lokibot | hxxps://www[.]mediafire[.]com/file/a9gm8qnvg1m233t/launcher[.]7z/file

Analysis

max time kernel
1199s
max time network
1193s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/a9gm8qnvg1m233t/launcher.7z/file

Score

10^/10

lokibot lumma agilenet collection discovery spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

Extracted

Family

lokibot

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

lumma

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Update.exe

Executes dropped EXE 11 IoCs

pid	Process
1380	Launcher.exe
6124	Launcher.exe
4268	PB-1.0.0-ia32.exe
5916	Update.exe
5816	PB.exe
3388	Update.exe
5464	PB.exe
5044	PB.exe
852	PB.exe
5460	PB.exe
4840	PB.exe

Loads dropped DLL 12 IoCs

pid	Process
5816	PB.exe
5816	PB.exe
5464	PB.exe
5464	PB.exe
5044	PB.exe
5044	PB.exe
852	PB.exe
852	PB.exe
5460	PB.exe
5460	PB.exe
4840	PB.exe
4840	PB.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1284-1350-0x0000000002FC0000-0x0000000002FD4000-memory.dmp	agile_net

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Lokibot.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 3160	1380	Launcher.exe	168
PID 6124 set thread context of 2096	6124	Launcher.exe	171
PID 1284 set thread context of 672	1284	Lokibot.exe	174

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PB-1.0.0-ia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PB.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000092e6c6e09718db0126b123faa218db0147b97f1ee747db0114000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 931961.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
2296	msedge.exe
2296	msedge.exe
2900	identity_helper.exe
2900	identity_helper.exe
5556	msedge.exe
5556	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
4588	msedge.exe
4588	msedge.exe
2736	msedge.exe
2736	msedge.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5728	OpenWith.exe
2764	7zG.exe
2324	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	2764	7zG.exe
Token: 35	2764	7zG.exe
Token: SeSecurityPrivilege	2764	7zG.exe
Token: SeSecurityPrivilege	2764	7zG.exe
Token: SeRestorePrivilege	6024	7zG.exe
Token: 35	6024	7zG.exe
Token: SeSecurityPrivilege	6024	7zG.exe
Token: SeSecurityPrivilege	6024	7zG.exe
Token: SeDebugPrivilege	2324	taskmgr.exe
Token: SeSystemProfilePrivilege	2324	taskmgr.exe
Token: SeCreateGlobalPrivilege	2324	taskmgr.exe
Token: SeDebugPrivilege	1284	Lokibot.exe
Token: SeDebugPrivilege	672	Lokibot.exe
Token: SeDebugPrivilege	5916	Update.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5728	OpenWith.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
5608	AcroRd32.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
5608	AcroRd32.exe
3608	msedge.exe
3608	msedge.exe
1064	msedge.exe
6120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4512	2296	msedge.exe	82
PID 2296 wrote to memory of 4512	2296	msedge.exe	82
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3572	2296	msedge.exe	83
PID 2296 wrote to memory of 3616	2296	msedge.exe	84
PID 2296 wrote to memory of 3616	2296	msedge.exe	84
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85
PID 2296 wrote to memory of 3116	2296	msedge.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/a9gm8qnvg1m233t/launcher.7z/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1ad246f8,0x7ffd1ad24708,0x7ffd1ad24718
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1244 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4456
- C:\Users\Admin\Downloads\PB-1.0.0-ia32.exe
  "C:\Users\Admin\Downloads\PB-1.0.0-ia32.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4268
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
  - - C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe
      "C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe" --squirrel-install 1.0.0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5816
    - - C:\Users\Admin\AppData\Local\PB\Update.exe
        
        C:\Users\Admin\AppData\Local\PB\Update.exe --createShortcut=PB.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3388
  - - C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe
      "C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe" --squirrel-firstrun
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5464
    - - C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe
        
        "C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe" --type=renderer --no-sandbox --lang=en-US --app-user-model-id=com.squirrel.PB.PB --node-integration=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5464.0.2132357109\1765418286" /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe
        
        "C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe" --type=renderer --no-sandbox --lang=en-US --app-user-model-id=com.squirrel.PB.PB --node-integration=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5464.1.2144612641\1243148849" /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:852
    - - C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe
        
        "C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe" --type=renderer --no-sandbox --lang=en-US --app-user-model-id=com.squirrel.PB.PB --node-integration=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5464.2.946805659\398111609" /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe
        
        "C:\Users\Admin\AppData\Local\PB\app-1.0.0\PB.exe" --type=renderer --no-sandbox --lang=en-US --app-user-model-id=com.squirrel.PB.PB --node-integration=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5464.3.998426714\561080967" /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7836 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8008 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8000 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,10881354641455327337,14607554998417108571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x41c
1⤵
PID:4304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5728
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\launcher.7z"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5608
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3B535D79956FB08D4924D547273C6CE6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3B535D79956FB08D4924D547273C6CE6 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1022AD5A3860C2960C62D630B3C20081 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A5C7D96500388A820804576CEDC6AD35 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1620
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B636547E75130E930C3444D4C4AA4AE0 --mojo-platform-channel-handle=2064 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5148
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4A41E1E5F778FFC4FAA5F7E0F802E791 --mojo-platform-channel-handle=1992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap6356:76:7zEvent26938
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2008e3b5hfda4h427dhb090he7e74e98f9f4
1⤵
PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd1ad246f8,0x7ffd1ad24708,0x7ffd1ad24718
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12218851593946232460,15682217360463531764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12218851593946232460,15682217360463531764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultead12f43hf880h401eh9455h0e3a274fcf76
1⤵
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd1ad246f8,0x7ffd1ad24708,0x7ffd1ad24718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7425284046057505165,17774300408650805151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7425284046057505165,17774300408650805151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4952

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap11391:76:7zEvent19786
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6024

C:\Users\Admin\Downloads\Launcher\Launcher.exe
"C:\Users\Admin\Downloads\Launcher\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1380
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3160

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2324

C:\Users\Admin\Downloads\Launcher\Launcher.exe
"C:\Users\Admin\Downloads\Launcher\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6124
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Stealer\Lokibot.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Stealer\Lokibot.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1284
- C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Stealer\Lokibot.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Stealer\Lokibot.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x41c
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
29ba48109e6b0ee508d0589fe8b94f2c

SHA1
36ec6acd38b53170d2b155a1c34fb4600f17f081

SHA256
d342f34a97716a53fc9d9b92598971b54bfe215ae8d6c49666e0e196f22f69e1

SHA512
c3c239512da7030197558b70fad4d4dfbefbb4a40ea271c50e63b7edd1c69d73e29d1c6cd951efee4827eb205cd3d6200500d9f44246b12598fac849c533bc23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
390c19203f97c52758d1dd26c828d666

SHA1
98b32ed9a10b61774d3172086a87890e7a4ce3e3

SHA256
a2e06dbacd8cd632b1d3f23ac50f2b5beea948c0861ad7aa7c0816f4811c4efa

SHA512
b88fc7b850a8b168f777954749bd739d0cfe129f397d56080c16e24a92a90877cc732b3fcf166bee46ee1ef822e198c237a37478e9bad14564a17b4fa6302f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
74e31252bcf6ad202c5b9fe5df0659a6

SHA1
8c969a20c834098021364d1cc3293bbec4bfb261

SHA256
f4c9d4007bafc5eef25b00abd03db6e2a815dab96b9f2c1bfdf785c3db54e157

SHA512
b07a8d85a0a7025eba294f1f8862be7480e492e3bcbf49fd22a8dd4de0d2ee35c73471f4b575c34ba3ea82371d36fe8815d8432d3a1e0ebedb0fdf92f7b0b720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
67KB

MD5
27d9344de055e50044e074ec3b54231d

SHA1
d07ff356acb90c9d4fa1c1e3e48188b1a2eeaf8d

SHA256
d5c1eb2d4d0a13aa42ee68f03218ae01f420003f64f572b77cbff7d61edff388

SHA512
ad045b2f4e6d58e43de1e26a1d5c0a46d912b65caed68ac4bc07f0c26223c5a9927a74ccc8956e074ee74db6e7b05415f3baa3634a714f3048278982bcddf26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
25KB

MD5
e98f77c695876f1fb5be900b7746f30d

SHA1
d68be5c834fc18f8d1c2dc6131fc56dbe5d2e3eb

SHA256
70e3bde20af4c0241b47fe708e77c612b75eed67692179114c24fedcbd35e833

SHA512
dcfb3868b21dd8e177da9c92d042844b45e89902e4284fa582f10fb414253f0b7902f430a593ab936563eabc64aaf29fe6e2a7bd64d720f08f26ef9a3669b430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\08447609b1a3c78c_0

Filesize
175KB

MD5
16a278e933eb8ab9020ba0f4fa81ea6d

SHA1
b11e0d1f334253f46a9907eee96c6a43cde08ee6

SHA256
8ed1af3f3b2c2989416055689a44faa0e316837207b346978f17c1d6f955df6d

SHA512
c8cdb1f1ca51ee414bcec2087587fb8cb49c0aeac6c9dd82ff4026d22f3fac0287d0d630612566aa49f2962dcae837ecfa6113bc0386b1facb43725ef17cfb35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
2KB

MD5
88ba734f634951c1be22f434068570ed

SHA1
782d9859d1cf61f5eb5d470b8afc2e50245a07a3

SHA256
806bdff96de1d75c86941db1d5da4707f8a3d042f9fc3bcbffb0a0917128b2b3

SHA512
ffaa83203e3b6f9de43d75c1084d8397e64edd2a543c550f82879337dda6dec3c23d76705b3b27c6a29803d893279f4c487c73e29d9db3dec55c6e190e95054e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
7ed929b42264a3984c9d78d9c9d455a8

SHA1
c93302b7444069036d2630910fad2f9f2917c6a5

SHA256
4b6a92019113b162555f6312bbe80c12dfa65c5bc6aad991511fdc405034e877

SHA512
a61452e3c5538ad31055ec2bce357052caefd2281aa01b74bf397866b1f958a78cbcb4627aa44b12f5ad01449ce64e8a4b66f43e2d66aaf9793f0c5e92bc8aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
9KB

MD5
e7d56f34f474a96232ceaaa65abdec3f

SHA1
86902efc8b8596eeb72acaa4c2d87ba6a28ef846

SHA256
3d957656220860216e39b6acdbcd420132c2c9e95e6cefb1ea6ee5219a336300

SHA512
aa54ab6dea427e3acc51c3d4d468fe078dc7b7a9edec0c7d0ff2eb5f3dfba8fceecc25ab804c680c646b39512977ee8e872097b0ea754ef20fb620729e1ca6a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
6KB

MD5
0226dc53fc600da64b35ac5de275e6a8

SHA1
9139fb68cdcc82f31e7a9e5f994aee869f590cbc

SHA256
15e30c831f6cf5f88a72cdbba63b23405a9143a8452060d0a605eaa81d38f722

SHA512
941521b7385c47a7ab8bb141f79d1d191834fe8d9e56ee955347d4b21d6fd0f940f62db3e57ef60fbc19917034619a2e5b12678a45c7d458157ad21555f6a4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f139f229e6f0497_0

Filesize
5KB

MD5
4bee46a21253291c79dbabf54228b339

SHA1
0229caa81d3e27eaf73e562e81216a9e17596549

SHA256
1f488342200c78c0efa206d16cf6ff35567ab4a07bcc11fb231a6621b3178a28

SHA512
c96412f9bcb6b0f6d4812f5a1018cbdc74a59a3e74cca7d4f7b9383ccfe358b7b8c940b564c16658cb3d9bde958ea95f0032ddf55bdca6093b46c51b3b8e5010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
d88b4780fe6f43ee56b48bd0dcd34d5a

SHA1
78d1936c41e2c003450f3712a09222a42ba90e61

SHA256
5fabb19107996db3f57a538e79f835181155be92fa5c0f70dfbdbffcb1c188e9

SHA512
2108d5f2a9679d2a2a060a988fa02f2f45c2494156beb4c4dd3cb7dcea8f1403b17b81370f26faf83ad1b875fb61d3d6369f7aa7b2bddb6322a52749ba6d2219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
a8c4be90e2060ae74a61c16e9dbf6331

SHA1
99a9864e57038bdf61dc07ca22536a07c3db5001

SHA256
a1f10bcd180e3348e1a1356f3dc789b504ae1f044ccda425571610b4e8263fa3

SHA512
fb9806d7231bdb083e6f72ffe096d0b3020e25abf3ce1927aee5ed7f0c91b1a57b0f3b3f678f7217cc20d4588ecc510186a7a65ef5578acfa2d303affff59812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
1KB

MD5
5f5437e1c3e2c7bab296c9daaaa4685d

SHA1
db591afb3e1cfbca0c050e77ba82bdc46b2f3209

SHA256
3b9c107801ca84ab7bac042f06c2854a12b28248d7b6cc088ff61fa9d629f9e4

SHA512
48208db060a4b7d708b80a414ff8b0a1db637026e10bc58acfcbaf8d53fc0898682ba7cb30dfa266bb49ed104bed0602ff4c508eba77fc6ca0dc97cd07527496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
61d0b01995e02eacc236826e1db392fe

SHA1
08d526a8972c8f2b56e4eb161ef3de7ab503a2c1

SHA256
9905986dbbd268fdcbecce441ea9f4386b1a723fc66b9e0d13d8fa2d3d57fcee

SHA512
8d3e5854b954f6cb56d2ee26d01a8425d75d7e4514e204557c242f61b8972d642e75aaa43eb338d072625185a003a5182dc2cd8c33121c76f83d6d5aa0ea1d47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54e10ce623bbfd88_0

Filesize
262B

MD5
19d2f03fdaecc56f7b979fc1b6f60b47

SHA1
095d3e2de95ecd54403297376fc6b9b328843abe

SHA256
b8b8ca4ed3f11639bd89d69846162c851603e560c744621a42853d7178aed7ce

SHA512
fc88fdc185ee11367835a438b7a0a380a8a8c3796379f4c8c79bdd536873d1d41ca16b21ac225581553d9d973b96e8eb508ebd4571067ca2f3dbd0298466b3f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\599c40ef6ac3958b_0

Filesize
289KB

MD5
1d61785e67675029a3c49203bdfa3747

SHA1
75cc657c8889f76265754a6c662c4fee2db54a60

SHA256
0ae8be98f2537c407540bba1958b41c4a693d17160c78da2eadc5c6f9f533fb4

SHA512
8811ed94684af1616f824ee75c1eecf34b2831f433689bc0eeaf9a49596efbc7749a401a35de8bd559b2e7e2f2b94c094d4701329e7e9d6a67a4a981f517ca70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
b1897675315fcbad241336d2c3017372

SHA1
ad619c600a87efcceeba3d3b82c32c367521b9d8

SHA256
1780cf9078b8fa587ca15de8279ffc79ee8e952a5fc2db7359aaa6e7bd0f8190

SHA512
ec59a7e7463992b9bca94b90401f4f9cb274cb1128c851549d8e10df1d7d4d4564564dc86f47db7d8823c80930b2b1ec03f3e68abaeff4b122a0e2fb988b5add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
4KB

MD5
e086fee43d1b0fad3cc764692a37e043

SHA1
f9ba80999b92c69b09932b5da8c74748a509b879

SHA256
6e37672db5aa66fa8c6acbdf27fda381cefc892ac0da69b0bcda25fa0fa42f30

SHA512
5c04a73931742438069dbe0d0e9110c420d1444b5a1fb221ab03198ce213d084a12131a1be476793e8f04c1fced128de7c11d67469e371781e87f2621b03c905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

Filesize
2KB

MD5
7d16365182cfebc5da9380e867d9e22a

SHA1
db14f77f37e9dd153ba7c83ea162c138d90d80b8

SHA256
9a77fc3cfba5153ca106c0de5f04d88f8e26e7cb5c4c6c0a6b30ca5107f5d42f

SHA512
132dcb941c32a1da9d0ef133e0dba3a80711d9744e45cea32806f5a8d4b49e04df023cdd8bc011e0ad192cf53d267c182fd3112d612dc6896072a175eda64f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e1427d19ff38087_0

Filesize
3KB

MD5
5b8ebf68eb7b2a2d60b8f98033b1cd30

SHA1
141ec9ffad34fd0fc03895fc2ca5a4dfc4970018

SHA256
637d86bd1e005ea2bf45fbc0fee36a76aaf02c36c4052eaf97bb9c19dee36f89

SHA512
fc528fe9d4640d223f742ce479f367f1ffb0949244429dd956d33770becb63b05877dabe9111a811f3fadfd938105eb4c24c0fe1471323d7f0b6a4653a7729a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
497ae3dcaa6b719a0be3c81294eed17a

SHA1
b5b6d3c4f99291097ed4b08dc3f4f3c4544d45b7

SHA256
590d879c75c980d98df73a5419a3056b03ce68be9672d7b5d9e242c2d42ef330

SHA512
6f35e5ddc78213bf76f3d067a1eb22c8cc9265704bcd28b3139a5bccc8ef3b86c8c93b24bbc9ac8cd01d13f421fc16d30aaa3eca1b5162e19f79d47556698833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\728d91cd2bd64abd_0

Filesize
198KB

MD5
056190d698361cac96c103d61d5cc5f8

SHA1
28018ce83bf1b2408c00a7e205fe9eb828957fd4

SHA256
76346a298ce97daa67a268248a5f469f98d33c0137569608ee559b1de9d2bde2

SHA512
9203419489dd3fcf189ba45ef784c672e7b2f0ec4bb2ce64001314e3775b353574ee1107d1a09b0da3212fefc58f82ea69f50762bd6fc1bb370e7f8970f87c03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
b375693280c54d5aced6d6be1e97c6f9

SHA1
3d0f7d533daa89038ea4ef92bd5aad5bac232c1c

SHA256
7db9e0a3a298a2ebf841844c46ebba325bc707e378098fc770c1e97a5c9cbecd

SHA512
7ee6bc1e29f8eae29cce60be49aae359ff02ee9a2a4aa200a7d9d57ca15a175f4a725ba688b0cff5bee26ca2127aa54f88024edcf4e259ef1ff2bbd24e1306d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
9KB

MD5
b7ba61eeaae211bc7bd7c0074704d1b4

SHA1
bd192d48958ea5b06732fbb6d5b09b00d4387036

SHA256
9e569e479c2d834bc6dc66500bf73f4fdfb1445041321d86a30ddb253405db95

SHA512
5e68523ac6e4735bcc3ff42ff279d08935b1645eb3865fadda756b9a0aa727e2cf17250752775f35cf11b064ad4aa1a98f103d7a1116909ff4eb65fdc135dc6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\782d018d3f59e184_0

Filesize
27KB

MD5
9a74e2f077e4cfa3f57b2368a2e8031a

SHA1
9bf054612d6d3c67f88e22fe9b09b9781010f83b

SHA256
c3e1b875ef469d58e06228ccde11e514b90d952cca61727f2e28a37cbc508a95

SHA512
d5591f99892cb66c03253574f149d59ad0183889abb508a7bc573ec2be250f417374806f3399f99f469b1cced84c26f97d3a712eb18d6bfca8415b81829b23d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7d07dc3a67fdc3b2_0

Filesize
8KB

MD5
15e89258a7f53f10e5731d3f8d66fead

SHA1
caa3bf1d44415a78a8cd68eac44bdf80dd53653a

SHA256
8f42157ed81b3a413eed14a6863dcf4f2c9151a4c2cb84b74cdba5eef267d9e5

SHA512
46ea762d78fc2bd53192f4c259795a97ac1b7ffd1e58f11e58ad23e4e2d286479c8e6feeef6e6773ded100e7970340bfe4db8fe105d9638b5712cb9527cfabec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
6KB

MD5
8a301df2145b6140ea41bbc64ac8df7f

SHA1
a1cba8c9ce041e91f4b53b3565703b5373dbee10

SHA256
4f784fa8ee9a847138acee393748e525961fc132cea779e2e86076a92e968305

SHA512
ca0309c63570b585167622b847dd055093604cc892aa0fa189f8bb27c073c29f11cb1069d30c0935f13d1552ecafe9efa988176fd225492b25cf7aca1692216d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
04f17b0b2fc175f9c5cdab2ac57aec65

SHA1
4e1418f4bf3f2f77e3415782676199f08b32429a

SHA256
5aca950972679178cb4be41ffbce78a4f3ba854ae485eeba6ad3fae619056501

SHA512
374866462c6f196f4ac8763e3e9720ffa2acba537d114bac88222645a11bb01d4791c7532619cc420467a1590257f97b0e7f65b02e5474cfc324328e8aab3b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
5bd192576ad245fd30a39a8c49d16777

SHA1
61878812c927bdbf5513a7ee6701bba6e9b2ddce

SHA256
f2b7df2fd0aea2156194dd79f97b436227614fd710ce533ff80bca6c9ce343e5

SHA512
2531d98e1bc4604a6860b7e6036aceb8ed17ec9e68a9fdbd83a949d81a7c709eaa02e9929f33371525ef6d60f98ed6219870350b34b76966a9c7693674e4669a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
ca80498e4d2163660d7ce1b05c77787a

SHA1
fec41149849a0fa69e3b1b350226feaeab1cd7a6

SHA256
06ba039204a9afce24edd8af022358700c32bdb503488b423a16143e270e43c1

SHA512
c7c64eda1941c1041fa58285c370c12ae9b6595f15c9b1aedbb4950a97ae127d51a0928634ec1677fe37a798eaf14ae8b25b1f6c30f0dee4b02646f2c4208c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b0b799691077537a_0

Filesize
294B

MD5
c64a422e350f056fb629cac61d2bce76

SHA1
d5e9b81b9f788ca3f9b4abd9db2caf6020494951

SHA256
8606fb777040370a91956457da1ecc76f070344269f6fd26c3d90a82ddb0a327

SHA512
3fade74db6fd9e39473960a8703ae3034880c262e71485cdde4adde7dc318921c23a87d2889a0d2a854b0a87b329438fea86ab07750b353669e34d4354562c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d693ac0f52716b_0

Filesize
3KB

MD5
0601f0f9b5da08cc623977a938170e47

SHA1
d851181219896efe1865810464a1722539432d0d

SHA256
d6de2516030f2311df281a90a6247775e9cabb02b73a966f870b8da40bdb8ecd

SHA512
efeb30dff0c744ea091bce2dc49ef70fee9e6f962b8ae3777f6766669d3fb48aa2c32183deefe57e98c9e74ec5e69c68d71eb63d3efa946273a05317d0ed973b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3e82669a81c981d_0

Filesize
2KB

MD5
00c5a386e704d337fb36ead87763a9c8

SHA1
65b1d24b635af3a20a1e56fc7bfd34a96ad8545b

SHA256
c834211fe9b4baff4614caf59d0ccdfad80ebd82d46e49e74fe1a8f39b7b7df8

SHA512
18ef8f2d932dfa11d1a7db4c8c9f8679716c7d9298e05923c6b54818ac795f8735666ccd86322f01dd91c405b89614664ff5df3791a07376072ef25bae93643b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
1KB

MD5
7880f0ef32938a0b8c9eea4049f93ceb

SHA1
0653581e0a01459c3a09189f29b76819650f12de

SHA256
bbaf99a6a3cbfce89277d5aa3d7103390e9f98be1d66c75e9af4750e7b95ae59

SHA512
2a27637829134c6bf6b6936cef276aae68e8e753f3fef36d81977f19b775160de8edbc784c51862a220c5b13c67482720a27af419e139477eaa9c92f9049622e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c91c845c83814759_0

Filesize
14KB

MD5
1114431b630b5667a8ec9ae5787193d5

SHA1
a313a41e2a002658b24379d3a1cbaf5e20032be9

SHA256
688f6a734265626177b8c1e337e21de896f32c672112963754d85662cf5610c8

SHA512
3ebaf53be5c5eb9fd82f850c15cd7aa74d78627da9838fd94be94eb9758de076e273edb48c84d03aa41ceab7cedf80e73f4258b575a399d8512d2f6dacd003e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
63a953765361881890ea0233e11abfb3

SHA1
c54c764302231076a985616156aee67ea0abcdd5

SHA256
5196d2623c71207cd6737cba7cc34233b390fdb0d8bfced642e7ae130fa729ed

SHA512
3ae5886b6331014ac7e6cc427957c6dfa4449a727d5cdfd5d7d22cf066f2483544fc3462f863f056f563a939751e2c89072fcb3599ce47860e922d435aa16487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da82014a94532e8f_0

Filesize
28KB

MD5
18a6af55373ca2d7bb0eebc283ba1154

SHA1
e36329b9c57cd3b1f3d2ff645dae8835a075f3d2

SHA256
9b81c11110b84976181959239dde55e69fb9f545a38d984bf7d06ed51c46241a

SHA512
e685fd76d2b9d448a3411d9bff1fc3490d982ce1cf9bd41b8cc3ef5a978f738aef54a286b469c649e008cf0bf955dc3e0384ad9fe0732a619d8f64bebc393e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\decee78410f8336e_0

Filesize
75KB

MD5
ac65a440325577788f147b2e54c7d334

SHA1
01c04c9bed5e66823c73cc577998a83b3cd1d1c0

SHA256
0350916c464032155f5571ecb445e200c7d82a38a5d80d3e015c0c569d6ada2b

SHA512
52b0724b12899d9e40cccf6429568e825cf9c2390c44f255a7243d267ad2a15a5ba2a47bafe5d6984e947dc5a1fd4e41a9abb25d46dd7bd154244cfdd31f2587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
6KB

MD5
8d9286a4c0d9cc3b2942c203dc300121

SHA1
436c3eb39ad2142aa39c1c751f451689f52ff1ea

SHA256
21aa693a48184ab69fb1999050eb2228c3ee07a28aed19bbfc25cd80d014fe30

SHA512
66e9e93bde62568557928b1ed9cd824851e7a012fcb594c8999a2a2516e59f07f1202e5d58f1dd9ea9d774bfb9e757a4eaf845abc254262d35cfb77d7676e7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
47KB

MD5
00cd462670650ebb3e5e7f603df689ff

SHA1
aa6cc26b632e898a26566946f4b0d7c403006be6

SHA256
b554daa4dedc3873e79b3015308d19b8ed1e6c86ee104e4ec6ae10da22df16a9

SHA512
c35b5fb24fca365570da87e873f9040c6f438b6f953c88ebd0372a687cd5337597353ee9aaef1c660c95f7ba1386726e313ec2729e8ce0ae9956d03f1a4e5c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
8fc672941579f6bfdd6b3894ed4109bf

SHA1
97971f67a9a9af1f203523571aa5780cd61cd0df

SHA256
670acf4e1d762eb02faf41fbb2cf603f5073482bbc9cc9438f1624d1b20fd871

SHA512
b535d738fbd77d2fb20a283b4ea4479099fd48b5c131f458cadcee52f0fa3071850de915eae12690c73f02111bb9ccb72236819c2783a9d52411452239a52062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f42c9cfed4a6704d_0

Filesize
23KB

MD5
37828d7070b1351688c322118f47d68d

SHA1
5267cd869713eb3f317d0c5955e78774b9da7609

SHA256
5463f53ee6f2d0de7cc78a121ead314ae74769b1a57cd543dd70ae25f5987624

SHA512
e3f32dd4d1120d1d68ec14548dfcffa05ec3f9b5473dbbb6b3b61efcd62be67ae44beada9c8a8e73249b95549c1c1f201dab6d1e95cb02340aabdb3ba50a4f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
a58c8119fa06186cca0ee9594bd53238

SHA1
90b879f3473336f15df37ef88ea9c3b922cc3ff7

SHA256
9582425c628a4b77d0ca9c97e94d1edcf6495cffc2a0462edc3e6ba5f2b1b046

SHA512
92ab3a539a4229c55e05d89eec632077c910b26eca30f65f667c5e07f48ca7f1c7885601592e1cec45f1a79ec02f7c33efa8bf320626104997dd590d5414d833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
03e002c61e3a33313e278e1cbdb1e1e1

SHA1
4bee92afbe7fc69803b91649ea7021337b74a214

SHA256
857d333e94854d4817128d0644dbe4d75ecf6c1ef7e78dc8712c9948c04c0863

SHA512
a04f0e754780b92bdafdeb31ccd9929d94fd2a68abe80374d86681642c269bd7530afdbc32ec13b130dd371361e219b69b75f297871746d500ee852ddc798448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
548d63fd3c18126316c7850eef2b177e

SHA1
34d0c8db4c720f82d3256a900ca1bb353b20b374

SHA256
1ff73a6b9f3777aa3720353ce798e1c77fd2b317af23879ed1e799b3aaf82213

SHA512
ed6f339c2e31da84804d9b9a9c8e8736dc66d9fd9816a330cf5105c76a29978636148cab5d51635a3812abe9dd4cc6f2a54b8d47844a5afa95c0e3ac03217a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f4c4d8436621d92dc6976fef114de6a1

SHA1
45eec85e000307aa7f7c28145710099a7fcc5aa9

SHA256
427f0fcd363be6cf3bb4748a04594ae039bc84eaa88c7ac3b6530a41ec2aa38f

SHA512
75c4be85c3de9812c041cd7e3b47084dda30a8862bfa79f95e2f5728b1797c123d3d2483dade16a3e502d1f5186302afe511b6c7c0a5f7e421386ae883def496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2a4dabfe062f40bc6904c15b32a94d4b

SHA1
36b501ff0948b6f041a96ec7e7725b2aecbd2641

SHA256
7682f38a989107b222d26031442a2527637091eaed46766f65f01f3c89852da4

SHA512
62e0bf4570668d9d3550e6b376f42225e5ef22914fba108486776d3e331ed837f279ee1498bdb288ff26ef38d3c92477df8a571395a36e38870f468cbd2e6c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
57ef09583da82b159d6385d23af42b1a

SHA1
2de4fae0bcb2e64d221cdfe1a6576a10bf54098e

SHA256
124065e66e5224bb19fbe9d6b16205df6a1466c292fcc7b16e4f72d0f06520df

SHA512
23d2b372ab89d08099a32e1ad8a513706f166e7daae7717791b3aa9ff63c2c7ccfee24c067e1423d8465300d438fde84563585b49b3262c80c85032aef8fbfc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
a4f011bc1cf49b20a474a7763e1d5d18

SHA1
9970bd75be5afd66ceac330491d2a01f1e5323e1

SHA256
4147ca8a39799e42ed7a14e4190eb5c663f77620a7025a5f3160c254454b3ea8

SHA512
021898e7e90543ff2a096ba91b12c69d6a61b1c42d4e6dca3de0b2b3db67990c3f8f8eba84d16f55c34e2d435d56801720d11ab1215a613e6cc6faa7b013dcc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
abb4cdd3da16b55c3080c05854f472d4

SHA1
11e2b7714bee3994cd46115b9fd5ad8d75da998f

SHA256
11dfab7968e9897970edfcda192c2f5970ea6d926c76221160204f6d12e528f3

SHA512
12f0e463936188bbac42823f038b68bf4ada9fb5acdb19ad75f32cd2b3ecf4eaa7261ee0c8dc6f4361347f48f31817c5b0882e31be15cfc5d4c2e378ad57992a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.xvideos.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
12c233fd16412222b6e773e5cd0a1a37

SHA1
25832e6f5ba0ad193143986421b955ff6a1ef1f2

SHA256
79d5ba4e54669122b93051a1308f416f25168d1be42bf9ba1f2064f652a2db6e

SHA512
5c37acbcf2044ed29e3ea187f8d07c82d03ac5c96508c921d8e3f390a76ab7b5a8b6839b2b9303e95a071f791650c9d2c44b9b51b36ac60b21ba2d0d3d0e1756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
1c1faa0f33fb2ded419e0029a0242d16

SHA1
97f99211a0a7bb94442ec99a67fe57bb6cd1f968

SHA256
64118be2770088d781969ecb1e68e473239e1ae6ab4355c129e2394ce70452d9

SHA512
1f2bf926c0f79223321e273fafa2ca0fe0f6fa19a788b284679b838d5760479b4d8dee0bcce91dde48d8e58dfb78bdeef4dc802b2086973cd82cfe5b430b2ee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
97743dfb64f4c4271314de37ed5aa3fd

SHA1
65832c61370789b3e3044e009a63299795461857

SHA256
fe078fa4010da3334d94fc9d2cd2428ecd606a39b8019779d9d97d17ec38c149

SHA512
fac9cadb13879c44c77ed2feaead0ec53d4e7118281bed821d49344abfcf8d2689822b9d84da86144c6c6fb1e8cac8c7a830499e544554a7ec0fdd6d8f85c9af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
1b590cb92f5a7c7c9f48719c0c10ac4f

SHA1
32f324a876bfd547ebbae7cce4cd5527f93b62fc

SHA256
ad3927220eee052c529572d171cbd6c07667b85a7b8fb34096e1b755b9e6b736

SHA512
938f790420f67394a740caedfdd64fc19faac2bcce6b8a20cd9619be655c2c29b5fb9d9e8cdc67e6cde4a3aa5cf66e5d422767ed090b64080789288f1293dcf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
399c3136e3c156c8dd2607f926f005fb

SHA1
00d381796b26fad49df8e0bdd2d39bbb4420eaac

SHA256
a68faeea08dfa67e6293e99542cb19178429c3674f8d219e3fdfb564543225e0

SHA512
91aac35460dab40ee1a1268cb6816c06a600d3437ea700da9cfe92545316a65155f0c8eb3d69e6b8728ef97abd7293c399e145d062ee36e51d313e361343b218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
69c239ea076126f0a643d0b8cf10a47a

SHA1
893749f784dd6e32542638f88e91c8f0deb793b8

SHA256
375af8c10fe0260b610e43bc955e88f1c18db8027654fae6e95366f9c91ca47d

SHA512
8996fe8ac3e053518bc313f1dc264e161afd236abf5673f0e00bd02e532a5620e6c3780369c033d6f4159aac3bc67c1dc49514c7642f2bb29415d66f26dc415f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d57644eb6ff65f098730b28ce81cd6cd

SHA1
772cd7ad183be5efa5edad1d4008a70ce35ff623

SHA256
b017f1526908129fe1615e494fa12e79b09eb32737ad38073b405bececb22088

SHA512
9678994512eb8062de7696119ad5a0166c2df84aa87efd786a74acdad48a84b4c3365793ff68362a1dc8ce835d8bfbbd580b673d7b3c5178830468a77a1ee52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
286c3ce209f317ecfb6ace62faa2d275

SHA1
dd22cc5507a3862ef6810a3908fcf9b4e4c6dc4a

SHA256
d27e76a503bfd02c0d152b1a41c378cda531bfbab418660aef396d833724857c

SHA512
e88bfbfa8a7a3c2b1a717b03d8a28517d76602d96bed555dfdd651a3f87df018cda4b5c051941f53eda5bc53c16c8c25dfab15c2d1dadf06ac388c905d58efdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
d03bcaa7fc83211cf795cbd0d1962ed1

SHA1
c70dec24380ddb69c1c60c48d5a6ca43361cbd91

SHA256
87b4dca427d78f7d73d40a9cf4c14ddb6eb077df4922992838d611612383a93f

SHA512
2f0138b0728e0b8cf3189b396ef0f920cbe9bc2cbfb5d4372ece7e12dd1c925e9cf9e146342678d5340eacc20a81d3561095ad7a4f383071e09c6d93139b9bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
c5397258aa81705e171d77a347422a4d

SHA1
86c411bac92f7c76aceba76d71c618682fb050cb

SHA256
f4fd1c1b3aeb414c4f8dcc53c435c40bd077abadad0116275a1270184665befd

SHA512
f8d35fe6c3bcead708dbb173adcaba4ee0eb483971fff37dd7e31195d409f85ae332c5a71f3acdfcdc73e9809ad9eab797db80aa0c591924e90eb111ae2c79a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
364971db88f768ee312676aa1a048077

SHA1
7cce3b2223b65b61f28f0c0294b7cd0d4cbc0641

SHA256
905323389cf720d096a948910ccbf9f732b5722962243aca776a5af9755eea00

SHA512
1a0db817ed23831cdf76ccf39c9d19796110e88c9d14585a530a1e8f6d16031c89955d0c69a647a0f455b32f5740f62f33d54ea54a774c7d6ec2f11389e5a71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
a28d4e2b378ca0efc7ed42d2c8cdfb00

SHA1
ee8f5185a4265f8d88859c95dce6226e4d5d0fd3

SHA256
488a80819538491fe2de728fe172ecf265c69235fbbc1094991d8b1cdda022d8

SHA512
be454bbf755b868bdf5e62c861b24f0f0b53d9e47786f985be97922edcfeb2b5ee76b08ed65da74e016c731072b9f692bc07273d36882cb0e12ded1d4de16e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
d152a60ee682e639bbe0853e42c17858

SHA1
de77144b30503272174dfe0e308c7fbd01c0838c

SHA256
41eb08677f1239537e2c77909e553b5312e94404d7c231225a72527e2d99da3b

SHA512
d6b5a1afd090b34d79195a45660c9540f3c9591c5be5cc01a53cba2f756583fd257fba0aff588c5531ed88c5e3b02c8d6641105c5689579cb7e67764d4cc1aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e9a12aa6de8e354bbcee55d49532d36f

SHA1
234fb48aed7559ce58822d988686de292c76634a

SHA256
0b75993705343ec34054dc91d83945e8c025c4a652a7302ed225944111e2ca9c

SHA512
1ca46cbe265ede15295bd6a50f381cf8558699e9da4b553fc670d8ac3667cecac2b2aaae8de31cdb5ff41fc747784bfaac12e8aef78e78c55b1b99b28612d83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
a44abd0e143655c87f0e7e52d01e89b8

SHA1
6b5f1a0b79120f92218f0819997986d88bc5c92e

SHA256
40c82b6405b02c242e00b4a619ef1dae18f387b47207f1b572f142385686674a

SHA512
c1d4993acf3b9bcb2991476bc25a2bcb83e7035dffa17adbfb208ee3a90a37e92f8a528e59aabb8714df36d2e0ae579a44c57282d30e2c3ae1e69af165e34847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ba7da72e7132b3dc8f64b75ce5199c31

SHA1
484cdd13b833486828e3b45ac9b71284843f801d

SHA256
b1fc12615531bf34377f3aa1b25099b08acd54db14e2d88b355c0eda823c1917

SHA512
7859c850cdbd787ccdaeb0952fdf7b5f05b2088f07b4910ea0d6a724cd246c10240fba07b794b63a9d8e828942cc44a89bce81ae7a781497277013dbe83223f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
65614bd5d0fe43e7b1c0c394df19a914

SHA1
35d584df59f3a6584b791994fc2b038c89efea00

SHA256
ee8209d18075a1f49a36160b60869083fd813c56e42e4bc22a5101601a8ca514

SHA512
372cf30d72fccc17b0deafb04fd3a60f3d323cba10c75cadfb5e3ec87a5e4b3f4fbe4f75d1ae12bfba424e21c86699f9ac9ccbe540f294c1716ec9f588e2108f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
140935fbee928b5a4267d2cb483964cd

SHA1
7cea59bc36e6c7293483f05deacb7c4652458430

SHA256
58312fdf3b8ce9948bdb4a537e3ab9c6a7daba6497675cb4c44a09a7a21cd2c5

SHA512
29622889586dadf899ff7bb24337eef157208863e5f0229dc019f69c48a405e62ae4f140f67bc0b5dc7e056696150b22d4e07b9e9a2f55f41262c61f2ff4aad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
dba9cd5d582083ab0541b93819a50f0f

SHA1
35405e55843ee7d41039172e298265e93f4efad0

SHA256
6b7fc7ea0b8c36e1910bb0bb4c7047c612185b18630a4ef665b3e6b98f2d9414

SHA512
08e66819a6f54ec5a9dfd13db1d21456ec112374e6321c5a178d54131408cbb67baea6aa5492c6af89bd17a20aaa6bb2c7359c48c31cad73734aa635b1319d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1fcc47f40ef086045ce9bce5ae029254

SHA1
54bb630b520854ec4515d9e3439415449dcac5fb

SHA256
c92511fc0b2930bec24b0026f736f1075ce0fdc57231afc314e697b855d873d3

SHA512
658372bf5fdff128aa798503c402f7cd4374581889f39da6d2a737d834b61f49a30c808f3f11f805bae5f4155780a9e25248c3408d15342d8f03957fbd4e0a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
182f2c9c4a26fccb257efdace0d76eed

SHA1
dd908a60a7315a12eef9a189f37b53a95e4807e0

SHA256
a84b8fafdf781813bfaefd92d9967185fb72db7efa53e1208b5a674165b5078b

SHA512
b883ab9222cd6f688441868ac67442f6de0ec184dbf4a2cf4a8528c19b442a72be8e83daf52b859efb1b3c3fa4c2dd42063beaa2d8f7dd91b65574720479d3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583071.TMP

Filesize
48B

MD5
4fb2be0ed7665b34d53a8fa869d13265

SHA1
27d0ad1e77e0b461b634db9fd07bb9f53612cd72

SHA256
46008f4e3603180dea3b7ce4f45b0b96c015cd98a1f92bd4790d4a86e07dbd91

SHA512
dfc50dc224f6c86673e4e17aeaef8b8f7c806c62ac19a8a84397126a2c192b476a858b0ae9e9f9946e4ceffbbf2b2f47237ca5b3b8fb3a2b184275f46b7b8e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5e87fd7f833a79705c47bc4fcbdd8870

SHA1
21816aa9c3dc572b74aef93be7051c97f8a6639a

SHA256
883d8c2518e533a4696d4994432221309c70516aa2baaa10355f2d89b1cd41ae

SHA512
a53c03000ffffd08400a3ad2dbbc18709240ab30ddb6d4c43228dd303d7ca59f84ae9466cc8bf92dbd936f70b7a8eb5d775c15933a3b83d6d9c33fd3e0153f8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ca472522b0bafd3c66a678016a3204c

SHA1
21a066151e7ea43ed84d232ccd1f59ed6f9da6c9

SHA256
b2fad30ea2a7c52a35a9a63c7a62ef81424338686b8982f598ee41f502f66829

SHA512
804709ee9f94364fed97c9943fcf78f64f3ee99f6d95acc0110a913be8d913b43ebda8edf7cd12024a6c62f4382ce4b330277e92074269ae29d7de60206fe2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
96a8b6e310e168aa1d7adbee97279d14

SHA1
cebc45b55e4aadc4a086f9ceff378fd63033e0ab

SHA256
81635fb776a6bfa8b705f1a4304cf70e2a73caa258d759a6396d18bb7966b711

SHA512
f099a4f18c6a03288549487cd37e6f20be03abf212dbab5c5b471cb57627127af63128d997f8742308a7b7ba248b66281a07291bebab2d551348f7c85a5ccf9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3b7b509777ee6abb5e73a4c960676be9

SHA1
2d5a658e8782fa7b6bd3a5418972c6f5a71eeb52

SHA256
776ff199b5d758f577311d2a67d7e521471857d5c9faad75bcd94c9985e7be14

SHA512
b947df57e428000772d6fbd3d0a8141760e00aa53f4590041914d84494c2d5aaf962754b52fba6db941e88f9c8f3590efbca525f768144809a4fde89b50960c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c91a9ac2cf3541a846bf3d362abff69f

SHA1
04101f30b409d39d214df3aa1700d888e8d9b196

SHA256
f8682f63ec1a65e29134371a27cfe49b1494d18574bd639208ea74dc37793106

SHA512
6b94e9cf78fe344b5a5c855245844a2a3612de4d4a4db7bb36b60345ec9d6913080cb84699814329bf17d75372832c1d9c4a201b424d00371c80da2da0dc4632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f9ced3bccb377263695cdef14d3ff71d

SHA1
48fdb92deda0c81cc522c5329a5f261b87aaf2c5

SHA256
b463e37c395e8850ab8931f58b825f91f3de97804e48a6531d4f4a2ce6cf9a66

SHA512
e8eb798b47bb10ec7dc9d803672b9101199a3a27d1fe8be3b78ab4bb9a441830de874e93915581de66e58014ef19e531abf108e016250bf35ba0a27f1ba2397b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
fc194dfb5dd4d432c3847a2b34812e3e

SHA1
9f3efe97e94f30980fb515691a1ebdb6d77f30ba

SHA256
c7cccc71c45bddbe9279bd9962d36389697b05833a244e40bf72308e5920d4e7

SHA512
a3e68e167ffd4f32027ae6c7dc7dc8c9e6606bad373b8ea578641fd96daa52f3b4093587fdd3034e2ee08b62ccf3e53789fac814cfb59d03b619c3b750d74df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
978140a7ebe8cc4d7ea1c51cca29865b

SHA1
ba9994fb90756b3ab14448337b63ad02992c2d78

SHA256
016ff41c3c92860ed75a3e4ba86c87a1d52189ee72eb423a193adc2674f60422

SHA512
a0c3c80c5ad2fbb690abc1a9f8cedbbc7826b8253e3a05580359856855546d8cfc0259e3e4c278261ac12eb2199848d71c10ee3040fef30f1ecccf111f2e0513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f9c5ac40600ffd4a4ab121481e3c5926

SHA1
abae3d14667b622ddd6c997896e53758225f9ac2

SHA256
df167495e40a161db8c534791b1d35cd3faff44e33e39dfebc5e28fbe2137d5f

SHA512
88eafbd571fc71f41ea9d5bdbbfee0cbd95f30e8db9b7fe73925cb16099ca067c32ca7e61e394774ccd59a66a0424d1aef19ed1d07e2ab21b10e5a8dbfd3b764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
330e99ce84c9f692c1b0602575fcb9db

SHA1
1fcd54436898bcd83e8bad4c2cbaeaa52f6e7e34

SHA256
0c5466192498d55bee8e93f6afaa134feeb003a03e1bb814376998366c0606cb

SHA512
7caa64e545bbe5c0e9d78dab361e679299309a29aa5ae5890395f6dc62c468fbc1a82c76aae272ec73f9a7f5f3c78671dcbc21a0b7b12223c184508368b88d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
666ade6b652a2b4ed810491f0cabfc41

SHA1
fd3afc708d9777907871307bd985aa2506d7b7b1

SHA256
c7be1245dfa7e2bad58eeb727caa519ca227fa77c7b34cefba88495671face3a

SHA512
dac822aa0d3c3032e021a696c8f4403bc4b2c62b70b46a7bc66ae86eca8f73f364d41396dff8a2c8875f236e6f3ade9ba487dffee001231e78bdc361ed1379fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580644.TMP

Filesize
703B

MD5
61f71f7bab55650dfcf78fa527cdeecc

SHA1
c9ac0b41acfa9c8972c62d7cff6dfe2365222fb7

SHA256
b262660ecba11dd48d2ee449b842f7aadf6c763daf082cb16b005ff787c2b831

SHA512
86655043e3e006af99e7ffde564902bef3ee9043742bdd22ced5ae0701134daab4f97ff1ddcd0068981408a1093ddb69d7c4015bcc542ffc95230c4a0023da2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c29fef0818c0fc284caa8bc7d3198d99

SHA1
af2f03e5b12a7bfaf5f5b9652b1bba686758679a

SHA256
06a39e379d5bca82fa44b176aabc461c6d3f2cb4788929ceaed0d6025eb5e69a

SHA512
9cd92d05cff38c5dc981c888f3db2338cab14c923206e03c8b292bdfe34cb9ccfe0bb6748e47c83a4eb84d1e62fb8bc047467e7b0766414ec731fc8bbdac7604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
57ce1fb48b543957a2335a69d6a866c0

SHA1
58bbc61e1f5589e9b312970dbd9a574135073e19

SHA256
8174dd7e0843083dfa513a32d154910633837684503e3eb65066d1ee190c2f81

SHA512
6e988e5e6ec31ad4e56d6ab55677e9181568dafc64cc7bb98a28d9b38869a90d44eec0ded69468df0f31ac0be1a34c2b47715daca31a450cd032113b94464a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
325d2232c2a092e29a1d44f5f07d99a1

SHA1
585e4da698072b36905d14d51dcff50e9a4a0294

SHA256
e2259b8dc406f059425f74bfba2273710877e2f9a5f7d470ff2e92420bb2038d

SHA512
34131ff7c272ac84552c13ccee473d8ce235245431f64a79ce6376ff1cae9b4249617dfba658c5f8d3218d8c4f4c8707e0deb325c042d5c8390613798bfd36e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
df0b21ee359811d5741d38e1b5f8eab5

SHA1
a8a261d4af0293c010617142e74cebe4d1fe9da4

SHA256
165cabe4f912704c224173b143c5cbc7300bb5397315aad1b382d3ee261339e6

SHA512
9861b84345ce5fc4658c560c6ab3fe62c40af6427cb184f14c26191b4957dd1e8a39ff50e3aad6adc782b3a48958582bbfef815204bcc7ceab5287abaa352e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38534112de47356f7df12ed2d8cac9a7

SHA1
cbeee7173c1d6f24b75ac9abad485d83aec33963

SHA256
b00847ade329e212f5d5bff045c0628b5f5fff1dd8dc8a2065aec0ea6c9b6444

SHA512
125366084149b55e5eef56d373c84198d18162de0c70199085d11d1993cb48567a840d15b1c9e9a945a578999cf31304af8fdbead0d44abf5011d24f18a8ad42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd2bb319276eb171ab67bc57e22b0064

SHA1
9d91d2cf8d970c0a0b504a5d20a946d34a41785c

SHA256
9f2f227cdd630cf7fc63dedc892282a13750b1e1507118d57de5704db7229c51

SHA512
b20e7b2e2598bb81765e60fb20cbd5eb94e84397f3f01f200b3a6898937f907e827eeb5af30c169fd081519bbde23918cf2ac7f64f9da4c0e68734d79a4e305f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2439f5fa95dcedb17e9a4421a6913c6

SHA1
8357024b7dc04af1bd16162673967c65a46a04cd

SHA256
ccd6e574c4c48d0117591b3aa3d59038bec3cd169de9f1bcddd5ce3e5fe355e7

SHA512
923e7ddb4fd1210a132c15ee3d825ea06d7f44dd1ae5d05bc307504d054705840655ca7ab5f08f78f41743d32658d100874dd0a0583aef150e46c42713800403

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\PB-1.0.0-full.nupkg

Filesize
40.3MB

MD5
e7762c50607b3abea192b49f6b97db6a

SHA1
6aa758fa51ec3311740d4747c4f0b01da4384960

SHA256
ce97dc93f096e70f6107a80cd9e67e2f6e2d81fd344332f80f2527ed84bed172

SHA512
80b634426fe922a5900b22cd9cd5497177f47d107c77bf520dcecf809220542198d850c55276cd381ad4086a87afe6e1bde28c1606c7c0f9f890443d4a2f16f4

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
72B

MD5
3bfa2eb1851cd1d59338268320f6585b

SHA1
de8694c43a2f2090c65249ca0da8def947f06c0b

SHA256
ed06afc26c0181fb30bb66d18e12a91c61ec6f88deb6c7a8666eeca1088e16c9

SHA512
e1c617dfc175556d2e9c7ff54d9b303040e74c80da167423417f18237e8f9e5042e0883f77c30f4888319f6e0e24ff971896238405719df12bfd0b3f5ae084c1

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.4MB

MD5
9fc3286afedc7013fa8d3ee235e99739

SHA1
6de0b440612debbd164a9cd4d5b64b275cc9c14a

SHA256
9bcfedc833ca8c5398117e60110203543c3182ae1d0505d03a41905e2114fb6b

SHA512
286ebb5e04fff684a389f57484a5d418c362476bfe7bb0ec72c7ccca2e6245d66c02ded9a09b0022fe9f2711e1b7d56eea662a7fceacd8af1ecc196045e6679d

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
43KB

MD5
b5a42ecde0b058b3c4e661e0ec84400b

SHA1
7e2bfc653c5bc6997553c150a0823daae372cd99

SHA256
ce636d201ef86ffbf4ee8c8762b4d9dc255be9d5f490d0a22e36fe0c938f7244

SHA512
b7f4a7bddb226066f7edf23dfb9bee658c30ae03dfe727ec739f51fd98c63831f732343c14a6ca080f31baed38bf9064cdd57c9d1daaf4c42c029fe83d846dc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4050598569-1597076380-177084960-1000\0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4050598569-1597076380-177084960-1000\0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\PB\Cache\f_00000a

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\Downloads\Launcher\KeyFile\1049\sharedmanagementobjects_keyfile.dll

Filesize
23KB

MD5
5e54cb9759d1a9416f51ac1e759bbccf

SHA1
1a033a7aae7c294967b1baba0b1e6673d4eeefc6

SHA256
f7e5cae32e2ec2c35346954bfb0b7352f9a697c08586e52494a71ef00e40d948

SHA512
32dcca4432ec0d2a8ad35fe555f201fef828b2f467a2b95417b42ff5b5149aee39d626d244bc295dca8a00cd81ef33a20f9e681dd47eb6ee47932d5d8dd2c664

Download Submit
C:\Users\Admin\Downloads\Launcher\Launcher.exe

Filesize
6.9MB

MD5
c545ad0d6cca2cc64dc38020bde76dfe

SHA1
291445efc322fe71a67fb4f666f300bb71fdaa5e

SHA256
4ea38d4dd2d96975943e0ebfb9a04181f207a462a2322859ab77b3f399b1c948

SHA512
f7f492a42fd2db942d0b007d0eb005810bd5c3ce13b40f9f14d91b9660dcf98ac62aaee168a3a2e57a1cf3e93cda95ae7ddf914a946a7269848d813830b77c6d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 931961.crdownload

Filesize
41.0MB

MD5
b88bd17bf0d6318f5897cc94f7b8b9a4

SHA1
957104dd56bb2c1c9453dc6a841c0e609e6160cf

SHA256
e929b13d93c89b43d3ac635e8d65aec96339126016c658a456af73475f7b098a

SHA512
138dfacad9917e41382ae87f4220dea6d6f8f64bf91a3622595e294cab01f2195c779ce3a8be1f9ad04dd52c14c22bce609c39c7c1bf156d15b8345796156493

Download Submit
C:\Users\Admin\Downloads\a92ab901-873a-4635-806f-f8e05bf3d82c.tmp

Filesize
101KB

MD5
ac59d344a3719ed55e1391d884ee61a9

SHA1
19fe4402116a4a73ad0ecb6fcd6d517582f2dff0

SHA256
07a98ddb3aa05e9a159768cd7fc87a7caa0829b3f6e221d787f63abb12ec9dc4

SHA512
78009f514f33f15e563011af577eb4865ea44c90ca23aedaf0ccc13db6116ce690c136305eb49e3ab3fae8fdad873ac548425719e159a0fb2f5a95d6912e98c2

Download Submit
memory/672-1382-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/672-1384-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/672-1747-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/672-1421-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/852-1945-0x0000000028300000-0x0000000028301000-memory.dmp

Filesize
4KB

Download
memory/1284-1354-0x00000000063B0000-0x0000000006442000-memory.dmp

Filesize
584KB

Download
memory/1284-1353-0x00000000056B0000-0x00000000056B8000-memory.dmp

Filesize
32KB

Download
memory/1284-1348-0x0000000000D10000-0x0000000000D62000-memory.dmp

Filesize
328KB

Download
memory/1284-1350-0x0000000002FC0000-0x0000000002FD4000-memory.dmp

Filesize
80KB

Download
memory/1284-1351-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/1284-1375-0x0000000006890000-0x00000000068B2000-memory.dmp

Filesize
136KB

Download
memory/1284-1356-0x0000000006530000-0x0000000006574000-memory.dmp

Filesize
272KB

Download
memory/1284-1355-0x00000000063A0000-0x00000000063A8000-memory.dmp

Filesize
32KB

Download
memory/2324-1332-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1328-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1320-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1321-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1322-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1331-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1330-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1329-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1326-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/2324-1327-0x000001ABC0210000-0x000001ABC0211000-memory.dmp

Filesize
4KB

Download
memory/3160-1333-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3160-1334-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3388-1928-0x00000000051D0000-0x00000000051F0000-memory.dmp

Filesize
128KB

Download
memory/4840-1997-0x000000001FB00000-0x000000001FB01000-memory.dmp

Filesize
4KB

Download
memory/5044-1936-0x0000000013B00000-0x0000000013B01000-memory.dmp

Filesize
4KB

Download
memory/5460-1975-0x0000000014100000-0x0000000014101000-memory.dmp

Filesize
4KB

Download
memory/5464-1935-0x0000000019100000-0x0000000019101000-memory.dmp

Filesize
4KB

Download
memory/5816-1927-0x0000000012A00000-0x0000000012A01000-memory.dmp

Filesize
4KB

Download
memory/5916-1746-0x0000000000F20000-0x0000000001098000-memory.dmp

Filesize
1.5MB

Download
memory/5916-1924-0x000000000A3A0000-0x000000000A3AE000-memory.dmp

Filesize
56KB

Download
memory/5916-1921-0x000000000A3E0000-0x000000000A418000-memory.dmp

Filesize
224KB

Download