93537a3e7b05f9a7873be00d310c278969de796cfd3693c5e4677898bc638021

Resubmissions

01-12-2024 20:16

241201-y2hmqs1jbx 8

01-12-2024 20:02

241201-ysgn3szqay 10

01-12-2024 19:58

241201-yp8ndszpc1 8

01-12-2024 19:45

241201-ygcwrazlhy 8

Analysis

max time kernel
172s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DONOTOPENINWEB.txt
Size

449B
MD5

b905963e0bb2d2d4f9a0b6a88bb5d04c
SHA1

182a1ab984d6a7c0359135de45765b41b7c542a3
SHA256

93537a3e7b05f9a7873be00d310c278969de796cfd3693c5e4677898bc638021
SHA512

ef0343f83e33cecb95bd5f1d91210e916aa43fa7897175d5b40e0e2722ad50adef28f9dcd58e33961fbea94be8ec886e4a09d1ba167ca41be73d50c30ee2d5bc

Score

8^/10

discovery phishing spyware stealer

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: js-cookie@rc
phishing

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MyCleanPCInstall.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MyCleanPC.exe

Executes dropped EXE 8 IoCs

pid	Process
5704	MyCleanPCInstall.exe
3328	MyCleanPCInstall.exe
608	InstAct.exe
1724	InstAct.exe
5812	InstAct.exe
4540	MyCleanPC.exe
2740	updater.exe
5704	updater.exe

Loads dropped DLL 59 IoCs

pid	Process
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5964	MsiExec.exe
5532	MsiExec.exe
608	InstAct.exe
608	InstAct.exe
1724	InstAct.exe
1724	InstAct.exe
5812	InstAct.exe
5812	InstAct.exe
5964	MsiExec.exe
5532	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
5472	MsiExec.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
5812	InstAct.exe
5812	InstAct.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	54.203.171.68
Destination IP	54.203.171.68
Destination IP	54.203.171.68

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	MyCleanPCInstall.exe
File opened (read-only)	\??\N:	MyCleanPCInstall.exe
File opened (read-only)	\??\W:	MyCleanPCInstall.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	MyCleanPCInstall.exe
File opened (read-only)	\??\P:	MyCleanPCInstall.exe
File opened (read-only)	\??\S:	MyCleanPCInstall.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	MyCleanPCInstall.exe
File opened (read-only)	\??\E:	MyCleanPCInstall.exe
File opened (read-only)	\??\H:	MyCleanPCInstall.exe
File opened (read-only)	\??\X:	MyCleanPCInstall.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	MyCleanPCInstall.exe
File opened (read-only)	\??\I:	MyCleanPCInstall.exe
File opened (read-only)	\??\J:	MyCleanPCInstall.exe
File opened (read-only)	\??\K:	MyCleanPCInstall.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	MyCleanPCInstall.exe
File opened (read-only)	\??\U:	MyCleanPCInstall.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	MyCleanPCInstall.exe
File opened (read-only)	\??\R:	MyCleanPCInstall.exe
File opened (read-only)	\??\V:	MyCleanPCInstall.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	MyCleanPCInstall.exe
File opened (read-only)	\??\Q:	MyCleanPCInstall.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	MyCleanPCInstall.exe
File opened (read-only)	\??\Z:	MyCleanPCInstall.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MyCleanPC\InstAct.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\BouncyCastle.Crypto.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Papirkurv.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\MyCleanPC.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\x86\	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\geckodriver.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Newtonsoft.Json.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\WebDriver.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Nlck.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\ComponentFactory.Krypton.Toolkit.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Splash.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\trialnotification.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\trialnotification.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\x64\DT.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Util.dll.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\InstAct.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Setup.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Splash.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Util.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\x86\DT.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Microsoft.Win32.TaskScheduler.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\updater.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\TaskTools.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\x86\DT.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\DC.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\MyCleanPC.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\MicrosoftWebDriver.exe	msiexec.exe
File created	C:\Program Files (x86)\MyCleanPC\README.txt	InstAct.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\ObjectListView.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\System.Data.SQLite.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\TaskTools.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\x64\	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\x64\DT.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\MyCleanPC\Setup.dll.config	msiexec.exe
File created	C:\Program Files (x86)\MyCleanPC\updater.ini	InstAct.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF59.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2E8697F4-207E-4696-9C4F-C2AB4A1E6143}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF39.tmp	msiexec.exe
File created	C:\Windows\Installer\e590e6d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\AiFilesRemoveNoImpers_2E8697F4_207E_4696_9C4F_C2AB4A1E6143.bak	MsiExec.exe
File opened for modification	C:\Windows\Installer\{2E8697F4-207E-4696-9C4F-C2AB4A1E6143}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{2E8697F4-207E-4696-9C4F-C2AB4A1E6143}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF69.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1049.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1232.tmp	msiexec.exe
File created	C:\Windows\Installer\e590e6f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{2E8697F4-207E-4696-9C4F-C2AB4A1E6143}\icon.exe	msiexec.exe
File created	C:\Windows\Installer\{2E8697F4-207E-4696-9C4F-C2AB4A1E6143}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2250.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e590e6d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1098.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyCleanPCInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyCleanPCInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstAct.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyCleanPC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstAct.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstAct.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3328	MyCleanPCInstall.exe
2700	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\SourceList\PackageName = "MyCleanPC.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4F7968E2E7026964C9F42CBAA4E11634	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\Version = "67239939"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\ProductIcon = "C:\\Windows\\Installer\\{2E8697F4-207E-4696-9C4F-C2AB4A1E6143}\\icon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3A6CFEEA43DF2B4479795768510CCE18\4F7968E2E7026964C9F42CBAA4E11634	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\ProductName = "MyCleanPC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\PackageCode = "8A346725B801E3746BAED025F900754A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3A6CFEEA43DF2B4479795768510CCE18	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4F7968E2E7026964C9F42CBAA4E11634\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4F7968E2E7026964C9F42CBAA4E11634	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	MyCleanPC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	MyCleanPC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	MyCleanPC.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 749670.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1708	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3480	msedge.exe
3480	msedge.exe
4764	identity_helper.exe
4764	identity_helper.exe
5760	msedge.exe
5760	msedge.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
5532	MsiExec.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
5812	InstAct.exe
5812	InstAct.exe
5236	msedge.exe
5236	msedge.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	taskmgr.exe
Token: SeSystemProfilePrivilege	3736	taskmgr.exe
Token: SeCreateGlobalPrivilege	3736	taskmgr.exe
Token: SeSecurityPrivilege	5392	msiexec.exe
Token: SeCreateTokenPrivilege	5704	MyCleanPCInstall.exe
Token: SeAssignPrimaryTokenPrivilege	5704	MyCleanPCInstall.exe
Token: SeLockMemoryPrivilege	5704	MyCleanPCInstall.exe
Token: SeIncreaseQuotaPrivilege	5704	MyCleanPCInstall.exe
Token: SeMachineAccountPrivilege	5704	MyCleanPCInstall.exe
Token: SeTcbPrivilege	5704	MyCleanPCInstall.exe
Token: SeSecurityPrivilege	5704	MyCleanPCInstall.exe
Token: SeTakeOwnershipPrivilege	5704	MyCleanPCInstall.exe
Token: SeLoadDriverPrivilege	5704	MyCleanPCInstall.exe
Token: SeSystemProfilePrivilege	5704	MyCleanPCInstall.exe
Token: SeSystemtimePrivilege	5704	MyCleanPCInstall.exe
Token: SeProfSingleProcessPrivilege	5704	MyCleanPCInstall.exe
Token: SeIncBasePriorityPrivilege	5704	MyCleanPCInstall.exe
Token: SeCreatePagefilePrivilege	5704	MyCleanPCInstall.exe
Token: SeCreatePermanentPrivilege	5704	MyCleanPCInstall.exe
Token: SeBackupPrivilege	5704	MyCleanPCInstall.exe
Token: SeRestorePrivilege	5704	MyCleanPCInstall.exe
Token: SeShutdownPrivilege	5704	MyCleanPCInstall.exe
Token: SeDebugPrivilege	5704	MyCleanPCInstall.exe
Token: SeAuditPrivilege	5704	MyCleanPCInstall.exe
Token: SeSystemEnvironmentPrivilege	5704	MyCleanPCInstall.exe
Token: SeChangeNotifyPrivilege	5704	MyCleanPCInstall.exe
Token: SeRemoteShutdownPrivilege	5704	MyCleanPCInstall.exe
Token: SeUndockPrivilege	5704	MyCleanPCInstall.exe
Token: SeSyncAgentPrivilege	5704	MyCleanPCInstall.exe
Token: SeEnableDelegationPrivilege	5704	MyCleanPCInstall.exe
Token: SeManageVolumePrivilege	5704	MyCleanPCInstall.exe
Token: SeImpersonatePrivilege	5704	MyCleanPCInstall.exe
Token: SeCreateGlobalPrivilege	5704	MyCleanPCInstall.exe
Token: SeCreateTokenPrivilege	5704	MyCleanPCInstall.exe
Token: SeAssignPrimaryTokenPrivilege	5704	MyCleanPCInstall.exe
Token: SeLockMemoryPrivilege	5704	MyCleanPCInstall.exe
Token: SeIncreaseQuotaPrivilege	5704	MyCleanPCInstall.exe
Token: SeMachineAccountPrivilege	5704	MyCleanPCInstall.exe
Token: SeTcbPrivilege	5704	MyCleanPCInstall.exe
Token: SeSecurityPrivilege	5704	MyCleanPCInstall.exe
Token: SeTakeOwnershipPrivilege	5704	MyCleanPCInstall.exe
Token: SeLoadDriverPrivilege	5704	MyCleanPCInstall.exe
Token: SeSystemProfilePrivilege	5704	MyCleanPCInstall.exe
Token: SeSystemtimePrivilege	5704	MyCleanPCInstall.exe
Token: SeProfSingleProcessPrivilege	5704	MyCleanPCInstall.exe
Token: SeIncBasePriorityPrivilege	5704	MyCleanPCInstall.exe
Token: SeCreatePagefilePrivilege	5704	MyCleanPCInstall.exe
Token: SeCreatePermanentPrivilege	5704	MyCleanPCInstall.exe
Token: SeBackupPrivilege	5704	MyCleanPCInstall.exe
Token: SeRestorePrivilege	5704	MyCleanPCInstall.exe
Token: SeShutdownPrivilege	5704	MyCleanPCInstall.exe
Token: SeDebugPrivilege	5704	MyCleanPCInstall.exe
Token: SeAuditPrivilege	5704	MyCleanPCInstall.exe
Token: SeSystemEnvironmentPrivilege	5704	MyCleanPCInstall.exe
Token: SeChangeNotifyPrivilege	5704	MyCleanPCInstall.exe
Token: SeRemoteShutdownPrivilege	5704	MyCleanPCInstall.exe
Token: SeUndockPrivilege	5704	MyCleanPCInstall.exe
Token: SeSyncAgentPrivilege	5704	MyCleanPCInstall.exe
Token: SeEnableDelegationPrivilege	5704	MyCleanPCInstall.exe
Token: SeManageVolumePrivilege	5704	MyCleanPCInstall.exe
Token: SeImpersonatePrivilege	5704	MyCleanPCInstall.exe
Token: SeCreateGlobalPrivilege	5704	MyCleanPCInstall.exe
Token: SeCreateTokenPrivilege	5704	MyCleanPCInstall.exe
Token: SeAssignPrimaryTokenPrivilege	5704	MyCleanPCInstall.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
3736	taskmgr.exe
4540	MyCleanPC.exe
4540	MyCleanPC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2752	3480	msedge.exe	85
PID 3480 wrote to memory of 2752	3480	msedge.exe	85
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 1312	3480	msedge.exe	86
PID 3480 wrote to memory of 3928	3480	msedge.exe	87
PID 3480 wrote to memory of 3928	3480	msedge.exe	87
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88
PID 3480 wrote to memory of 4872	3480	msedge.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\DONOTOPENINWEB.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8157646f8,0x7ff815764708,0x7ff815764718
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6328 /prefetch:2
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13148147064900075342,14942140775847445764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:2708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1904

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3736

C:\Users\Admin\Downloads\MyCleanPCInstall.exe
"C:\Users\Admin\Downloads\MyCleanPCInstall.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5704
- C:\Users\Admin\Downloads\MyCleanPCInstall.exe
  "C:\Users\Admin\Downloads\MyCleanPCInstall.exe" /i "C:\Users\Admin\AppData\Roaming\MyCleanPC\MyCleanPC 4.2.3\install\A1E6143\MyCleanPC.msi" /L*v "C:\Users\Admin\AppData\Roaming\\MyCleanPC\MyCleanPC 4.2.3\install\installlog_MyCleanPC.txt" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyCleanPC" APPDIR="C:\Program Files (x86)\MyCleanPC" SECONDSEQUENCE="1" CLIENTPROCESSID="5704" CHAINERUIPROCESSID="5704Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_DETECTED_INTERNET_CONNECTION="1" AI_SETUPEXEPATH="C:\Users\Admin\Downloads\MyCleanPCInstall.exe" SETUPEXEDIR="C:\Users\Admin\Downloads\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1732842515 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\Downloads\MyCleanPCInstall.exe" TARGETDIR="F:\" AI_INSTALL="1" ARPSIZE=19752 AiProductCode={2E8697F4-207E-4696-9C4F-C2AB4A1E6143} FASTOEM=1 /qn
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  PID:3328
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\MyCleanPC\MyCleanPC 4.2.3\install\A1E6143\MyCleanPC.msi" /L*v "C:\Users\Admin\AppData\Roaming\\MyCleanPC\MyCleanPC 4.2.3\install\installlog_MyCleanPC.txt" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyCleanPC" APPDIR="C:\Program Files (x86)\MyCleanPC" SECONDSEQUENCE=1 CLIENTPROCESSID=5704 CHAINERUIPROCESSID=5704Chainer ACTION=INSTALL EXECUTEACTION=INSTALL CLIENTUILEVEL=0 ADDLOCAL=MainFeature PRIMARYFOLDER=APPDIR ROOTDRIVE=F:\ AI_DETECTED_INTERNET_CONNECTION=1 AI_SETUPEXEPATH=C:\Users\Admin\Downloads\MyCleanPCInstall.exe SETUPEXEDIR=C:\Users\Admin\Downloads\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1732842515 " AI_SETUPEXEPATH_ORIGINAL=C:\Users\Admin\Downloads\MyCleanPCInstall.exe TARGETDIR=F:\ AI_INSTALL=1 ARPSIZE=19752 AiProductCode={2E8697F4-207E-4696-9C4F-C2AB4A1E6143} FASTOEM=1 /qn
    3⤵
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    PID:2700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D57BA81B3600DCABCC948EECA4FEFCBC C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5472
- - C:\Program Files (x86)\MyCleanPC\MyCleanPC.exe
    "C:\Program Files (x86)\MyCleanPC\MyCleanPC.exe" afterinstallpopup "C:\Users\Admin\Downloads\MyCleanPCInstall.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of SendNotifyMessage
    PID:4540
  - - C:\Program Files (x86)\MyCleanPC\updater.exe
      "C:\Program Files (x86)\MyCleanPC\updater.exe" /justcheck -url http://mcpi.helpverify.info/setups/registry/mycleanpc/s/updates.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2740
  - - C:\Program Files (x86)\MyCleanPC\updater.exe
      "C:\Program Files (x86)\MyCleanPC\updater.exe" /justcheck -url http://mcpi.helpverify.info/setups/registry/mycleanpc/s/updates.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F14CB2B30FD11521ABD2B34CBDF7B2F4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 247D64A3F6B473F7CEF513787CAEDB08 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5964
- C:\Program Files (x86)\MyCleanPC\InstAct.exe
  "C:\Program Files (x86)\MyCleanPC\InstAct.exe" createini
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:608
- C:\Program Files (x86)\MyCleanPC\InstAct.exe
  "C:\Program Files (x86)\MyCleanPC\InstAct.exe" install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Program Files (x86)\MyCleanPC\InstAct.exe
  "C:\Program Files (x86)\MyCleanPC\InstAct.exe" installurl "C:\Users\Admin\Downloads\MyCleanPCInstall.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://www.mycleanpc.com/app/carts/post-install?lnT=PostInstall&ipA=181.215.176.83&mcA=FAA11E730504&osN=Microsoft+Windows+10+Pro&osV=10.0.19041.0&lng=en&bdV=4.2.3&scR=&lcA=&lcE=
1⤵
PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8157646f8,0x7ff815764708,0x7ff815764718
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6240361005268454292,8396589796767684113,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6240361005268454292,8396589796767684113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://www.mycleanpc.com/app/carts/?lnT=Purchase&ipA=181.215.176.83&mcA=FAA11E730504&osN=Microsoft+Windows+10+Pro&osV=10.0.19041.0&lng=en&bdV=4.2.3&scR=1&lcA=&lcE=
1⤵
PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8157646f8,0x7ff815764708,0x7ff815764718
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5324516865211095464,6518775967882489107,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5324516865211095464,6518775967882489107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  PID:5384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e590e6e.rbs

Filesize
4.3MB

MD5
2b949931cad0a2f2c1d895ed47a46a60

SHA1
f2b3cf52e180577bba93b1b2a9bc6bb5ce6e2496

SHA256
77d16c74847d01024e3e2739622a2b36d653212b0f0964e5ac58b0e305d48c8e

SHA512
3c42963724baa6484f99e7578f378ba749a4f17ed02c3cb7546a84b38851f81cede45481d2576076eb0a53f429c081df4a002706bcd6abe36690e9d3b2770a49

Download Submit
C:\Config.Msi\e590e70.rbs

Filesize
406B

MD5
7c64454eb29ca525953c8116163b2405

SHA1
2f6223859c4bfd6fe9b1240fcab8c1540ed766a4

SHA256
8cbebe27e6803a463d46b4ace62bd0047990d486fd825287ce0a4c88fb4f99b2

SHA512
c7aebe13b38240724a8288424ff2750a4439750f6cc9761746a60d3f29c90a9741c42e7e7ea8ea207cd970edc9a3bcec424f7f4a62548fb12244d3e3b91f39f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
f3c6f090f58cee21def3cd3334cfa542

SHA1
d6fc5e0ee2c3a5433a5d8bf1c76ba14c26fac55f

SHA256
9e2ebb439e6a8e0bb85607310b7f5d6f296db6d569298ce00863d33586c610df

SHA512
96ee1c1301710a00dfea11fb90ebb4a3b841d6d1172b26edbb9e6dfa2056a9cbac4cb1fdf9e31a98b431a9c4df50aecca798a5a485a32d46fc8bc20c0a51a170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_8FA22792264828A1635EBD528D392EB1

Filesize
727B

MD5
b480e9fd5d492ee33ba2c5c694cfe585

SHA1
6149dd502098dab89d44ab5323595b06e03a4908

SHA256
efbda6c566d4f373aba8d7e4900d343931f399782c0d111120b54321d134548a

SHA512
fddab1cf697fd6ac8b625d7236e244d907f00d5b20d13a4881c33e3c01a8957619ca5a9f2f7d34f0893b9ba106bb14d2cf0dca22fe266e122d7c050d511ac0aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
dd4a6de11c5aca03831ce2c397816af4

SHA1
98aa2153abf98ed443bb2214471fad28f61db070

SHA256
49f3eb5a31dc7c52694a2baa6defe57f668a679c3fc5cc736162b6e1e2cf4bb3

SHA512
8c0de17a3838d920121901226aa8d72b8434b8ea00f6d9a0e354d05049b5cb56c6bb7f9f9325e882077cbfb43f8da5f71b8f50675569c9a3a163c20a457c9694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
302314a87583e5026002a0e2c3643090

SHA1
5b5e7b91ad43b60ca46d01f2755e0c9ba3e8c751

SHA256
ac887e0d107f25d0cc380f1d271c2d5e954db545de735b5a23cfa1dcec4448cd

SHA512
e0736a9201ff41ea8f12db1adc76dae2af5e89e405d2c7548101678cb9998b70baacf442927004df59dd410997f7f1521c2f3dba9ec824562837c3f714fc275e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8FA22792264828A1635EBD528D392EB1

Filesize
404B

MD5
3eb00bd637b2a24283b2442e42da0012

SHA1
d6b2585c668703c451751b3d0da9c82d6d23f968

SHA256
449868b31f675f9395ce05bf97377aa0cb825fd7e0d22cda68c1cbaade99b20f

SHA512
c8f6270127db526abd9ec4c5a7f9f4beff973ea6313c8d624311f5011994ef840d2c70164b6c127622d6c34543856373fa06194d604227e4c52c491b2eb4410f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
88cac44e09d5b70bca1ece09a2778c63

SHA1
4883b3b22601fa643cc8cc5d28decb3fc293f186

SHA256
db0ea70c77c843f0b8dffb1b27d4119394adedf1a359f663ab6233295b2504aa

SHA512
f1acc43381db4766acd4296e6f40da91c95d83f5557ca14ece906e2e29c154a72b58e5099b56508db8f917f88fe9b7b160483c822154a3f3fd98b36317026647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2009555c0bb5f9bf2c55e65e80350eef

SHA1
667993bb8554032c3b3755b7733fd6532b0685c8

SHA256
65dfb785a61414136f5b61c4e8e9dea11d6e714917704c752bc5f67568f9f4e7

SHA512
29819a30731703e1e8ea1141314dc1931a6792c99911c60b065653be36d8f9311b2f95014338dbf5924ffdd453e6c1e6d8fca2782c443e874560beba6d777531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cce9e9f4b9fd8e0f9ef79f48c6dbaec4

SHA1
4fe453b717b00775adec43b84db8955e1108d8c8

SHA256
c4191c0180a10c00ab5e70dbb4c01173954a481f48c2202f59257b277868e637

SHA512
ddd6475da132aff41462af588dc4ec8702e2ca6e029f30f42f2410b061530cd535b559a4a5a3ab219e8cfdff388dbb3a25503a4d8d9fd155d9f7e80065fe5b49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
29KB

MD5
8ec8bbc7d71df3c7fb8f0e287d4604e0

SHA1
f5cded96fedc4194cc96a9d5da8456e4b2c02f68

SHA256
9d53089b72d4828a1939167117db78dd89806f5e0658357695d4094d340483b4

SHA512
d31ebbcc2b5658c2eeff3090e42a02fd7f8eb75897cc8075c16363422193175766329d786d79495a3da5fcf86b741a04e0782d0993b461205047d5c2bdb10f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
71KB

MD5
a8de9d9cab2df6143d0d14ab91233cb6

SHA1
ac5e7442ac5cf2da09a26ab4fae744dacca0d08f

SHA256
6d4de24de17577d9e3969102c27fb042c3f1bf11663396e87649b95d7ad5ca7b

SHA512
77993dc87ce82ad3c5e13630720fc9f466c944045066f1ab64b9323b9327391cff26144318f6f945771ad16c0d8e8bc663223ccfc5f2b9e9153837fa8f891811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
39KB

MD5
058deadd715ca094607a2fd2412c1630

SHA1
867a23defbff2ee31f6d2a9231aff26bce738b39

SHA256
0b637ac549f030fcb6935d6a3a9f3b41ac251d6e1f94cc35fe2f2a83639e67cb

SHA512
3c52d9184f0ad0521e546fb46044d93ba84aea26a618f79d776d6e099128667f5baa40285e42e00822554dcde76841c65a6c20fdd0189138cce9c6917b1016dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
120KB

MD5
e3a020fd6e3d5ec3468abbf01822e90f

SHA1
9143e3ac97bbd10263bbf3eec0c22da5f60fe73d

SHA256
4adaa9917a62314a3439fe750149351a31a449c56364de241ee275784336cde2

SHA512
430ef24c9f23e6bf35115c8c48185d4efbe77fcf5ef1116285704722e1508a6615e8d456a2ea43c9e4d001858553992fca46a0c58b6e5e2f18a97a2101dff9c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
110KB

MD5
517dd2cae468c7f972d504a4e4a6a4b7

SHA1
f2dc994719744b7218b74270c51795984c6a86c4

SHA256
6fedbd5cbc75ec303d370772c649ac3a51f54445b1f6182570e1fbd472d3974c

SHA512
43329ce9f018330021361815b9f18aa153b43e6a4b35e18c14608d761ea1502158ef4af3b23db088838a0ccf20c74470f7930d7f2abeb043526fc225ad5c7c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
6ff0e2ef9c8ae1209396dc2a19137a35

SHA1
7a5850c9ea6a93f7cec4877c232057be7d53bab0

SHA256
2dedff428cf5d0f273e9afd1cd384b8b6360154c1d787c6629dde1b0d39ce2a4

SHA512
f1881f2920898aea217e4947ee3707038cbc7da26bce8d4b147bc32b96d9798bba9a2d3147e1a5e0f4f9e07d981ccced6eb31bfdfc5b7679574110212066bfc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
21KB

MD5
32122aa98514bf79d9173511f4b85ab9

SHA1
daf58bcc374d83aaec5f2880136d0101ab2a5913

SHA256
836b404c31b8697332561479edaf0c17c375b3b22cd8bbb8034abed3356b9200

SHA512
5712dff0f8cbd3d8d3f324498b3fbbe9c8f95344dfc1d74dedec22eadbb9e4eb1a166310129e588dd897522cb5b95006c2d81924389284904691077b942994ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
17KB

MD5
0eeb2073a03cd3d87be8e2698be863b5

SHA1
a98b4d9736acfe993896d11f9a4c28e4ddd47a90

SHA256
0fc4c048b8e43e0c80677660283c4652349efb3983066d2541a57b9c50c15815

SHA512
a9d65e523710369fa32335f77b1291206e836b5036c12022776f4dd9f4cdbaf9f0800b131efb7081de33dbbb28e775a2976329d01f79317b40222d26026d51bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
98KB

MD5
b6fee9a8d18749e31ecdc56e8bdc9bfc

SHA1
d1b5465fac1968399379c4346930baeabdc589af

SHA256
ffe4ce47fb487ce3e4c670c0cbf319906a04b0bfaeafe179ddb989a7e6fa8b0c

SHA512
98d2d4e4666d00f1260d584015bb60338cc4bfed13fb8b96f4c8f0c1a111503196f310c46648f6eb3a1ff07c95093bc439f187b48e067e36b3c41d1239aae100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
21KB

MD5
4c6a4cdf42edc95888e440d639e255d6

SHA1
f5ec5c765accfededef8f1133e37b7f2b9387846

SHA256
6b08df4120429f2068bccc69b474a95958f93c3f26baa9fa385d342cbd404742

SHA512
6116170289524ceb7cfbe766aaaef0d81137cb5cb500e7c81fa7eaa3a994c0420649bc58793ae854ecaeb9fc411cce149492cf2e01150056fc19b2a2a7ef0318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
27KB

MD5
dc654d5da1a531fdb3b1bedb619b0182

SHA1
49d3de45bea7c279cf0ffe4cbc43c24779d1877a

SHA256
b395c195a5854253500b3b210e585ec801a47b49ce7b90fa5a9717df387598fa

SHA512
38952929cbf8e103cad50007cb492c93a7feb8d9d1853773883e2771cc97e50d6a514cb6347c912e7945d126a35677cca854ce8542e2210d7e59799238bae8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
18KB

MD5
c83e4437a53d7f849f9d32df3d6b68f3

SHA1
fabea5ad92ed3e2431659b02e7624df30d0c6bbc

SHA256
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

SHA512
c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
18KB

MD5
6d5bbe47bbb0003b62d890c94825b7a8

SHA1
30f546f4ee2e6285462360355942c5898ff0bf1c

SHA256
1b150c409df2cca1e55ffc6e55b649980f9a282bb6b25da6186d5ed55741141b

SHA512
8a6fa56fb7cef243e324a7e0d7aa12fa885f36f1ded48a561fd7a79e7b97e30a7941851b0065acf4f75cb66e1c0fcbe2fe3486d1b72c878862848604310d24e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
18KB

MD5
115c2d84727b41da5e9b4394887a8c40

SHA1
44f495a7f32620e51acca2e78f7e0615cb305781

SHA256
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

SHA512
00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
22KB

MD5
6030466e3ea9779f8596076c6438a7b6

SHA1
77d1cbe94004d6cf224466754f43cc12b87491e8

SHA256
c7dd144163721cef3b11282607dffe203646a44ac7275874c7fe09669f76ea02

SHA512
d944177195e61e1b9ccd6fac19fcb052cc58afbc71813bcf8f07c3647b4b28e3f1eaa2a3487b8f87a59423b2f7da51d85dca4ceb75e960664981a1a6c05aa322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0f2de54bd7004393_0

Filesize
76KB

MD5
0c1f2f21a7d4602bf1911fc42c891ae8

SHA1
36b2ea37acfd98e8cb022c29fc575592899df796

SHA256
67c6b2ee34c8d0f4778e379849810d9087fb08799e562957dcef65469c2995a4

SHA512
89d575595d7ae8286d2bf7d4aaa6211c8cc7800465dae8f9fea13e1e5e10abad568630711323b7f16c571bf05ea70eadd8d9fb6166ac34d1400397a5a109d0eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1c4a9700d14f3a59_0

Filesize
255B

MD5
92636e565a4ccf18442b5fa47946e785

SHA1
bed8a6701288da70a50c9f51b1e89b483538055c

SHA256
896f08a1f7ad741ab294d3e804775c704a6dc4c65ab174805674221b3e4441da

SHA512
2fdfb78b01a5d4381c3ae9c72c820524e94f0fa67cb7d094d96a5ff3fa0c30a1d4de364431af7383b9acb5b61480f448e7ad176c8fb7366cf66fa5f2e919e933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
f0829fbd41d968c35f06acc579f55a8b

SHA1
f5a2cf7f1d2291ccf69188ff0c8d891d8bcd82b0

SHA256
e11cc6b3a52d6658a1cdbd6c5fa15974f22bcdcffe980ec488d349b6d40a797c

SHA512
0a2e07ae0cf886045e9fb5b0adeb98b0743a0111b1b310d36773cf91c4f3ac48805a110a6c236b9cb54ac7faac2c570fffca65e36c917386fb99481d8f7057a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
62ce6173313f0b40441b56f5b28b0c03

SHA1
6f6f83218414aa2a60772a8fe083aaf9434ed4bf

SHA256
436e6f1648eae4727594597ba492780cd0ea763f1b1cfbf029892d1e27c978b9

SHA512
b07bb7339b4d70412cbb1a6380dcac840a7b2b6634a28d4cd461772cc5a52206b3481a9fcdca419d0853cffcd17b796536cd52ef4d3a7eb959b60cebeacdbfe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
e201b219aa0fa15fe964de667d7ab5dd

SHA1
437a09e98d8e8d70f5a9787afa01486ac1f25c38

SHA256
bb23c75e1ff6673c00c8703032943fa0eb3ee4413af3cfa063056a37574cb9cd

SHA512
6df3cb5f6bb6fd2a06d6def9697038639d5ff015ac8df2b03164b467553f372c0634cdac489e5e38b1a35cf5db5b8124815af6b83b6a29be4309d0246ac81494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
9a4e686c668a86e6de408f053218c15b

SHA1
8f7a60feec4467e7935db0c6afe76a1d5f3f0be8

SHA256
47cbc2f1ec921b8da951118068b6ab31db0500e03bdc9e67133ff51643501a98

SHA512
f89928c21f70e705e9e23445fb73bd177b46113a34ef9c95da7aee4710213a19a64efd5869ff03f3944819a73675ad75a3b4034afb65f15235e643d5c5ca666b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
9e1afb076a91bdc8116edfa6d65e7382

SHA1
bdb09533fc4e0133905db87f39419a6a71343cab

SHA256
2c466aa288f7a29fb56f929ce5f2423fafee20245a6cda1368c0f4c990d4aeda

SHA512
48b6de8224275f63564bad672d9855e6816f4ee293306f78608d37e537ac4df74b8a00e04b35e5657c1f3bb5f67f23c6ca5e6b1be405afe81db35ac6375fdf70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2920802d05b71c8d0f8a57a7ab5ba9b8

SHA1
f93acbeb51a95da4406c27d9b39439643c7d8127

SHA256
26f2820448c1929f9c3554b51df0204e8f06ae745eeffe8feab5d4ab3c11582a

SHA512
d477847398684033514b49b7e91283fa20864afe33b27cf1704613cd4696cdd78100c3c17286dec79284de875a386cbb3915c21f23caf3e6c47993af2d05eaf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44e3ed9e1fcb4bdc0eb0f43a633afa22

SHA1
ebdc81b2f7db526aaeb7898b76be2173e3a33c26

SHA256
19d5a4ff7ee3c5b055f640af001681724c33767107fb9188f46581cdc1e143cb

SHA512
800d84e801a2c3ba612304efe2f6d36a136ed96cc8a7b1697adf0d6ef82b5c933cea217830df0b8d4dd31985aa7853c02317f9449a4737f37531a94cce4fa5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
99a876156fac19209c878deb67db4c47

SHA1
c820b8a091ebb668e1df813c1e80fd3a5e2ccdd6

SHA256
17d1a08d3693c443b0b9979277bab28d60299dadded5e0a2229bf1760e768697

SHA512
aec51931f7e80d0064c4a698d02c16537f4e778493abd30f491bb4910e2aac0a295b4b6e7ded59e9ce0159f41b50f8d66104e58ffc853d54dbad5afaf1916935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
4bbfec9a04104a31448f8ad06eac8b65

SHA1
123f47bfbf9324e4f9e64325d4d0ffbf68d12bfa

SHA256
3ac6b4dd39c28e0dff2bfbef145aeab23ce2ae32a59c2a2a74dec39854e10cee

SHA512
27eb22faed73ff9b205f869069952e669ad7ff7ef96507338c9efc0d168db590abfcfac394e3bb241e0b9b158f646d1de0a38b7932a89c5b57917ed90d3a623a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
ff753c26ab21e0a28c31f309ac6e7034

SHA1
420fe2458e5e926712f16cd74b444967a25b72bd

SHA256
e226829d199e33c173731315d71f4298b5a743569b1616c7a0a879f49811d2a3

SHA512
8682083a3532487d57355a4fbfec3fb089a64ebf01a3b5d30ab1414638646b6e9f0e130e209fae3e89457fa43bb505bf160094bec562c062223e7bfc3cb9e4bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
25KB

MD5
a8aaf1faccd6d30a7afdbdab046791c7

SHA1
a23801c2c24115af5dec4c223c3ce61169bac90d

SHA256
d8e8c8f2dc8fc589e10a9b25697bd7581a38577f14d76e24637e0277340f3445

SHA512
40808d0ad89a10945c41439d4bff4314929505045c88bd87e013160d320ae903a13799845a85b293673350fa1177ee5ad4a32a7e708b618c4e0dd9b8b794ae7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Filesize
56KB

MD5
c9588e249c6127a669a54fd6dbf07a86

SHA1
3a995faaecec3e49057e103a290ae8b8b2cb558a

SHA256
39e18513d0721d469cc72679127c61708a2d414bdbbddc87bee06b5fdb44a05b

SHA512
c1f06ad7b9215f52358187e1895914936dfa07676f3c641fbb52afa768bac45b8d9df3c876fb31e0c3a6a44c7c02e826afcaa4fc284d06ad6db4b094d2ada565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
96B

MD5
01ff0edd4cd764be57650a66f205aa4d

SHA1
caaba9893d86606d36ac846eba7ff8d7a849cc64

SHA256
9505d7a6d93e91764f2ab94b1b54eb6b51cbc1784eb3d2e949a1cb096302a3b2

SHA512
295cf611706f1e8468d7b7bc72d5ec2c4fac03680dd0528265049b5432d7cf29e2a19f0a427d86d57ddace3644e2b547cd73907d3e9c3ee3b5f009791ec2e7a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7267238c398a024ae5aa09168d33ff9a

SHA1
034c3f59afec1fe30fbacd2f8bdd1fae89ae942b

SHA256
75afabc8b49c2cabbdcbaa759fcd15c7dc426833cec604ad70f9e5d1e3822091

SHA512
9f27164435893453489e895fc8392674193b59a5052563b83f7ccbd2baceba4f21ebd4f86cb2223164297eaa7902037365e39a52e3f931602bd9e3480941d2b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586e74.TMP

Filesize
48B

MD5
dee64aa348fe51bf4583365d5a2673a9

SHA1
f583ad696e0d39b3fbd3beb153b44e93e39effe5

SHA256
e3bebe93898011967773f0b558713787a561742d6fd501b9de3f809d2fdb90f6

SHA512
abb8d404e7ae61aa5007505c0b84546faedbba2e8d78acec7666e874c669135b1db701c1657b51862e82e708d2a3d77f11a00eb5386d4c1725fdc68d711b9aa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
032ee4c8ce460eece65e0936cdfa1c86

SHA1
84f98e25f57950da90cd524199827e5f62d81ed8

SHA256
64bc95e9b99e32c65ab36708820a73859a0312f9cc98c9fcaa16836e51e7eac9

SHA512
895becb8bed5aeb7d24d8453804673e5b1a6338f42f1c3610f6389c359bf774ad7112b0a97d7d2a27c3550bf7a131e4581c52260b75730652df850e2f4a218ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
91561bdf61e802548550f22a7265c808

SHA1
bb29d389d97dccca0f714a4ceaff9db45a01ebc0

SHA256
d699518c238bece1816b968b5d54e839b03fcb05edbc52302c1fc31e461d70c8

SHA512
1874555b1ac2530f695ec21b0e39fd9ab642d26be64d2bff181add383516e294c9dbf29562241154bfb78de58b2de9559a471bd9da27ba8ea18b77d1d6b91e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ebb2e369a93d497d95a5338df9cf7599

SHA1
d37d1efd0f1ab149291712988d2bfb761e82bd7c

SHA256
1bf653c430cf5af70e54ebfd87e04d2523105ad018348a077538d32fcea6f604

SHA512
cc666fd6fd79bcec7ca447840211ebb1bace92c8eab4460e9bdc9a331882f80622386cc3ca4075c7fa5684225e4acd2a4770ecf71598c54d3bbe732fad2d7df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b8aad56f05a51247efeb0d84f12804ff

SHA1
8306ff44a7b43ac0340d4999f8fccab6750864de

SHA256
7bdd80b5a23a31c35f141e2958912c3da597b7d644a1b4e05753ded220548b4f

SHA512
7e7b958c8378dfeaf9fb1e5273f481f85a1da9579eb3490608cc436fc99349c7dac4937adf0bdf0b4e58bf83943fdecfb67212e91012f57767c0e675a54cd97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f8083c8383044ad1852ba1e5c268e763

SHA1
f40b4e59bcd08f6e62e43bfdf63d0766b422c098

SHA256
a8b1a3235b54b11fe931157ef5cb811bf67219e36e361b3b6c8f90da074fd489

SHA512
d539e9da6a28f203c8c0be311e54d27b177cc71661433b8983c78910b6597fdf79073aa7d1bfc3bf1aaba7269942354aabebf4261c25abe25aaa8564f9fbedcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
9517cda72828b00565bede08a3978520

SHA1
fcb57b5bdaadde2b07368823905f8dea75b6ca9b

SHA256
d75862f6d342c3e07ce40ec5f2c6c89213afb038a28bd36d4bf1a98c86e34b64

SHA512
bcb234717f2d6e4471f1b72ee06506f079ca90b5b07c4b371d58ef26b4df890eefa2c5218162b66e877b09f92b9d200f17f5f65cc1eff417bd1ecd25bd0ee902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
65f4ea11fa748c9fc33f7076fd1f486b

SHA1
0aa415fa62ebbca5270e7596d0d7e0b708909759

SHA256
40ad238f9782cdb7d100ad5247383fee7915e050f941b2d2d0d882e2a2443aef

SHA512
4c7cf20e570895d8403b754f5623695a24555369d7fa082ae6692d2fe810e11ac431e4fb5fb964d46c5fe5dc222e67114c309f7fff1db2b20831213c81f10e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d71.TMP

Filesize
538B

MD5
3548dc4d0e37b3e7c8fb61923882f3c2

SHA1
811236103ba5c482e3357e8d617fe9f676bed8ce

SHA256
a9c08ed7036b1efcb72cf600406fc2f37759f32888bcf2829b0d3fefa5f1dcb2

SHA512
1d92a5a6a01ae0a5e0769705c5530e1c0d828251bbc822f0e1bb95cb26ae6dc98af319f9fc90e62021b9c7f20043e011f7589abcc7fa3373e0f1f2b36e5b8124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c5328120b0ed1d1e55cdaad24325569

SHA1
abbbd164d1f168c793487227393f2a9bf787fc7e

SHA256
46e961aa81f4beea372dd04e598f05fec786a90fb2f5dc35971c957dd03df916

SHA512
1c37bb6a3b46b551600b8dbac31e89c218ce7f035b013d4eeb0ceac6eb0b0136b41696eadfae41aa49dedaa12abbe449a1e98b9a6415b20cad282a1369757503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
72882f63d896ea90c3456136bffd6f84

SHA1
b7641d2f9de6f6b3bcb055a15932dd9f01eff50d

SHA256
775c7d49334b83ffb7bb69b8874e95181b0e32b370ae862304a8d7ca3665f106

SHA512
6e11dcf15fea79a909e61638734526ac8958f5e3f3a86e0a6da3bdc12135ae411fae8aa3eeb15fe8338ac2b42d8e9b08e80bedcbbc4a9b0092acbaf8b7017d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
306a6dcf5f01704e631fd999311f51ad

SHA1
2be555771a3426639485acc7cdfe1a2d1cd9bc56

SHA256
8396eb4a82d8ef35352b469d212c52dd18e0e7cd2f033eb839f3a162e4d5fd60

SHA512
8e8ccb8a5c9c0af1b20b2599f35d388d99d41a46da56d4e771abb8ced89ea683574e3253a79ae279a52d685c13bd3a896abf6430ff8b44c751d83c87496aa8a1

Download Submit
C:\Users\Admin\AppData\Local\MyCleanPC\errors

Filesize
224B

MD5
961e0ca39fdb885ec769b1326cc82da1

SHA1
2539a4a47a5d3b8c217aef858fceb0fe4fc68567

SHA256
d3d020cc5dc56a848e627bd17bb9d804b12e8b3cc1999a77cf7958b465e93301

SHA512
b3f866bf511a9165807de1fc0252698087b218233c83e0998b3aef492af185229d3eb41a31bea1bb07c082abf96c8c205619dd264abc0b2fcc99d60eb2eee8b6

Download Submit
C:\Users\Admin\AppData\Local\MyCleanPC\fileerrors

Filesize
1KB

MD5
98445a203dc7e31b551ab41c6a863da1

SHA1
9ad0fb3fea7724555b9ada0b2c9156bd50ef74e3

SHA256
99fe64c1cd30338523e3c684cdd956e44a89c68ca16c951ee51f42a6a55807f5

SHA512
3b05745bb4e5b9d653e0fb0d426326270a867eda465528ca7ab14f3ee0457c64ddd9197635afee6818e4fe532b8d03d4f15dab28fda37cfd86e705885a428ff1

Download Submit
C:\Users\Admin\AppData\Local\MyCleanPC\fileerrors

Filesize
1KB

MD5
2dfc5cd6e380f1b92ac53c60f56175aa

SHA1
21ad9f78a0c4e5925ff6909168bfb9d76f6faab0

SHA256
bada0bfceb090ce7c2e515d9b2e4a694e5a99a346fc3ff79fdcd7091648f5cc6

SHA512
e90a5f324f25d5d1beeed3810d239a439f4077e464aa82931e43f4c40fdb7406197d7096fff86f92003a81abc3160a2404156351ae8aaf09dd11a3b6c8038986

Download Submit
C:\Users\Admin\AppData\Local\MyCleanPC\fileerrors_data

Filesize
32B

MD5
35a2c7d26e4dbd3d2cad17eb91c788c4

SHA1
cdab7deda70b52b37aa199e06cf34068321265ef

SHA256
77342d882e1294a76e6a422843bc600afec2142a9e6b2f08e9a406d1bd2cab94

SHA512
53255a158c91b718851c0a76f52f6e17c2c456dc112e92a5c7c7cd5b27dcbf243592de7a842a1a449b38674533bcd4e3d97e29d3ddaf2617d1a7e41b63efd74a

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\jatramw2.newcfg

Filesize
715B

MD5
b3c0dbbecd2df4b7c058c2ce5576f1c0

SHA1
e48f7fe7e571bccf096d962ef970ac4989ee479a

SHA256
bb4bf4f8420a9ca5142d3858c3b4cde7a8d64ebec65ccf5c7a6f14d3e41d82f9

SHA512
36ae113a62376dcbfa7c0e4c16ff338af46005748a895395e168099233daeb8342431ae21fc443b8f17396b97251881ef634d6989f1906475d70de222a75b291

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\jz0gwly5.newcfg

Filesize
971B

MD5
9786330420a4469ef56b96c8594f8e0e

SHA1
31ebe30d93ae0d03236a619a13cb5c1adaa8c71b

SHA256
51afd47b143b4a91bea449fdfcab5b54c3b52789156bbdc37ad91c7688a30274

SHA512
1eb8481fa1944cfac95e9fa27d975432660869cf4830c599daacf6f0cfed89170f90501ff07e26b9e331be3725056d27b787dacf54b95a2716c9ee1f6f4adff0

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\nemrqvp4.newcfg

Filesize
446B

MD5
0bdce6bfa503e464ccca8698901fd26f

SHA1
14cde1b29690d88399d8406c833bbc4315073532

SHA256
d37710c2c376d42cc32eb18901f66a24a4088b073b7b4f611b8b039115ca73e5

SHA512
0d967cd2cffdd6c312368cd97b34904f5b3c0da590650f6eeff46a50add1e4d40dcbbb25367a6e97f85d0b2344124867a070e9aef2a58473cf5c2357dcd60d71

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\oirexort.newcfg

Filesize
835B

MD5
530f9691aa747065f3c73ad34637f2f0

SHA1
51d84bd7bf55e8743b38b3a3105884de1fa1dbec

SHA256
5b93a3a73fd9925df36edb1887baf38196d6163ddf9b8c1ec06d3813b1bec854

SHA512
6f73af0209bdb30436f5f9b17109bb46aa00efc1c6d4720404b85184be1402e4089a4d0a9f543767a917e957f196fe5d6b94f849b48a2f37e8d4761eb4f41a2e

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\ppxotfu1.newcfg

Filesize
586B

MD5
b3564fd8d71ffc34ede31b40fcebbe9b

SHA1
c426db919d604dd29bf7192b5f6c1cff7f2317fa

SHA256
43940359db10026ccfd0ca20bf029d23b4529b5c3f6d0a76dd5ff8ff6a8248cb

SHA512
6bcb4f515f33d9733d9bca9cd4fd4467633ffdf07355ada493ea81cf3ce93bf7e8d41eb67a70a73d607327a8a1fe22dd526fc85bc1a75d3166a75623c078e0c4

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\user.config

Filesize
971B

MD5
158db1921b809d9a1d356daaf91ea1a1

SHA1
6fc034857e4c859706eb397baa0704e25ec1d9c3

SHA256
f0c078bd792fdf5883d870a5e8d5f8aa4c9f7f9aa227e51a723d858dedc4e02b

SHA512
89966a6caddd7d007644dfc61c27d438afcf0f8a23f6185463558a6ff2696eb9a32ebb0130299ec7c591926fcd617518585f9031089deb59c2d62dbf7ad6c336

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\user.config

Filesize
324B

MD5
d1320e5a2abe02804082ea78e5d2e243

SHA1
a72ccee58c42dfef2881951762456969bd422bae

SHA256
2c8d7f06cfc94f7f9aa18537dfced806229fedda9e33455a56da2ad114dfe87a

SHA512
484212f66943cf25b9f86e043844637acf44b17103747f07ecb10a3892f4bdec5d932adcc82e2a29af307b10b9a2145d231db16f71be4e69b613f758eb6b84fb

Download Submit
C:\Users\Admin\AppData\Local\RealDefense_LLC\MyCleanPC.exe_Url_qt00azpf5rjxiq2gkbgexk3tbp1i323t\4.2.3.0\uthi2n4w.newcfg

Filesize
971B

MD5
1969041b70b119d019aed17aa2ff77fb

SHA1
9db36ea9922c5afb7868472f09b1b614c63aa868

SHA256
ef0a3b038ec4db2d3bd7310a3210aaac03897a76775238853fff7ff0c14fbe38

SHA512
bbe5bd252b4c7a327357209be9fd4fc7cb23dca0607a8155e8c235b2322395eec0ab86559920d9d4a9b0d7035e4879f75139f52fe9229efe68a89d62e09048fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5704\Installer1.jpg

Filesize
22KB

MD5
f0f3f0416111674e3944e152cdc0615a

SHA1
07fb63a61b7b3aa2d33d4e502d1eee2713ab13dc

SHA256
34829461f5d26d16aa53181b814d5839312b3423e4ac7ad9a200c287b176f410

SHA512
c841f01ad115756b0eb3c607caaebb6bce61de66b800a3dc81fad76138443f6f0c6fb8148cd16ad0438f5581397c4eaf5312452a4fccef262151d59830feb369

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5704\Installer2.jpg

Filesize
49KB

MD5
ad149d1655b65e0d99c1c216e424e1af

SHA1
b805c3acc59b53db1571b4b8be1c240362310f73

SHA256
534d9f3c6f152a818ced853237c3e73e4aebd1eeeaaeaa22b9c619b74839bdcb

SHA512
f8e00c025559adbbd0091623f5cd3117c8d7c6515c8c743749fa3d7d575cabbf59d4fc19ef91d94ea559ef031e14a15f94df5dd7eaac6e91e0f012cae3fc2458

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI259.tmp

Filesize
904KB

MD5
421643ee7bb89e6df092bc4b18a40ff8

SHA1
e801582a6dd358060a699c9c5cde31cd07ee49ab

SHA256
d6b89fd5a95071e7b144d8bedcb09b694e9cd14bfbfafb782b17cf8413eac6da

SHA512
d59c4ec7690e535da84f94bef2be7f94d6bfd0b2908fa9a67d0897abe8a2825fd52354c495ea1a7f133f727c2ee356869cc80bacf5557864d535a72d8c396023

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI327.tmp

Filesize
1.1MB

MD5
e612b2f3c68a7d5c34592c88778766b2

SHA1
e18329c9f763f923682408032b7b35a4e62fdf81

SHA256
403869ed494bcbc3e535b492f2ebfad95748049e203ff7c31ac1afb38d8909ed

SHA512
753c8d4600595c0b83f1a5bca9da637d56d7778ffd74a90942ee243e6b998c113e372b35cde4aa90b4a11152176812e354a6c0761b169243ecf5d3a9c793b543

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI357.tmp

Filesize
877KB

MD5
a67acb81551a030e01cda17fa4732580

SHA1
9f6b54919ee967fddf20e74714049b8c13640083

SHA256
107fd7ee1eaf17c27b4ed25990acace2cb51f8d39f4dfc8ef5a3df03d02e1d34

SHA512
30cc0870797220e23af40d5f50a9ce823c1120fba821ff15e057587c2a91c7247058e9a8479088047b9dc908c5176793e6f3ccd066da30bd80e1179649b2f346

Download Submit
C:\Users\Admin\AppData\Local\Temp\MyCleanPC.DC.KolaciciCh.GetCookies.tmp

Filesize
20KB

MD5
0a9345743a476887716e3ee4b0684309

SHA1
c31d815dce5bebbb309f4d29fad1a4656296abf5

SHA256
53bd1a41789591e865f34345b8950827f40a175e2f9991be606ac3f9ce5a9f2c

SHA512
073efba247e0f4cbc077075aac2f3b72166415b48de50325b21ab493687a438e3fe4b193c351878a032fd0bac0cd3f4a6522f22528ca1cd2dcfcc33b50a49882

Download Submit
C:\Users\Admin\AppData\Roaming\MyCleanPC\MyCleanPC 4.2.3\install\A1E6143\MyCleanPC.msi

Filesize
4.7MB

MD5
fcb1dc34831a8823d4109df926eeaab6

SHA1
933922eae9a7dd85437674a5b539146ac64e7ac4

SHA256
ba5c35fde93faedadae1d3ead7978353c7cff647ec66499a7ec12c9cbdfe368e

SHA512
ea41b2f98309d7e48b2c9afb184b86a438bdc6207976e3bc0b158553da4e489e088e9f77f4935aad42b1dee38404c85c329ddb3e3289b51d85817f00201ac634

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 749670.crdownload

Filesize
11.9MB

MD5
50d21fecbd4a986c4ddd51acbed43532

SHA1
865c15d07ef7df1a2690a1a8c8fbb5641daa2e38

SHA256
15280db86cf430919c03bc3c162f5920d47cfb493a6a39ccf02c3c08d5eadcf4

SHA512
48e2329db5450b0acc5e0938fbebc9d2f8561da988ee93ecb36aa0eb4d6a3bf2cdf24816cbadf3a5c1be6129123d08478de53d65b4a37a9d97eb4b90205e473e

Download Submit
C:\Windows\Installer\MSI11E2.tmp

Filesize
868KB

MD5
b1ca6f0d6edb2a6c4246261957098518

SHA1
13e0ef50ffadf6c5a00884c7146d653b1b0f7022

SHA256
78035b1d13620a8d68c96a3da5ead38963054fe26aa85e07f820db4a680b0404

SHA512
f6b0093d0319fc823f1f66da0ba312c69ad19cd50e8bb32edc5e1bd6b20d5a7ce3f09cea6b9fb505a90ac60848698e1c92495ba075c351bd6aa260ec92f27ee3

Download Submit
memory/608-1014-0x00000000009B0000-0x00000000009BC000-memory.dmp

Filesize
48KB

Download
memory/608-1015-0x0000000002CC0000-0x0000000002CE0000-memory.dmp

Filesize
128KB

Download
memory/1724-1032-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Filesize
584KB

Download
memory/1724-1031-0x0000000005240000-0x00000000057E4000-memory.dmp

Filesize
5.6MB

Download
memory/1724-1034-0x0000000004E40000-0x0000000004EA6000-memory.dmp

Filesize
408KB

Download
memory/3736-816-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-815-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-806-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-808-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-807-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-818-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-814-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-813-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-812-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/3736-817-0x000001B44F7D0000-0x000001B44F7D1000-memory.dmp

Filesize
4KB

Download
memory/4540-1256-0x0000000008C80000-0x0000000008C92000-memory.dmp

Filesize
72KB

Download
memory/4540-1252-0x00000000081D0000-0x0000000008224000-memory.dmp

Filesize
336KB

Download
memory/4540-1141-0x000000000DCD0000-0x000000000E024000-memory.dmp

Filesize
3.3MB

Download
memory/4540-1140-0x0000000008100000-0x0000000008122000-memory.dmp

Filesize
136KB

Download
memory/4540-1137-0x0000000007310000-0x0000000007396000-memory.dmp

Filesize
536KB

Download
memory/4540-1075-0x0000000006300000-0x000000000630A000-memory.dmp

Filesize
40KB

Download
memory/4540-1066-0x0000000006580000-0x0000000006812000-memory.dmp

Filesize
2.6MB

Download
memory/4540-1056-0x0000000000690000-0x00000000009AC000-memory.dmp

Filesize
3.1MB

Download
memory/4540-1306-0x000000000C650000-0x000000000C671000-memory.dmp

Filesize
132KB

Download
memory/4540-1302-0x000000000CAF0000-0x000000000CB3C000-memory.dmp

Filesize
304KB

Download
memory/4540-1254-0x0000000008580000-0x00000000085AE000-memory.dmp

Filesize
184KB

Download
memory/4540-1305-0x000000000CE90000-0x000000000CECC000-memory.dmp

Filesize
240KB

Download
memory/4540-1257-0x000000000A0C0000-0x000000000A128000-memory.dmp

Filesize
416KB

Download
memory/4540-1258-0x000000000A460000-0x000000000A480000-memory.dmp

Filesize
128KB

Download
memory/4540-1301-0x0000000010980000-0x0000000010AE1000-memory.dmp

Filesize
1.4MB

Download
memory/5812-1143-0x0000000005D10000-0x0000000005DAC000-memory.dmp

Filesize
624KB

Download
memory/5812-1144-0x00000000062E0000-0x000000000680C000-memory.dmp

Filesize
5.2MB

Download