af75face1f0f628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3567ba7eb1f62333bbc61e5657eaef42

SHA1
5edea80f4d19ddf136cbb45dc6762a81dc42246b

SHA256
31cc984478be07f552667ff5bea1dd7429c25f4f82eeb90a8d9aca67b39aa26a

SHA512
f370e9d21318477cf88ca5f11aeb12270442f87766dd4eccca4f1b1f10f2f6d108771448adf52f787b1aa968c2e84a9d28850f66a7967bbf7e7b357e3dd3ba58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4e42a01fec3f6708289b4bd2c8e5a5db

SHA1
de5df8e7829d302a14387a1eb69730eff34e10d6

SHA256
e68271f2392d79901f0571ec9cdf4a54cd5db0cd60eb107d62a444df5bf6eeec

SHA512
ee73055e0e625dfce57c0189ee77aee01947ceef83214de9b5a712ff54eb0cb36f7bba515236405e8b572f3cf228bcf3cfa32f16e08622e64e5d9eb8765c9c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ebe53791a69eee8e83237c0711c92316

SHA1
9f5dbba4039169cd7b5c6dfd184a8c694f16e83f

SHA256
1490b8850b8930b1aed3d6350e885e0cb1e5e71b0f394e09e680ee651feed38a

SHA512
9a4ddd936cc56f4f0dc91a337df4b66b965baaac0e54440d090661b40ea5033493cc1d809c6051941327bf018dbf3b52e9cc350edf805e1f6fb3a56efbdc971b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09b3e107777413dd8af42f796a0ce556

SHA1
88fe7e97d9a3a1461de4ff0d5801307876dcef3e

SHA256
3aa0b73f00c281a180200abda3a8e832d379dd13a8e16a1b7b83ee125c8b5039

SHA512
df3204d0254944c458d278b9b94506581ed6687409810c23612764eb122c65c462b89520bc5d1ac56eefe20f52852136c280da0b2749911658491a3ec3a1755d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
22b0e1a42269e770cd2757a9156bdf36

SHA1
965ee36d1e787d6f7dd7807b4bcb732e58f15164

SHA256
7f5cc4317dd51df6e16d2534927ee4d378bf9960fc61f332b8a146b0b6114b91

SHA512
4d478744430ce2290fecfb2aa9ccc6c97879f51e8df3854f9f4b46372bb14b631c5bd66d11782d1f56f7a790eecf0e37b905f8cae39f16216eb126b73731b3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
90fc2485b3008c761c4d83df33bdaffa

SHA1
60a5e83041d3103b894b8c4a56f6f1ee96f81ad6

SHA256
afb123d4594e024da3536da4a1491a7ee942ed947f50fdb80149b6f3ca49126a

SHA512
5ada04805e79e8a8436fd6f78fbad85ce29313c5bb952dbb0ace464deec296afda0b3e718e277e8e97c9be553c86ef099e609815005dfc8a8b5fb668f8670f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6cb65d4e26117df1ae76ad6ae09569b5

SHA1
dccebae4bd970aefadcb94e0bd737b20b8e968f9

SHA256
08507da3c5437847b0d65df36dc15b89b6e81a6f1a9b55e866fec6f6f32873b9

SHA512
d6dbf4d8f0e09d97666f9d115bfe84822d4254db2800e64dba5ee99a926c2a2c45d8e8d7f2666ad05133486dd71f03bde75a32a916522dfa2bd96a0f86a1eb43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a806e0f8ec1c3a38102eadf55d1e7454

SHA1
48737f873a4b48a34b79345113cdefe140af9f20

SHA256
2e40b0c9eb7a075683051a3d97a910b1952177007d1844b71947741daa293fbe

SHA512
d23a85ddc7693a7aaa15b9042767a5388fe8615ce63044722d4c34a5222eae47c36d65cd98190383b44a60a5156ffd7ffb7e4708ca4e18d4f5e478aa50bb1901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f72f384bf06aaa3f04d84469a03de42e

SHA1
3f3b67df2bf4fc8ab16f79fa1aa91c254926a29d

SHA256
4adb49a0a231a3bc417f385dbbd9eeaad3127dbe7013cb501dd13793b8bea0c1

SHA512
78342e8a0a0767ae9f33797713c72e38c7452dbb0866c5c028635c718b53540dd5e08c2a857e8c2ed8c9340553ed9fc5aa655535ceaba2e8d355b07febc2f414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
574f67762de4e8c702f2322b18dc538d

SHA1
2251095c9b8e56261cf52cd1e6453bac6b1bf1f8

SHA256
5092588a668e3c2086847a80ebc35f280feeb9b43886457de9fce0a98a2615d6

SHA512
c78114af938e5a2bba7c7371a0bafa3240070d548ef9fa451b93722d69014b32f46f89c80fa46534e1547e48dc0c13432ebe426bad68ea32876c18fd56bad9f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
408ee3d2ee8e6b9e9e74338c4c8b4275

SHA1
a843abc9c3640975ccdb608fac3b99786e56fede

SHA256
7971aff2bc843e5f3f827c5004975de47edad8ee4eacc243399b196709d7dbe5

SHA512
21466bca84d630118252d98a1ff0a71298777dd1e1e3efc95a9c7480654842987f0ff905ec47cda58d3a7b59a699b841064d2d8d7f978aceed382a6f77c3e26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f3ef2e66012f5c9f0f78b99ace02b1b9

SHA1
4e61c83f58caadec7d542751cebe2c6c18271e59

SHA256
e700ea1d09465c155c91979e2a6845a1b86a1eb078e8913f949625366fdfbf25

SHA512
e6f1022d356302b2a0844d71d4eebd111c11b2c66fcb23fb951b6a440786e17ab268f0845c0c5214c015ec4319eeffc059687aaf0d931e39bcedb722dfff0a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e85e8c2d59fa3df650e57e33415fa97c

SHA1
55310aee1b04b2ca1044c22b511b7d5577f6534f

SHA256
2372708a86d0e31f58437201da816216b76d2748010c6bb655d7961b1eb08c71

SHA512
6fcb0dd4cece68dc803c2108ec8b1e59c6aee485eabfe11e6002f06d29c73bb7a4cc3b2fbcda29eeec83fb67d37a0e741b44b552dfebe0567b5cc3dc65100b9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
05a5f436ca3377ce6eca033a92afd748

SHA1
48e245492b1754922d03e3e79568456a14c52079

SHA256
f2543a5ac87361987f5a104ce14f0dfddf4649e06aad07294502eb7496b0f507

SHA512
7fdd9156b80e483d77180cf019ccf26bfa634027b87755f62d5e316b109e598d7be5fcbbb2a5e71c07c00db190f7d2b230efd31d894882e701c43e464e3ae99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4f305063d69d873d7357837e2a53a1e6

SHA1
4d7b41f71670b85ee73756415f7dbd08dbceb28d

SHA256
cc86f2208794b9df205cdbab65d1e26c330f7ad6e53c505dfa400f99765c83ab

SHA512
4bbdde1cd08d47a3baa6c03bd261223e775e45453917d9c5ce80cdfd29df003296de61fbefac49851a1a8a19e2e3134d3ac13a0f57fed37e103768dc07c69008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
431e45b67d27c7bdac42b411b72a0770

SHA1
3ebc5b3c72b260cc3543daf74ca1e6c8546c9bf1

SHA256
5564311d95990b07f8c210c1553ae5226ad33eb63e33e915741729a1a9ff6b72

SHA512
44328dbf01b4945bebe784ba08d4ceed749389e39a6f4d3c6cd12b58da579ee6db5e4f9640917b1d95bacaff37e0f40ef61db321dd884767bef2570aa35e7f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8fba564b8b79456bdacc42530961f7be

SHA1
7b810be550fe0f6e05a45922711241c1dd71c957

SHA256
a239cb5a445b1aed4ab9e170d303e65aa8b3cf9f167940d3a611522302ae1be5

SHA512
6e4c08cd7609162719bc779cb1e7df3f9912efa8134dfb51cd9000a8ddc6542ab34771c0d38e63b5e8e4882d124abcb83a0a7b0befe93f30829362a4ec5b4f36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
84022b3aad9f5ec835336fe2f352ab86

SHA1
bf8812088675bc6751f9e9ed0d4360cefd2e8d47

SHA256
37bfc4499892c374d8b2c3a61eea4900b0a1f0bd819f3e777eb4b2ef4f5f6ba2

SHA512
eefe74f7e9b94c3e925c7b00383cfcd6508940742d1ca8feb812193a84429ccf3198129b703210742032d24e25e992bf308e6b4e43fb31e5ed1fbc3661e5b126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
066b2249393a6de5cd758f2afeb21499

SHA1
ab9c7546210d943e15d7a207dd2491d797e1df14

SHA256
65d4b559d0dbf6186b0b6fc8ccaab0e3e3a39783dee9fa3248bd6faf43386e67

SHA512
15bde8d4ff1ed1213f6563f5ff1021f4745f73e210b00eeb8498402ea87df006fa0a6b90519cdd76914ae9f2447cbb63d458a9d094bd679f06bf35eda02b037a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
14901f05264097ca4c1037ef051ebb32

SHA1
ecc2365235ca304d11f1d9f707484bda97b8382d

SHA256
c51a7b29274e663eb471c17c08ee73a5d97804d4fec0d829e253bd808cfc96a2

SHA512
a21bb220bca123afd5faddd0c4ea3bb1ef7a68bf2141983dee00d4adff4fa9265be57be7628cb71a69f5c6e3c2195589dd1ef8c4efefc00c7c28f3b20dd2adcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4f80b043088eb071399bd2b84e4b6c3a

SHA1
9e536462f39c9fc95d4fcd9a9a3fb7340452b30a

SHA256
7068803781e6dd819e300c583c2a4e9fc6764662d0f017977006264b665f309e

SHA512
71b82120dc956e3b0e465ce1971b807e0d050fa927cf820ecaed474a7fa3c7dee94206def7bad507d708d255438e8649aaba02139fe7757bb41aa2d5fecc0845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b9e68a7f8b498f9fe6258ed0b507ec03

SHA1
c5884d24b254dae5b835bb83157376017b4756fc

SHA256
a10db248e109b63bafbf8f3180cc23cb7569d9f62bcf3a7d1384b6d85f9fbfef

SHA512
6dc7e7a8782ddaf0d6945c931334b7095d3753ce6602294a1f85035aba438adad001034411e51cdff92cc8cf9c011b9488f2abc782e0779123704afbac989664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
72c3275737efe7ac7b9280d044fcdadf

SHA1
a9be59dc600a8fae61b559840413aaf1dd49b750

SHA256
5709f1c3f3074b8d329df5573035035d5b1c35a5f9bd1c5ebb6ef418434c4c7d

SHA512
5de021c9118e224da265dc529c5127fb84a89ef689e05ece0e07b91f0f9ed15c69519b228c24e1508d48eda56ee3f7b28f283f310d88efecba1bff946cb0e1f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1640eb1da6d7d4790247f279d547583a

SHA1
be88dfe816904d9661d3e11ac3ccba823259d97b

SHA256
92b02cd5eced4a47588c66d3ee0f928cbdb59521662529a5418fe7c5c7e7ef78

SHA512
645772d5d524ed08a119ad65c831a81b6314c6b4441f05195647b6c4e4c0897945cde632c9abc128891271ca0e5cc33f6a63726631c1c52b7f3fa6e669fe0c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6aeecc7adc2e377ee0df30ccf9918da3

SHA1
94183c5c195190c048e8b133ca1448247b885353

SHA256
d8a51c87bccb390af8fb80abe2ec8e1592f9561d8170b4edcde75ee7976e1778

SHA512
20ad5b02063d061d09208d6b8b34b42562672e72ddde90b8a98dee3cfac64d0b38557bd4e37b0d265e8e605729ea1bd93a367173207f22d8d9386f7bcd02e633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bc4c5de824d176734b18ec7a976bc188

SHA1
e9ce7a17563a7aa1887cbf785a8e1ac766e1a8bb

SHA256
28eb5b4658b422bc96a8927817c15dc21e2cde0183be855254ef44060b29cb20

SHA512
fe1956422da48ef1c6d461af98d5a1be052a400ad8393dbc1c38ff2b676a28fadaa321c19cc7e3017a156a6618a373c1c0477f92d5d39d70d2e2e563ff21af01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1e16210bf9e0323406336cd7b9bee45b

SHA1
b82699715755d53b1ed35a7c1cd4dcacfaf5f81f

SHA256
2a7bc82a451e92f1544ee6514e5137a11f80ef404b12b8b29db02e62f9a8bf50

SHA512
a334beab238878aa472ecf05c34a0d79518488a9683240e3fb63c0c99c5a97461e68eb5baf51e7e3e65dacbf07bb16641836acac79c9ef8ad1706a8d239c66cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8285f280f71140a78f2d9c4e155b1045

SHA1
96690cab72a7a388c7cb985ea2fb29ce6598bed8

SHA256
03bea950e1ad349cbf155da22a6dbece5ab001df7b59d3f55957f068d41c58b8

SHA512
6bd687614a9842040bf7e04513deba1e8e37b11f1804d8f9206b0a55449a1c697839ca56911ebc18f4355c9501ce44511584b4fd57b0d9d990518c330cd257d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e3fd1bfd9837387ae4bb0bad5389283d

SHA1
a8e603bcadf7229dd5b4c40157c8497007882bc7

SHA256
e5ed7d872837cdeea4e3448fbbcb3c94e3b4322272106311339f435be7f48b10

SHA512
09a72f97ebb5fca636fb535d63d59aea1830a92d2ddfbf4b6d245b26a30cc50509129231d663365e30c95bdef09ab4708d532e9955b7cf735e017e25fe005705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
844599d07befe79502eca41df943807e

SHA1
073026e4a1de511eb79b6366f32f46c4e903cde6

SHA256
4a7865a8adb2d92db00b72a2417ea854b7f3e71a375831a2387092262273c06a

SHA512
39a96984a072444b4a127fbd3ddb48939afbe9234d228b099c030535db0746ba954b07a42a0ca02630ae5eb29cd4ddfd7348800f2c753827b594d1fe41f94120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cc1f25a8ec24d04437dcc5c2a45ea727

SHA1
4b07a5b9f9b451ea026f376a008bf462ec1ec338

SHA256
fea89935677c63614d6d3c54faa9fe5c8f91812335b19234a35d8c8fdf783525

SHA512
d1099fdffd6c440fab31a79beaae0b316c5c3b0455b079c7dc81b20f46f8148219c1bf64afcff6f2dc820c983aa0baf8d14e02028635064fe45b3b26c5f209d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
010b8804dcc38778499ca0923d144687

SHA1
a3b8d838dd71595794aac4f47beffd535c3e0c50

SHA256
d97de3efb1a49036796374d9767946a7c0225c27111a250ffae24110faf2f65b

SHA512
f8341422266e3047dea9fdedfc7aac81739208ea90645ae21d11cf24141156a56b6957c742e5ad30d7c29104278b50b076d11440736302a4fa133111c829e6c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c6bb35b3b9e1602831e04981a43e31b9

SHA1
6e79298a5fe8593de021087dcbb709b4fb07a5d7

SHA256
a17db69b1f6f1ec5f68ace40a3970333e147d8404ddd52275e2b0e41707638fa

SHA512
941ab4b2a478a31e8a289c8a22bfc4e3c49e67458102e416e15bdce655cf2ae6c65288ae2341c49ba573c6015946f030332ad23fdcb9592e4806e5730895cbd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
429f79253eecf04d7c7d923bc2555d4c

SHA1
ca98a926352406cb8395f3697c030f72da4b9473

SHA256
22894776688a1bd964a1e8bb260c9003528e1de9025264323b8fb0da0f8df9eb

SHA512
9fd3bfb0c85c5dc1a1ed70c606f840173da5265ac909e787cbd05df5099c64f221df1e4c01e9bf20d988062771386fecc8b9258ef3ec635891e8b01b8e6662dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ee89ae47ce5391015514844ea69e9423

SHA1
1334628928c0c2641b07c15f6df1854da6279d87

SHA256
59f95e3949968958413fb0b5dba658699db2904284fd5e360f7ddc54618475cf

SHA512
c7974ec8c546bfd847b60d9cabe75a0701521174d63eb6d34c20b1c698d0a1dc23b60855c8925895a1129e9112e60da10f4e1c772f64eb199fd21b5caf13bdf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cb03e39869556e612086d07432705c10

SHA1
3849faf416d5f62f01a663e832c78edb7c9f2f2d

SHA256
e676efca52b6b76d88d2a89223de6baba8a8311fe168bf0166cc8438570af82f

SHA512
53c50b7514fd86b01ec7fc24a0e8ab7c97faab9661df6c85290f8a3465768685081ae0982da69806215397890d5cb698cd81679e739fe47bf5867eaa4aced639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6588978b0f5c9231bd5554c0d9336741

SHA1
91f3afe39197a62caa76ac6754a4eaec1b5f5212

SHA256
b5172bc7e45a75b79e2a65755a44e8a104bda9be6ed055bae2869bbfa2a282ad

SHA512
28aa88cf7e9725082ccfa78e5e3a9f3594a71916f81bd873769dc1a795b234a0caa332d203d0a7be0932a49cf828caa24f17f507415639454b49609043b8c5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ee5c69f166a004d03421596c4a4231cb

SHA1
aeff0d781a4f91688230cef61b87a87f82349771

SHA256
34fd0e1b567d49e141beaaba358aa70dcbeaabaa6728d441778847404f3ed271

SHA512
567a6b3770b81aeab5177966c486461ad031c2e737838ccbee02870e3d7848dac8707ae2ec177bf8161f8920a4f6bd2fe9c9434eb41fda686034d9585bbb33d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cb79.TMP

Filesize
372B

MD5
17e8910893b83fae2f2dc5531f1d70f2

SHA1
f55e6bb19a5dfb46cee08fbcb471cb5c7c4d001e

SHA256
f82cf58de433de0cdb4744725cffdcf9b4221309d81946258fcd42f8cfd8a62a

SHA512
0acb14914992013e069ced3ee93fe3cc7ec2faa0e01b96775da36b05b1143cd24d07feb920b4e802d83ea0297e415f049b4d288d1bac3a478867264d58171c1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d3329010824262ba0e7729c60e726c9c

SHA1
6167b63e0f368aa457e67ce3177b7111de0942a8

SHA256
3c5c39dbd5aa41b56dbc97d41790d1ca563a3a4a71af43fe0a305cf60a72c390

SHA512
0411f62aa3aa03ab4c5a4598cc0e517d60ef2053e323b7a61662809b21df346a5dc4d940a773392e6da9556b2a189e7ad062007794ad50a0618d12e168a3efd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cc1c9962060d350b49a023ed65b563de

SHA1
59e558f71dff351c581a4a2f871b5fe344af2840

SHA256
965274a98cda01657f2fef4c7137e95655f18ef896f4d484ba0f391d40f83040

SHA512
7474afbcbbeccea82f65f4b93ba51ea4c329b91506e557ec4aa8afe37303383d4c2c07bd422a0051ff7a325f66d6ee16d96e92fdfc933fafd181e0b30b956c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9b5050d605165e65cf4e42de1f98df2f

SHA1
5cee1bb55206ac408a2ea9f735742fe2d647efe2

SHA256
954b3140290565fc7cbf667aac7813ab7818bfa903e4c1a580a153e5c1b4656e

SHA512
91ae3c8a76f8d73c23136ea535c0b23be5ede06bf77e5dc7a46ad5b74495c41abc5837e759df0d5b356d9fca18c246ce0aa839fb52452397bd5d906077eed3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e40ea4eb68e98e345efd734b60c74b6d

SHA1
145f01915e6c6f74f7b7087d2a043f6c6863945d

SHA256
aad62026ae18bf25f707393a332b9526093bab0f16fef0f450713d98cc4c7290

SHA512
427ae537f56da9f53a87bf4dffe26ea59d593c6a0504d74cc5e2cd932a4991a73d41cdf80b9a672700932b55fb64fde163c19f226605b4412b0fe497b5b4a989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f5acb5199cdb217a0202eecfed69c813

SHA1
2523a25aca5b1db7fc7e72fd2b78ffa4431aa24b

SHA256
29b48692520a33792e65ac1c6d8890960cce10f34847af1875599b9d2f47d2d3

SHA512
4dfdf65a137ed83074c5d11e64aff1f5ea9ee6074d56dc70471acbaf9139589ab97b061374504fc3d2ec08e07bb49949d156d395c85e65743224fbf91b1559fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1edc5d382d1218f9427eb25a55027d23

SHA1
b88b6a24170ea9d359c7b12a8cac032c706918f8

SHA256
7180289ccff3497c14366b45d3527605f6682af9b482b69b7714844c3a231e4e

SHA512
3967d177093b590d70d9a83eb6790e27590db4f27a2806f7e5b3e76f023e62b1b756264b4d4c5e021ab43ca48ac16c67267ccccb293b1e1b266c2b548820d68b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
502b40c8757cd5d42aa9462ccfa9bc42

SHA1
16659fbd39c2b175a8dfdfca70228cfb8a4534a3

SHA256
e487d123ad65b98a24181a75e76b3f8bb4e8c8bcec72ab50bf6c9fe0f9f405d2

SHA512
d910b0fa93c2cfb5415684cf45ee71cbda6282d4d53e65a51dbd2835c09b29f3ac21b1880b09c32d37d67a3897aacd72bdbdd1cf7c46e297ff29cdfb361cc9cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e595a9c0ad972e75445bca2d53f95bd7

SHA1
8993e1f0b08c20b677526e17f43660a5c16f9e8f

SHA256
af671b2217eba50e12122bfcd1509cf4f588888d6fe5611428bdccce2553252b

SHA512
89bbea1a079c17cc6d1a7c859b571ff371684e4beec5c02d7db403959e42a906cf5cc749dd7b5722fb96c65e6cfb298d2112b542bff123144b6c9ab2775141c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c20fe3cda3deaca637d62395c2686d4d

SHA1
c7b85ba3d8b0882d8cbdee7ce396878b44a7aa98

SHA256
b9984a85442f8a26ffb88e23f00a73271dedf9c46e9828a70dfa0c3f6000b080

SHA512
ababf5de1ad75e29f0526c80eb53a954a07196960c3b1d046badbacfee29e142fe6e37d15dcbc107586073d4e5317cec6caf839fb8604ba10b04e04970a2cf89

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
f588da03ba30af3a528026488cf920d4

SHA1
0d3efc9acad17deb8c49d13d60f5d03eebbc16ea

SHA256
29f9c94c7a5907ff20c426543d5591974d57a64c8c99e3f922d8ffffcc752c7d

SHA512
0fc1b23fbc00ec53125a33dee26f6e87ecdb9a31c1731f7c87fdcf873a2a94ac747acacfb93429ffaba4edf7ff7373328d18e1b8b493e70ec95d9adfa502eb1f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
bcaf0ab264c29b5589d98d6df8664ef7

SHA1
a3afcba26948fa586f25a615c85ec75bc99bfad1

SHA256
f401edf01f6b4cdb4e88050231a41c3f0593ca362eca57c191e4471c38f5b1a6

SHA512
ec66121de439fad758f4205dc453db861b55a8f341b9c345127cad62dbb30cdd4b257e6d678e9c0acde74454e54f3efa73773e5419af52b21e60c645b18c4dd0

Download Submit
C:\Users\Admin\Downloads\Autoruns.zip

Filesize
2.8MB

MD5
09aa3a18f9dbf8588b0a3489f5c752f4

SHA1
130a744a421ca914f2809685af8262c468f4177a

SHA256
b04d2ac6dcc287a4b01a9cdc5bd9580a38df8a3379e03698cf7b888cdab7ea0f

SHA512
d0a18f5b71fdf9df60e604d12c9279322a6aa8ce6001cd980bd9df138718c59bf7023690de51b64e6926f154b2ebd52950fa21a89e5e30d6942c784a28edb453

Download Submit
C:\Users\Admin\Downloads\ChilledWindows.zip

Filesize
4.2MB

MD5
5806c691583167135665b6aac348d3b8

SHA1
34d14feafac0946097fbbc03e3be2b235392587d

SHA256
00cf66b0bab94b1ae74d534160a801315df8a7efea764cda906af49f99be54e9

SHA512
dbcda2362ba5aaba904087a512e3423e2356f0e824e4bd4de99f277316afb32e03d6f8ea109d4d046ba9f14fc32f21a5d80cceb982fbce529c6f15abd7c6fa7c

Download Submit
C:\Users\Admin\Downloads\Curfun.zip

Filesize
131KB

MD5
7ed5b8f6e5a564cedce1bde04419a021

SHA1
4be340967bb9f0c3292052f5078d47ee060f3955

SHA256
f530b4f31840a9544e7794899e0310ab1e99c2ac58c0421a2d854683fb204f45

SHA512
bf1e4b791f7423bfe5730d267d66cce9756f649b3b6d990e3ac4832016a900d3db6352350d179d46d206ee3b4897a069f42b550f25a448b16d9f39fb73a9c89f

Download Submit
C:\Users\Admin\Downloads\DesktopBoom.zip

Filesize
513KB

MD5
14e716c9e9a4e370ccafbfbba4c657ca

SHA1
0aef4c04766d1a39925917e46fc011ddf36786fb

SHA256
666bdf8c339fc5f924f4d31e1ed57e6ce3f63c487cfb218a9b4d7a087938d5d7

SHA512
3ab23f8dc84b39e8444d3b85ecf0e1b882786dd17578e0fed34d43994506101e6034f5e95f6e88b494c989f40ecb3052ec695adbb457662c1864d97c9255eace

Download Submit
C:\Users\Admin\Downloads\Melting.zip

Filesize
5KB

MD5
23f0f55480c0cf9696e56405ac36866c

SHA1
9e5be354e0d554d1afea539691f6d72641b40a8a

SHA256
2f71afbb548363284a237946992c56cd7caff2753ab6b946b48371b91c7980b2

SHA512
4c17dee58d66c6f3788bc9f6a29a8231db32f583eb2ad711bff5a246659e2928a50117bfe6c6017f206d1e467c572b0d898e4f17fa2f0fcb04edd3f490374ce7

Download Submit
C:\Users\Admin\Downloads\ScreenScrew.zip

Filesize
104KB

MD5
b79554fbb0dc8dfc2382b39b5dd3a6ea

SHA1
c92e557a8c1f756108d80d7af2d2bf8c8ca0c3e5

SHA256
ab7d15cf7d327924602b5cd6e6ad43306573ca14198a00d8b5cf3a5ed532f8c4

SHA512
cd88011fc6e0c6377362a0563caf8e0494d622ff74202dc4fdae88f4ccc62727d01523e8e0a430db49b895a793f7cdc718ae96640a7fc839ee94b789f6ccfbb6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 4250.crdownload

Filesize
291KB

MD5
e6b43b1028b6000009253344632e69c4

SHA1
e536b70e3ffe309f7ae59918da471d7bf4cadd1c

SHA256
bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

SHA512
07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 519872.crdownload

Filesize
111KB

MD5
e87a04c270f98bb6b5677cc789d1ad1d

SHA1
8c14cb338e23d4a82f6310d13b36729e543ff0ca

SHA256
e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338

SHA512
8784f4d42908e54ecedfb06b254992c63920f43a27903ccedd336daaeed346db44e1f40e7db971735da707b5b32206be1b1571bc0d6a2d6eb90bbf9d1f69de13

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 981928.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\WindowsUpdate.zip

Filesize
603KB

MD5
d39389492bab27ae228b7bf147167ecf

SHA1
652a4ab9f09826964925f69b951813c29ba0f7d6

SHA256
1c7476c3a7a83ae1afb6b7c00a34c0e117bd31fa4ffd7b0f890e0c90587a95a8

SHA512
d731cacb28e6982667efde3b161fb02ed87609cddabca5552bb59de3eec6f51f7041bfba99a0d1dc52d4fb5c943b5042395983104953ba4370b6eb4c93f60ebe

Download Submit
memory/932-3280-0x0000000000400000-0x00000000052B3000-memory.dmp

Filesize
78.7MB

Download
memory/1624-3290-0x0000000000400000-0x00000000052B3000-memory.dmp

Filesize
78.7MB

Download
memory/1932-3013-0x0000000000400000-0x00000000052B3000-memory.dmp

Filesize
78.7MB

Download
memory/2052-2305-0x000001FEEA220000-0x000001FEEA23E000-memory.dmp

Filesize
120KB

Download
memory/2536-3740-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2536-3382-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4388-3383-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4388-3741-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4748-2335-0x0000023AEC800000-0x0000023AED114000-memory.dmp

Filesize
9.1MB

Download
memory/4872-3300-0x0000000000400000-0x00000000052B3000-memory.dmp

Filesize
78.7MB

Download
memory/4872-3310-0x0000000000400000-0x00000000052B3000-memory.dmp

Filesize
78.7MB

Download
memory/4872-3321-0x0000000000400000-0x00000000052B3000-memory.dmp

Filesize
78.7MB

Download