hxxps://wearedevs[.]net/exploits/?O=A

Analysis

max time kernel
729s
max time network
735s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07-12-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wearedevs.net/exploits/?O=A

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3596	JJSploit.exe
704	JJSploit.exe

Loads dropped DLL 2 IoCs

pid	Process
2304	MsiExec.exe
2304	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
2	discord.com
111	discord.com
183	raw.githubusercontent.com
185	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
908	Zorara.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\JJSploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\magnetizeto.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\JJSploit\JJSploit.exe	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\JJSploit\Uninstall JJSploit.lnk	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\fly.lua	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF6AF0B90287418568.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C62B7338-B484-48A1-AEB6-9AF4EF5E384B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C62B7338-B484-48A1-AEB6-9AF4EF5E384B}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0889F6EF2D05E183.TMP	msiexec.exe
File created	C:\Windows\Installer\e5f620e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF26B1D627133269D1.TMP	msiexec.exe
File created	C:\Windows\Installer\{C62B7338-B484-48A1-AEB6-9AF4EF5E384B}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5f6210.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5f620e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE5C688BB52B9CA62.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004c79797f2efc73ee0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004c79797f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004c79797f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4c79797f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004c79797f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\ProductIcon = "C:\\Windows\\Installer\\{C62B7338-B484-48A1-AEB6-9AF4EF5E384B}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\PackageCode = "A18BDF92C7E95474E9D3DF8A68D823C3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B5BE67603097495AB20AEE6179D01CA\8337B26C484B1A84EA6BA94FFEE583B4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\SourceList\PackageName = "JJSploit_8.10.14_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8337B26C484B1A84EA6BA94FFEE583B4\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-556537508-2730415644-482548075-1000\{63534AB4-B380-4A25-8188-EBDD73BE645E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8337B26C484B1A84EA6BA94FFEE583B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8337B26C484B1A84EA6BA94FFEE583B4\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B5BE67603097495AB20AEE6179D01CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8337B26C484B1A84EA6BA94FFEE583B4\External	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8337B26C484B1A84EA6BA94FFEE583B4\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\ProductName = "JJSploit"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8337B26C484B1A84EA6BA94FFEE583B4\Version = "134873102"	msiexec.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\JJSploit_8.10.14_x64_en-US.msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 637296.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Zorara.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FluxTeam.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FluxTeam (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 410753.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
4008	msedge.exe
4008	msedge.exe
3220	identity_helper.exe
3220	identity_helper.exe
3176	msedge.exe
3176	msedge.exe
1916	msedge.exe
1916	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
1324	msedge.exe
1324	msedge.exe
4172	msedge.exe
4172	msedge.exe
1668	msedge.exe
1668	msedge.exe
868	msedge.exe
868	msedge.exe
4772	msedge.exe
4772	msedge.exe
3776	msiexec.exe
3776	msiexec.exe
248	msedgewebview2.exe
248	msedgewebview2.exe
5080	msedgewebview2.exe
5080	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
2152	msedgewebview2.exe
4008	msedge.exe
4008	msedge.exe
1556	msedgewebview2.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1216	msiexec.exe
Token: SeSecurityPrivilege	3776	msiexec.exe
Token: SeCreateTokenPrivilege	1216	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1216	msiexec.exe
Token: SeLockMemoryPrivilege	1216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1216	msiexec.exe
Token: SeMachineAccountPrivilege	1216	msiexec.exe
Token: SeTcbPrivilege	1216	msiexec.exe
Token: SeSecurityPrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeLoadDriverPrivilege	1216	msiexec.exe
Token: SeSystemProfilePrivilege	1216	msiexec.exe
Token: SeSystemtimePrivilege	1216	msiexec.exe
Token: SeProfSingleProcessPrivilege	1216	msiexec.exe
Token: SeIncBasePriorityPrivilege	1216	msiexec.exe
Token: SeCreatePagefilePrivilege	1216	msiexec.exe
Token: SeCreatePermanentPrivilege	1216	msiexec.exe
Token: SeBackupPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeShutdownPrivilege	1216	msiexec.exe
Token: SeDebugPrivilege	1216	msiexec.exe
Token: SeAuditPrivilege	1216	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1216	msiexec.exe
Token: SeChangeNotifyPrivilege	1216	msiexec.exe
Token: SeRemoteShutdownPrivilege	1216	msiexec.exe
Token: SeUndockPrivilege	1216	msiexec.exe
Token: SeSyncAgentPrivilege	1216	msiexec.exe
Token: SeEnableDelegationPrivilege	1216	msiexec.exe
Token: SeManageVolumePrivilege	1216	msiexec.exe
Token: SeImpersonatePrivilege	1216	msiexec.exe
Token: SeCreateGlobalPrivilege	1216	msiexec.exe
Token: SeCreateTokenPrivilege	1216	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1216	msiexec.exe
Token: SeLockMemoryPrivilege	1216	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1216	msiexec.exe
Token: SeMachineAccountPrivilege	1216	msiexec.exe
Token: SeTcbPrivilege	1216	msiexec.exe
Token: SeSecurityPrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeLoadDriverPrivilege	1216	msiexec.exe
Token: SeSystemProfilePrivilege	1216	msiexec.exe
Token: SeSystemtimePrivilege	1216	msiexec.exe
Token: SeProfSingleProcessPrivilege	1216	msiexec.exe
Token: SeIncBasePriorityPrivilege	1216	msiexec.exe
Token: SeCreatePagefilePrivilege	1216	msiexec.exe
Token: SeCreatePermanentPrivilege	1216	msiexec.exe
Token: SeBackupPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeShutdownPrivilege	1216	msiexec.exe
Token: SeDebugPrivilege	1216	msiexec.exe
Token: SeAuditPrivilege	1216	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1216	msiexec.exe
Token: SeChangeNotifyPrivilege	1216	msiexec.exe
Token: SeRemoteShutdownPrivilege	1216	msiexec.exe
Token: SeUndockPrivilege	1216	msiexec.exe
Token: SeSyncAgentPrivilege	1216	msiexec.exe
Token: SeEnableDelegationPrivilege	1216	msiexec.exe
Token: SeManageVolumePrivilege	1216	msiexec.exe
Token: SeImpersonatePrivilege	1216	msiexec.exe
Token: SeCreateGlobalPrivilege	1216	msiexec.exe
Token: SeCreateTokenPrivilege	1216	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1216	msiexec.exe
Token: SeLockMemoryPrivilege	1216	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5780	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2084	4008	msedge.exe	77
PID 4008 wrote to memory of 2084	4008	msedge.exe	77
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 3988	4008	msedge.exe	78
PID 4008 wrote to memory of 2000	4008	msedge.exe	79
PID 4008 wrote to memory of 2000	4008	msedge.exe	79
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80
PID 4008 wrote to memory of 4060	4008	msedge.exe	80

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://wearedevs.net/exploits/?O=A
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2380 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=904 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8184 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\JJSploit_8.10.14_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9192 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9104 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8884 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9164 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9104 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8780 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1408 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8888 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9032 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8676 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13859082046776881943,2108566691957877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3320

C:\Users\Admin\Downloads\Zorara\Zorara.exe
"C:\Users\Admin\Downloads\Zorara\Zorara.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:908

C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe
"C:\Users\Admin\Downloads\FluxTeam\FluxTeam\FluxTeam.exe"
1⤵
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/fluxus
  2⤵
  PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
    3⤵
    PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getzorara.online:1000/
  2⤵
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
    3⤵
    PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getzorara.online:1000/
  2⤵
  PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
    3⤵
    PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getzorara.online:1000/
  2⤵
  PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
    3⤵
    PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getzorara.online:1000/
  2⤵
  PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
    3⤵
    PID:6036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA7551233B107B553E36D6D76DF01D1F C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2304
- - C:\Program Files\JJSploit\JJSploit.exe
    "C:\Program Files\JJSploit\JJSploit.exe"
    3⤵
    - Executes dropped EXE
    PID:3596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --lang=en-US --mojo-named-platform-channel-pipe=3596.3980.15851193016564415744
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:2152
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
        5⤵
        
        PID:408
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1768,366916792597271050,3372109912062582373,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1776 /prefetch:2
        5⤵
        
        PID:2872
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1768,366916792597271050,3372109912062582373,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2116 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:248
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1768,366916792597271050,3372109912062582373,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2360 /prefetch:8
        5⤵
        
        PID:5224
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1768,366916792597271050,3372109912062582373,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
        5⤵
        
        PID:5496
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5324

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5780

C:\Program Files\JJSploit\JJSploit.exe
"C:\Program Files\JJSploit\JJSploit.exe"
1⤵
- Executes dropped EXE
PID:704
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --lang=en-US --mojo-named-platform-channel-pipe=704.4932.12836385775489116355
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x1c8,0x7ff801f33cb8,0x7ff801f33cc8,0x7ff801f33cd8
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1768,5659562342717238078,10771133889155444544,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1772 /prefetch:2
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1768,5659562342717238078,10771133889155444544,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1768,5659562342717238078,10771133889155444544,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2492 /prefetch:8
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1768,5659562342717238078,10771133889155444544,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.14 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:1
    3⤵
    PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004CC
1⤵
PID:5892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5f620f.rbs

Filesize
21KB

MD5
f940afd54af7410744654982aa38db26

SHA1
30bf978baee543b327bc96000d3854aaca1ade7d

SHA256
6543dbbbe799d11e8bee9b06b78dfd0a8d7f937e3b21a43d8b2a8e7fb1e51176

SHA512
d7001f99819d7545ab80dcef4c4dc161abecfddb991068617b4cb24a38eef55bb247faa9f47400de44af3f90ddeb4e0a212627b18cca39c2c451ede8c35dd5f8

Download Submit
C:\Program Files\JJSploit\JJSploit.exe

Filesize
9.7MB

MD5
281a79abb33f10b3f9c6c40c0e165cc3

SHA1
ea7bd361ca528f02f0f95c376d844af98105e218

SHA256
30f840be1b9249d22c6bdc943d6901ee8723284770be1b7e18ea12a844d91f77

SHA512
2f6deba4a2cdba68820dc8a47f20253107a3420a18cf3f0995fa12b434afe41fa6213d392cab2826517b4cf8cf59fceb2083f855531daf9310128754dab7ea1b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

Filesize
1KB

MD5
0039dd8d90de6499f0527b820798c276

SHA1
b7cb3504b95a639eebe3bfeb2d052c0399fb49d9

SHA256
f64d6f1c81803c658ae1320b8848490a1c34e2b6e89ef4ea200004865953b1ef

SHA512
d2f52a63ba6b138385a0344d8a04048aa9061501a8a1ce5f6a0aa88ffe9e2e6e3b21815741d1c9d4f6b335f80fc482969ce92bd9441140648199d045ff91ffea

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe5f63d4.TMP

Filesize
1KB

MD5
0dc09fff32bd0bf443949a22fb04e25c

SHA1
14b13c832997b681437e7b6f359603884c9e9804

SHA256
42f8ffe041cebb991f59e319964d2fe32150d34f15aee799e9606b58e8c8db79

SHA512
8de7c8d5d61db94b03555fc190f413cd831c084a58ad52d05d985b935294f60b5b9fb1caf21545e64d216c75689eeb6aae09c33b566b5040826ecf8cb1f9f565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ea57335-89ec-401d-8443-d70385c88e7f.tmp

Filesize
1KB

MD5
48f9ee82d361c015fc1fe4b73665b2a6

SHA1
9fe91a62bb9b97026856e70bc9440e897f0f2b50

SHA256
340724eeda5f832cc6934bd199fba378ddaa7f1b671ed1636bc481d8c1faed96

SHA512
02955b40de2d1a7b9eb58fb9c6a5e45a54cd2a138be6fb6e7efaaab3e80423d086ab41a6209cdeef7391580d3b98bf4fb4700f616467e7376e2a281016c8d3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
29KB

MD5
ac3619eb929bc137ce24d816cdbf9af5

SHA1
9c3e6a39f020e467635fad161cb8f7cdbfe9c447

SHA256
e64784beaa8988670c944843ba27750a57b438901de18033fecd92df6f98d8e3

SHA512
cb1281e7c932af484ae17ff5930185b5b52de4f2cbe1627afdb8723235467f08630dfbc086eba76c76dc28fb9f566fcdfa03bf512b97515a6227de4a08327e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
130KB

MD5
6370842671effef28a84688de1e3d885

SHA1
3d380e474bc2a932325551cd4f3776ff1d21b867

SHA256
ba7f86dd8fe32470086cc1c50155b830566e6dabd9c741e8831b7cee92e27776

SHA512
28e2fb9c7a961283a5b25a01e25c4ba33ff7bc92855740b64949f86e8aa37f4ca4b330e3dcba071e95ce216d68f0a6b8c517730b1cbc44876897737dd432bdda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
40KB

MD5
3901431a1cf953a09fb115f792530d50

SHA1
9d3f7fea615821763849cd320e3c9fe501d9cbda

SHA256
f6495dbf769719aa52f4bd6887e8e84a6565368841249e480143f6bdafeac85d

SHA512
b480791f426899e8c212d327bce05f9e9b9a9efc0ad09f73168103291a236bf72cc6c3c0f4048ad2feaa560a51235e1ef91dd11720cfc273b99f59fbd60ccb52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
16KB

MD5
30572bc81bf860f471f7357316172b09

SHA1
fefe7a69ca54d753a826bc33b6846cdccbe227c3

SHA256
490d408e7b45aa17a64c1c888ab1ba160b7e8d8b08f46a561a6f9218c02ea8ab

SHA512
bc14466ed9a3b754c92792d5e65a2ba0adad659d9f562b37ea9e91bb7089ab32fcbc43d0d4ccb677389aa047f94d570e55382f3ff72fc1fa4fe28a2023c06c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
85KB

MD5
e6a85e6ab9d15ce7195cffe41549c8bb

SHA1
b5a7efb8ff2992ec8623a2496aa42219ec9a1ba0

SHA256
f858afed3a53c49be782ba2484d020c94e5bfff779912792cf3410a48cc0facc

SHA512
240abad90460df5219631a93a3126e2670b98dbf653aabe5200ee6a4cd83ea92dc14ba585c7a4547876cb9449f38174fec9bd3c420191261e1bbd4135788f978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
52KB

MD5
d81198cc44ed5c6fe729641f0c87179d

SHA1
8f6c1dd541dce180ac09db7d7046432e158f3c78

SHA256
cfaa36795be86aa95875d34ae1add3c1d4f4b1c95f096873f53327977b9dc4a7

SHA512
a21f04bbaa8a5b58067e4ff4b3dd5f2417aaa14d0b528992a71fb90165fbd08a1b6341bc3f90eea61faa464a0fee9771f99ef5fd845d809c34dc08d6e06f18ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
3070b0d3a0854092db26c3ddd2f7b044

SHA1
dcb02d3ca182c85e94fec612e151add71bc5284f

SHA256
bb4d02d2480746bd00ae9e0188a1f262480bdbc866bf3ebf7b84052fec535b58

SHA512
5552400d2b631f9de2c005d201eeb857b95b2d686606195c498e38e6a4296de78045a74bd463866318bef61e3f51f7a559a55fccf460ff6bc7b0f674b6e2810d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
75KB

MD5
4d2acecfe5f244da741e869f71f81d1a

SHA1
8c1aec3c87e733c61fe4750c1fd5591bf16ed888

SHA256
8acafd08dacf1c495a8feaabde9ea1197760699906a1ad98511b5863efbe9f46

SHA512
16aada2d1a0d39aee56364792313a11167f141cc6cdf1a1d6a56d4e3ceee8eeec6b93cf7ccd9fee1258dfc6d6f41d197256aaaffefdda781e569a0339adb80d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
31KB

MD5
32f9d8eea0884da9906ce411d7f6cab2

SHA1
30ce4dfe4fd9782593c3d23795f34144c02e3d59

SHA256
35676c461b9cf6effc4a5614cd6d6e1c81a1337e0007f5e2a9351216f1580068

SHA512
4f502f87e4d9961ce5a8c2575fd2e6bfa0252a0de025a0d4fc870811cdb244e5ec01554b2ac0a953a6269390457c3f880367dd7966d30f71dab84658b9bc4f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
144KB

MD5
30ff756ea9cb6612d20b80faa55c62fc

SHA1
65b93f59cc3db270cd05e0aaa3b5e23002e9a7b7

SHA256
1e6774965b2594936b2a3e4ecafd5b2e496710991660f79dab9bd5b8251c203c

SHA512
0db87b24d963a5d3f394806400642ae676b1aeb5f67ca838bf27224d73680fbb9b5fe4d8c7c9eb35833a213ec83ee8b34872bcb1a52e4d1b742b26a41d624bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
67KB

MD5
bcfda9afc202574572f0247968812014

SHA1
80f8af2d5d2f978a3969a56256aace20e893fb3f

SHA256
7c970cd163690addf4a69faf5aea65e7f083ca549f75a66d04a73cb793a00f91

SHA512
508ca6011abb2ec4345c3b80bd89979151fee0a0de851f69b7aa06e69c89f6d8c3b6144f2f4715112c896c5b8a3e3e9cd49b05c9b507602d7f0d6b10061b17bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
59KB

MD5
5078e6a6654861ca6d4734b0596b6434

SHA1
0951bdb43fc9944ae93f7f799fd2f25a27ac5b20

SHA256
9aa4effc3aecb0297a1785fd98f817ca522f1d8368f6409665afbbe55ea41fc3

SHA512
8df27a2e169b9d84c93b3e3bb1ad0775e2acd58d4464b3195757075e51749529293532048300f91185209bc0e2dfb96101bcb6522632017910e75d44e77bf06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
20KB

MD5
1e517370dab856f71cc8ab9ed6efc03e

SHA1
41f8518a44bdc2beb7e8ea3efafa75e79b795ed7

SHA256
2276d0d7601175db761384b244100741538e9e59272e7bcfd3949fab5ec4f324

SHA512
7f757cc003f948631aa1c9b1fd33e0c3a7dcafcaa83d1097f69e7113cf108e227e2b37818f432994451f5a50c4866cc072b57578bfc4f6981c7d48244172cd4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
20KB

MD5
96816519180f8f9ebe4129691fe25d37

SHA1
9538ccbe5ffa891e2602c1d7cc5bc0c9c5e3dd2c

SHA256
64c437ae1c76a9f3550fd29306dbbbf1808dcfe6ff6b76811236b5f0e43de9b6

SHA512
c065288a7c70fb24846adfa0406d92ac29fd367d7280461b70b1418d2e0eab648b92b8dc5db480d1c306fc90962ca73b24b1bb7f9a720b5f80ead217a32cb339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
20KB

MD5
23b3f4d735220a79b8f2784dcf44b86c

SHA1
bdbe725f8612e24e3a374323d710ffaa29c1881a

SHA256
41adef63ce6e21a9eff352187a11bda18d989101e7e6a48a3a51998c3e2726f6

SHA512
4158f39e9a82acb582fb2d58e69d7625dcf051649890d0c9cfa135459916698980b28305b9232ac29a408943066eeceb25ecc6a221e7871e8c9ecc4ef9827768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03114a5f9aa8edce_0

Filesize
253B

MD5
a9457fba00c0a6cdb322492224c3a538

SHA1
d99bcfc288b42968f72e657c587c61f452e6a725

SHA256
ae53596b4858d67bf83ec6d882ddf251dcb1ac0ef57aea1ea09dd0de77fe553a

SHA512
1a613031cc630a29cc09ab9bdf13720648f8bd2da2e7bcbb50c0d6c973a202b611872375f669f4c58b8426e1441fdc8552db234863efcf41a9679a123e1db27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ae9d18b6cdeef1f_0

Filesize
3KB

MD5
c5142373373bcf81caa608f1410009a0

SHA1
0e1bc12cb3d8702619b2e068c2b80480269554fe

SHA256
ff5b8ff72b6ffaada665b0f3180197dfd7e8bfb10b8559ab591f7bf14dd88fb3

SHA512
8e6ef065cd5e3f94c593b31f8bff81f50c592cd7fcf2976e0a3ba85c248b846b3687bac930041a93d957549e436e13fff73e731142db5bdc73157b357e7ea2f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bf1781f9201bb86_0

Filesize
27KB

MD5
36b5774a6595d7fb251c2641c39d43b7

SHA1
d1843f335b9987940902d72d7e6b23c45e4a6c98

SHA256
d9f4fe7fd3123dff9e0166a57b0bbe39a5ada1d0f174e3f57cbfe7365b5abe33

SHA512
6e614c6d83c9a5105b42165369151f00059ebaf160f3859ed43de22e59e85f9c793f5560fa3cc340b976f80078ff497611b9dd1810d8a71e94ba64f134b1fbee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33954ce3ec19aa64_0

Filesize
366KB

MD5
7c58ffe049bf152d50940abacf499312

SHA1
f25d6f5e5f88b3c9f3ca154c0411dc91de7741eb

SHA256
6f1817e8a968c0090edb9eb3c52eeb6cafe1be0f5fd6a27590f21bccf06b0a45

SHA512
44d286025ba866cd09f970265ada1c1ae07f15eb437c03819838bb95a9bb020cb8cf3dcc06c4791c5a5b94b0ad4b67ab84f928936f564da6dc9450d4c54cbfbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\43d7c480e2253ef3_0

Filesize
32KB

MD5
1166b2963e47dfab08566ee760d4afee

SHA1
fb0fb2dd61def9cc51138a83038c0bdae39ac13c

SHA256
d9c64e2dc8b96fa02aad15ead3b1cec83f09027ab3fe5bdc19517f354ffde909

SHA512
42db2c010653415b08c7ee0feda09ac01bddb5c5e4872aa6fee026e3f7913165b379bff31b8391222483a0ed3655e34123887d467f9b3b89970d8620d439c6f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5c9385b4b844f34a_0

Filesize
76KB

MD5
b0655593ae198e54b1f98019dbc3f082

SHA1
6c6bf298a844dd68339082f9fe77ba9b147b1031

SHA256
472d99c640c8f114154aa44cd74dec965377afaa6bf39eef6cbf82a1acb14334

SHA512
278faaf70a78678c50a95f020e9795797984451b931f63c76d179447394d2d498350ed3fb4b339b2dc42f06a529651c51c935b0278986786ad69487af3891fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71848a3da7ea1aa8_0

Filesize
301B

MD5
fac73a7eb14e55224c9245dc767384e4

SHA1
cc95835a39963f70b2853aa349435fad52b3dc17

SHA256
7c84ecb3e0b6c2bc64d9b9f447ea1bd37f504a0a07fb03b7a6f80034647eb9bc

SHA512
eb8b2124b41224a0951c0f4321b6cad9db6991629a6b8dc94609fefa5ba5b1fc4ac2619c272bdb280b15e7bb48d041560655be838b1903f227d17215d4389625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74c3cceb81f57eca_0

Filesize
54KB

MD5
e3a890f059e028d58aa02fcdfc91f811

SHA1
de0feee605896d615d81df808148bbe4fb097697

SHA256
ebe02134505849448ffcea486fdd45cf2d7d2433e6b02d74bf512b85472a7b86

SHA512
503635b84f2a930742a388cdb23ea4c863b4b02bff6d37452f1e9fe5f6942afd2e5459ad2586fc2a8890de433bcb36529fac7f6d31c9f8c71cad1cede46af6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5bc306003e57d75_0

Filesize
67KB

MD5
427303429364bf0f60229c5cd5ea79fa

SHA1
be60c02521412bb95a41b6cf9852f154f112f58a

SHA256
280168b7e6ad4e3ac97aa5d3f61f9f97c22ba01a92d2ef4568434a99aaab0d5d

SHA512
8bc211c070f84ba1e8baa4c63a99e734152c79f6c22f018a0de320865423d7d04176857bc20a5af8746ad9575495ea7c2d29a3299a2c38044afffe13545d0141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da5afef3d0fb9581_0

Filesize
242KB

MD5
4fc68b6c41b1bb0dfd92d1c79934eafa

SHA1
ae4891e342c914d5ff63c4ab2fc63e17681e8508

SHA256
8278706a06a039eb0511f5bcf2c520d2fb7d160dbc38effdd35642afd6806628

SHA512
c108d69b5cbe623f911bf59b0dda971aee5076e44865a2aa0110315e6cdad29d548fede6b6f10ee60fbcc4660686626a5ab38b8d0c31ffbb8bfa9576743234de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df53bad28ea1e322_0

Filesize
303B

MD5
9795977b860787f905a9d15aef09fd2d

SHA1
250f2c93fa2683510738be91c3e95a91dd6fe344

SHA256
06a65957e6c04ae19d35fb4cdddcfbaff6d2a69a853ef03054d66007cc0fd283

SHA512
fd29a4bcc0f2487807cff633a1dbc95a58543b1aa8e34533a48c739808f19cadfb4c44712e8cc4a99d6106e9525b40ef8f94f9acd41bb51163eb3da4afd38ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e41434aaadb4ac87_0

Filesize
587KB

MD5
6ffa1206b4f0b335472058be99a3e254

SHA1
03f6630e7df80f230cc703da39147a95c1f4657f

SHA256
17341b69c2fc68830093f4776ef40199c90d35e5d855d43856a0af2e83722fb5

SHA512
cb82a633190645e6d0e8345cd4f981de42814f0c87b17fa575d35b36270cd874de2dd59e903e41a4800b50c884e39d90207ed85d28b43a67f11352c171b58912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e454980e85bbd5f1_0

Filesize
311B

MD5
849f8200de669cd14e9f660f61b881c8

SHA1
5b0b253a445f489fe93e0457c3457bd462531608

SHA256
7ff87931fb66fb6728642c963ec113a57c24ff2b5a108e44e31505993acc0e0d

SHA512
5e712c8a8191dd85b337091793ee0521b8863deca8d091dc3fbe7835213a2065239c20397662b93ce540b575bb42e7beaed136f6e3b073127c77e7e6a3977289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e7b149eb22efc5fa_0

Filesize
322B

MD5
fed9f3254ce568422d08dfe668dc6482

SHA1
c1bfd215ebbe86d0671fbf4ec616792cf3f1de41

SHA256
221b4adbef445c59af1bcfbed8b78e8dfd6a71837f7b491a1f806aa654f10b46

SHA512
5c7d211bd097d377cbaf13477aafa235520a5f8f009757d17eae59c6d49127994d6232fce4a2571abd65cda66ca919942f1f7315a4cc9f08361f5203fc3dbf20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ee46582361c18fcb_0

Filesize
264B

MD5
56d2ffd2ab3df7b904022857b1ed0d25

SHA1
8739efe2ace890c97cb55d2cf1958cdbee7df00d

SHA256
30da2ee2c2d2b7b93be48ccd4d393ba1ed2c3db7f5f65619d8b1573408978d17

SHA512
c5be616baccddef7afc42da27e9055137aa3dc6a8cca3db453f683cb5ce6f2c1d53aac560d3cde72f14026bbc20a4846dfa0222369a11fd2896a4d7c9dd52d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f59204dfc3e455a5_0

Filesize
275KB

MD5
66ef9aa6438eab403f1e73077dbd67a8

SHA1
13af3c0d8e9e272f781f03b28b46dfe5cb5f1cff

SHA256
732f3163d4118758aec2021be8e3a33689bcf7ee3deb5910ca706f8716ae56eb

SHA512
b519cfd85b9dbd730121d4e8593a04febc415891cac04f37877ac2a6f557147f1d1e24c8ff375a3cb1fff086bc7081dcd504917bfca290bae59195499908db35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f9daa55b3767bd9a_0

Filesize
3KB

MD5
fc6e4a7e3bf0f3b0326a76bbe30c4edf

SHA1
019f0c6b3a5358fa6c995dd9d63f85cd3cae83ce

SHA256
89794d0098e537bcc365a048381d2a01bfd180882d6f1cd0ba88c9fa69454c83

SHA512
b8e03591c77ae4d969f2809eaa6c908d122290198b44b9c9604e5f4661d987e6597d38a888469eef987ce89543b65410c3a02c16380517c911d8ceb8a759b5fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c000c62d9342f427dff330e117fab6f4

SHA1
505a9bb03b104dc57cb906da952b630fe3eb8800

SHA256
0a8a99e4506eb46f582579393413693ddff7b445c8f592377a2fd3427c5be929

SHA512
30bca7ab0739ed575ce516442ca84266acc369fe8f47595f7656c8e47e092a9d4413adb5eb2e09d25b5d52fee46d0d189be57bf85a40ca954353f2bc27427136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
89e7a55cc1a9bb230531a062ecf4d828

SHA1
de72b4fbe005503c97c08e512ea756851a5cc901

SHA256
10f9c4bbd415bafafa8aca23e3bd956579e218a23961c2503f65ccd0f6356568

SHA512
b44d5ceaa61b05b42e8ecafa7743d1a34522b6a2d88a52b50338a062309ceeb9e79501e77f40cca7a8d930123fefa1b369265dd7446096e7ae6d2b60aab7c174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
99c7e76e881781ad83e2be145db391b5

SHA1
af7491054ac9b3476fe0fd5fc09b956d78c78e92

SHA256
bb15feb1bcd72a0b91f9d60bc196514569fa53affa082198dcc0da987825f267

SHA512
434b7e4b5e0337d7c85285b08259ea277bfa3dd7b2fc0003216e00ca064444b82d5f2333c926db0d8406a7c81355cdb1232455aaeaa05dc3f65720bb1bac1893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
ed5797d984cf31b51d639716a9ac7673

SHA1
c6e4e82b16e88ed05a16cfe898418c8529bef00f

SHA256
378b8b909f0950b7b3020e59bc198cb53f0482d46382b29f5c730059cbca153f

SHA512
ae3818b829aa7bde9db592fb93d46d7a71d9b0f422dac87823036d3483d32183d3fe42040b228f1900cf80c9413fd14772e1ce50725ced9f0d798cc350924975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
34193d2aebee8a12ce8b63965cee1870

SHA1
d2a052deca25b6528bd5f1043127e889bb2131fe

SHA256
808207f82bf7bcf01ef4e792cf7b96bb1b9f686f19306d58b405fb70e0ce57b0

SHA512
6ffb7d7c4c58578df02d972d40e8056c949ae2a0783a3f681a08a84faca3031d753df40edda569f5a6bbbb067820885982e2d6021a6baeba441d597be96c6e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
f8466125e614004b9c82bf6fbab2dcb3

SHA1
e2744a8da8529cc2a84a2d7b3bc726268ebe1497

SHA256
b279542f81672c58b3a64db120f889a401f8c55ac803371f7bd4c984928ae81e

SHA512
ac43e32bc2ca72e72b8eca588686526357b1fb4de18088df32456d14e9dcfbde90658e3aa36b12c1d6f426172efa13081a87cb8553a08788676368f45969ef77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
aa5b5c753d4bec8b78aba4ae8c6c3bed

SHA1
80802060afd8cf0ff77329fdb2d84120ae1d770d

SHA256
660f0ac0dc664c236dcd6daebe3fcbd54da918bd8357da08899e433ab74d0d34

SHA512
82d09f1cefcbf3d1294b699f10bc3130b124ad6e232281cfea6b634d94cd8450855f1b5c5856fec05d1a58a3d2c1f9975095ab220d86f280f722936571b95555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
64a50abbdda6b7e3f16c8d4785f4a25e

SHA1
26c83f9db62cc90a5de2b16cf4fb4a21b0db4fb6

SHA256
e3db1351109ac5ae24f2dafdf19303c6682a82534aea25786523ad10fd4c5feb

SHA512
f63761e75214d350543a7e1d51dfa5a772436f56c1575b72b535794e790da1ba7c4e9c9ce416434225b594600547445c41641e9c0278478cbd952f9806912529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
4c66157ccc0420989079f6bf007460cc

SHA1
1be6d38e9ae8887b363c6ff1a3d3b3c81904b4cf

SHA256
152bd89bf7d0f9447c9c4fe7536d7989f206e2fd75eecc171dca0ceb2fa09867

SHA512
1f7122aae1eaf6b6dfea9e74d77f892590db7b7d0877d4b5155e42a1c91dfa3f1adb2ba636499da3650457d56502711daf628a05b1fdaafbe731e0529638f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
6311fad99d7852a1c5d2c656c517e97c

SHA1
49781c3f5ab6b85aff30feb07e92d2b0483e8cad

SHA256
7c4efcda343ee66a212b6557664cccee60c8f5f9d1ec3e778f65954715baaff8

SHA512
5db27e43df502ea977a80beb15ed88e1987d57245c2b7907d0f439049be76e488dcaae941d1fa774089439657e00782473152b7013063831de69cd0e695c59bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
b59aa2533c3b66cd2dc3d74513758e10

SHA1
ac5e110bd33e6d2ee32fb2059d9066a8bd19a96b

SHA256
368afdec2642f9f0c229a063868a0c681356f1eb8b25778d0009f75dd9a0bfbf

SHA512
d8665ef7ae35fd7e72d368db6c153a96762039e0b277eb34ac955e15bd9cf7e7110a117dc601b73162f8d2221a5ce5d49dced3746c538a92a9aeb121561a717f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9da6a224947e2c906ffac849d06b1c70

SHA1
177a73bd0dbab24464de27f616baa3f9107562a5

SHA256
d5cf9da9e1ff0ba642f49ee8b4fed9c3fa7fbc52a7d7ba7a923ac1b635e96c22

SHA512
843510887f2558247b4e2fd18135bfbcdfd336738f31bb4a570828c65d3b00d578aac48e452da90b1a34049b14e243ba399fa80e38a613ce7e390464d9cc1d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
11d395c4727615e20fa8ace93c970ded

SHA1
417fd37e871ab8573616e043b3b95b337e60e0ac

SHA256
2c439f0957fd75cbfc143d3820b4d2fc072d0f3b7e10fb46b5f24205ef7a9285

SHA512
6f5bb297be862c39bef0a734bc2cd1e8ced9afcd6e0759becd7973cafd1d57dbdca20e48860919ee159fa933e1d3479befc07fd99e232ccd68c64f4519ccf30b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8857aa5e9a6ee956b45907282d5e6789

SHA1
8225bb240363251d3134499ab3de013ccc815395

SHA256
77f798311e7f76a9488906d36630e213a15668575b9b20627e6f51dd30529aa6

SHA512
5ad5f52c6d8e38214c74e6cf34a150d4e37b62cc6415d7958191e707d60cbda1cea3e4f6c5e112466663ed1134a18b713b359df5cbac02433bb5784d146c216e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ac99dbaa3a7c3afa82e887f867726b37

SHA1
50fb00f6ee1222ef3fbd3eee44d39b9479c78552

SHA256
8e83202f26cdc43b32c500672094ffeab68fef35e2f0487e48b26f5d6f857c2c

SHA512
18aad38cf8ae7570488b5f68b7f7eb147a7dc4bab9ba2bff03fdbc512a69f41d386eb6f49e8355614390f69ef1c260f1ae3aeb4133fb3c6201d58029a0076209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
36a90739741b906a3c9556b7539f6a80

SHA1
489daf314abafd08331cdd3f1b3b6f8cfa43802d

SHA256
ed4c68092a721e077fe4389bb8ee9cd0505c0e313d34b821f380756aa6bcd9c4

SHA512
9871505503cf21de0c14900be6d992e18637492adec1339dfbe9ed3b473a701c9b9ea3d943dc0464cb07741053da5b9e933627284f7020946a87424fbb4d7ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
790c02e789a0137aaac4fa450a8868ba

SHA1
4fc146fa005757c4ed89bceb6668f907e891586f

SHA256
1d03e8d2d4545062ad3be0896bac5cd1acff68977c5dc96f215fbe5fa873ad60

SHA512
0fcddcf35af50069f8c704f7a97e7b2cd026daa342d57be9b21bea12b6c0156a9352c10bda211fee66d5cad034dd145939821a45c124877a62c68d7a7b6b529d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
31707ecce9dddf47bed4907825ffa790

SHA1
b6810a78da7a270fb5ff43f4d6dfb3b480f94c0b

SHA256
daa0fe9b38aa2e89db5be7224af879bda77e60f96721ea12f1950595e1773ed8

SHA512
811cf640619024e1c85cec6790603aa873025d5ef2c31693e39ccc571b8756ec3b0a06881aed9baca7064cc8dfc8b7b66b89e7ad601fcfa06bab8dc6018f1404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0e7d3eaf2c17f08f615bcf339e7702a9

SHA1
d8dcb3c9446200e91c5ae13fdb7128208a418a2f

SHA256
faa81728f5f19eb96e9de8e417e1f35b5119f6ecb0b1f3392fb11a21d3ae3f1b

SHA512
7ee1c77be3381d4d4241ce006793e35de11dbaec4e33540c7ce8017bc7eca14e25ad121947c94d2746a772c894df43958bd9da7c352fdd6343c4a635de15fb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b20eff5a9dc4a67b4e68499cdc276acb

SHA1
2416c0d441c87b0230668a59217bc7e6db5e280c

SHA256
0dcd6647a1cb18e87c7cd04e8a85d0f479cf757148b6fb9d47dee4e04bdabb9f

SHA512
8aca158aa83ad12af5a325fcb753d8dcd63cac10b379e4528a1990b891cccfffdb0be21e5124ce99790ddc0a78f286ad5368d2ddbeb482ba936aae39569a9107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
4b60710cd93e50a8d5a85b5bcf146a34

SHA1
35e6815350384082092c6e1e13c3bbb82a330d86

SHA256
07ced9f0957bd7cea32ee001c0e8793335c314f2e2ac4463fc3ba835e2609b12

SHA512
452683713336f9ff23d362ef5ed1583c10ef8db258b78d0a0dc686957ca1fff19ca8193344992be99b615be363e16501c013f26802a643b303c0edec21715d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
485ab816f8fcf7753d4ace9ddbd5b963

SHA1
9c20c488dec34f88c976f23162a4b2c8ed785e78

SHA256
9a185bb086b377b7f5a8337bb0b1495ef51cc5c60d97cf6d8dce688ac8a8ceed

SHA512
a25234ed9933dec0d036fae69b956954b060e6865a25533f274581b53937fbf96b0feb87a6ac8adf861380c1692b4e19c8bddbab3ecff2fd4b1b2334e900afcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5896ad.TMP

Filesize
48B

MD5
11676d55e0a41b1efa8dfb9827a8f6aa

SHA1
5dcb313d2000d3769fa448c4a39b8a683ec0c28a

SHA256
88ccc926b8f29892c9f8f66a29e404975b35105b2daed9f03e13c0b43da0a0d2

SHA512
8a518acf9562d472d00c7ccf0b200f797e3cd87cd5b5b2d4aa2e21c18c3b90923d012caa824eaa74d86ca00085992fbeadb538da666b37cf35f0bf20267782db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ce161603c32a81d30985ca79cf749a5

SHA1
5eaff9ce22ad07632e3c9c837ed583bdfae024b5

SHA256
ff3abb1f6d224c54ca54938ccc84a384c37e4bc2ddb31e5a4a70d014a771d979

SHA512
141cc23c77fb7bbdd025e2a980a397749696bd1f0a5ffdad2beeef2e6cae5d5b80bb4620bac25bf54d8bacb19741628a3b79b7bf8cdb0b4991e1a93bb7295677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
60ca6ac509e0a54666e85f7a47366dcc

SHA1
3c468c3cc78532594ced88418b467211fe9daf6e

SHA256
628a36f357019126b31ad0c6b19d241dfa9c1d8b600d9397360be14013e91cfd

SHA512
c72b4cfb10bc8c050f18805a96c8f238efecf64956574ebd0e3746a470e1488573d2b7dd3ba625bf60e643e03b09fb1d499c6fc6750333723e8676541f45cb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fbe5e6355bfa5bf2503d23d8abdec2a2

SHA1
4e85a65318216ebaf77b7ef99d77ea001ae044be

SHA256
bb52841e32ca138ffb805bbfd00f8063b61430f72a8b0652b9af898fba007828

SHA512
5000f1ac73f2ddfbe0d9747b8046e4136a85c45317cb2c339cf89d01a83fe2d877dbbbbc3e99bffb914838b6b4077f3d3c7b981e5077596d821e45463ede7bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
76ecd839c7a919fea51c888417c8fb67

SHA1
c12037abf9f997c6ef3c4da26e6cb4eaf5270cf6

SHA256
18788c8720695efaa14a7b1b6a8d81b8d11ab459982bd14e98fb6c9d038aedf8

SHA512
f29bf5c884f6b7438895d0f03a9099957abebf8faa409ce7d4cff21d3d0eb6c17fb9065f3fdf369c16cc695db76c377f1bf92fb2264ed76277c4adc562693439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
62075bd9302cee358d7e82a2335484c3

SHA1
0feaed82c6d70ecc39a5d533156e6abffed9a105

SHA256
74eb579df927ba76551f8b4f44ba8096c7f589dca8ad00ae0287f835c4037efa

SHA512
c9f4874ce525b4170957499fa253c7c9e23a660d5f89078ca06a54d021512bb51d55f2dc542667c066ffd881a3b18ff111bc7b73a3bde058ff2d07c10bc0654a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a8dd3cddd153819c18eeb5215e82d3c2

SHA1
e42a7ab725a6e1c7cb6ed55953483a4eb4af2dc5

SHA256
4f3e3ac9e67eb2e7eb9b2a204ea16f5ae3c87a11227ddd43eda01926c6cc472d

SHA512
50a8b8d1261b15ffc5cdfa53dc0078b3e088e570565a77e08b8a0e9f376e1f9949f7dcd3e36e92719df47220b2f7c22d505b6d05f4a7901ea83a1d0b8d9f37cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b9f02e40a30ed60d65dd408721cfccf5

SHA1
444ed6f5002c379737374c18d8d74b654ccdfeed

SHA256
9cf49d8a89f27358a27f8aed8f6299cc339699a505e5dc76ac9579398d78a2cd

SHA512
5243a6eb863cffa973a46023b25d9aeafd4fc670235acf3208d04e056b700bed4fdc8d7bcfeb7ea4ba7e074d06390161a050b132eec4c04bb0c065f9699a2f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6720700b7678e0815a05acc57b69ff4b

SHA1
956f87e0d82ba44204bde3f920eb74a432be36c9

SHA256
074d152785d3730bdf143cc53c95ea25aaa1dcfd45cfddf70a603a5acf460c41

SHA512
542b5db53bcec78847a18aa32cb64db537760bf42b816aecb3b15ba4964271a92380d16df8533c2237da75d7fab4a5b9599cc623fe94d098dc8498674c38ad99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85c5ae374a0f0eac103f0a195ca94021

SHA1
a96f46ab1f4b9f116540d29e6b822fff4df9e30f

SHA256
c3f5c46c9a05126bca5f95407e0575c019e67d12759d89d0c7e4f4456ca1fed0

SHA512
7cc6c19923e4446f49e66750bbb43e7cd509a1afae99d48232cfd2567628d5c852915ac2f8d9ac9ce05fab23401250da42fee9b812950073f1c5e621b9bd2c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d62f9d88fd4e2a828f5e178c7f9bbc51

SHA1
f7198f4c06da52b947de0a514f3b966d6e6e1009

SHA256
1ff1fa53c0129411daa902a4e67b64d6a4dd63bb24ac83564b63384bfeaf0c65

SHA512
ca29e5c46312243f229c819a2fc90e0c78fa21968e333621252d4130f1630292e76fcdd44ee129b29628290df71d81ca46cf1eaa07a999d3380689d2562a92a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
36513f1548114462659f5213885a50ee

SHA1
63f2fe3789433c7176228f4ba841fd074fbfffbe

SHA256
f28e78a036088cf1543d6fb37193930245df30243411c91cee2342c6d3d5e181

SHA512
26c8e2198a6dbf03888021ba5593fd89dd22bec256620117c52ba3cec5e4fe92efbd799c9cad8e0d9305d0a9328a6fadf70c1907f32cea09c97cf39b83422532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
dce52aee3eca89ab19fc767e829654f6

SHA1
7ccb36847a8c1eb45b47296aff451036f10f9bc7

SHA256
8876f248ca3f3d570ee227bdf286bd5986d25e383f06af6cef4b1d07bc11e808

SHA512
42a950b0c677aa4e8e971537abcf0548dba651d90062a20e15cba23f19227fb95c982e17c0a3a409f07bda6015ab5501627bf17a7174d8b6804cb8c7e4591aa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
43be84c9eac514160336cba3224d0258

SHA1
fba0744bb2349ca3674ce01a454c7ca1d4d70f8b

SHA256
daba715d5e7432fd83f7d375c77a959617005155f0a9e0eecc7d8387fc5928df

SHA512
f97b6e95fc1b1d6f48def17b6c32b0ef0bad79b16c4db6fcecafa0f9266ccf02e77ca59bec2d2a32587076de2f6e54a5f40e896a3ae7fa502ab5eee7e36a4479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585157.TMP

Filesize
872B

MD5
a35d59dcfb66c894fe457b2cc9f6c167

SHA1
5860b8bb904190bdd2cd791dabc02c5742969d61

SHA256
be813b9b4ed1d0e32cdbf67ea15505caa9cea97928c09d7b0d5c34ae7c29815e

SHA512
1e33e3b3518c045129316695d8aa09cb85c7f9ca16741287509433da84b9f53fca0153c95a372e5bb0154bf244081ba9897257fea4d6706369ed349949bd2df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13331d8968320578389445aa11afbcf7

SHA1
8084641bf12c571654908c285da49e6f8164a442

SHA256
7ddbfed9bbdf93055566ec4af47f66036e7ce16e8cf4bf3462989ceaae866272

SHA512
0bc4eb373388bcea06877f0666cad2b52d4616449cb9a6eae95811cd76a5287945e75c7edaa0a03e6379d709723efd0315cbb6d5bddbb66de3a76ce85273fa70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
72798328c04951cda881f80b94c67763

SHA1
4c300bde8c4f11939945ccf664bd9a45ddcfad23

SHA256
8c722cd61f64c03fc87c4a10443d04341fdfef4692b4c4bc4985627568fb8700

SHA512
19ef34be9666ed209f5b4ae38653a5a0a57afba1834bc8ababf5869e30d5be7b710d303808ee2badf56f39bc9b4c6a68bc69f5ac2f96c8c8be894263417276e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a005cf901cc89082de85226f27b61e2f

SHA1
01a576d63cc35e5ea23b41b8f73dae64b84845d5

SHA256
588a51c4b796230cf820faf4d8de455a0e4eff740b147f4735bec8f9ba9f8b78

SHA512
27d18555b0ef26c3353c0f22b537c7cba74cb861fafb98387c340e978c9e1a619538e534c794750305ccaee5b0ee16f9fa9aa1de8ad90ff7de33f54c552688b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bacd824c300bad142bf145fc1d7520f9

SHA1
e9ae6200c4a5d273cf8d0f5cdd18844da6925811

SHA256
5c97aa6fceccdcec4a9844b11eb146d593b3d45372e70551fa8d7cd5920ea22c

SHA512
f2d6579f83cd92e57a53ebba39b2779f4ecca9078b72cc8e3e80ae9d4f339fd2913a069b7f1bf0d84c711d69ed3fbd9d0e798d645061bc377f6734680f39c2d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da73b736edc0f4338c06a82b43b17fcd

SHA1
a08b5560369fb4964134eae5aa3b8a9284794519

SHA256
621c86f0692cab14a8edfeb06acfcc9f1323d2eb5625d7a0f95e94f1bf2d867e

SHA512
69585621005cd6966797e52da4c96883cc9035b0fb8e0f45c2a8e54083d36db409a701bbc00cdf39d5ef6c108df07ac10800ae89196a720580f975ed67ccaae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d51a5bbea58a4ebadc5750f6fc3a5960

SHA1
f3f5735a8f8f02889504eaf05535193f2bdae225

SHA256
77358d996b5d47c53cffcd63f8b4606ae4d4ccc74b3a69fecb5c0a7535e4f429

SHA512
271db8139a5653d089102f24671af2be03e44ded958cfbc788d1c5e55ce0723cf769f271b48183f42aa66fff4b6c8629c6e9522065517cc132f977ffe45ba195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9adc6968744c09e6e2c102a231729d9e

SHA1
13af096f67e867b4cbb9e01244278132849e0e5d

SHA256
a806fad01762b11c71f924910542d5f01922e005b9525c0c1f7f05b2930aab13

SHA512
68051b7db76d93f1a847361cea4a18afa6fed1c26b891d81cbb8f26e860eb9dd333033a4ada6ed37702af80d63c706ed5fcf4841de4712e125ba89d0a91484e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3fa8e51c915463f139677701a35bcd1a

SHA1
07e7f6b9176733467ab702f656132fdfb69f513f

SHA256
304cd06baba14a02938094f45c94a5d2396da9d45b6a84a0ffd08a54af758479

SHA512
12bcece5ea5eb616f5133052fe2a4cacdc26087aa656d59e5fdbea0735673e60ef3d969ebb8f660a784c8e4ca9670f285b85c3262ae9105f719a15d95ab8598c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8bb8ca7efe2ea488a1283786d848c4d2

SHA1
35bbb627185902201f40318eaaaf108c06a3856a

SHA256
b32815159a382d12df0cfc6fff682b87d1f887615d0f62d628d5e954236964de

SHA512
960ba22173a9c275fc1adea866b63877d709709e143cc64804b080f86ed3e15aeed767f9eea36d825099921c113cb326dd0f3f445fb409e3c5847173ef67e3ab

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
467e653826c28f44214b9fde1d2c9995

SHA1
35966ee3b522d31c18dad05677b93a69771ad800

SHA256
ddbcbbdff338ec4df8d2e6d207d0bcc7029a3cda511b3174bb6966912485aa2c

SHA512
07245cd5b7fae515f385e91fcf938c1232ecaa31f761299f7f5d393a6878052fcc18d3b7638f62c479d7be9795375d0a8beabbe44c61727e543e957cdf03df9c

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
8f1ee67cff86fc5f7c71eb36e2698a39

SHA1
7b03a157517769c95bdff471e7caf27fae313d48

SHA256
8fd655c2b39cfb256f96976fbeda993efebffacf0489a9f4027e0dd4de218e7a

SHA512
499ed7f2e9e3799934d3a1f53149a5d5de2dc8783bdc4e26aa7ff1bcee8d0062a645711977a2fbf795220a08829d303dfe7b1c55d4de5a8df21f1f3c23902fe0

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network Persistent State

Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences

Filesize
3KB

MD5
fe71d701b5a3457eb5250a480a507fcd

SHA1
1c1fd182b8771fae7817e7f5c2117c688a4899cc

SHA256
b9e19467c32fbc153a306ed0cac7a00aec39a497d8453c6386be36a296ce620c

SHA512
af7fdd5499ab3c97526ef47eecf6b5c40d5fd3079cd62a42aaf47141d51f567794588a809d3f07e5ce652173180a85133c5971d08699a7031edcc1981fa7d97c

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\c936305e-5bec-4f1b-a4a9-8a0d4fe2b933.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
2KB

MD5
c00c595917ac0cc7aefa2ad651ad2dc6

SHA1
069cec0012bff2ebe86fca755714832765c85ada

SHA256
aad47d158ce0dea703e5a1da153b51f436baf8710fbdf7f679b87e2ff9a8566f

SHA512
2a055a5c33b0c74d10dbeef2d37c30d5938cf855bdbea3856c13adbd38db2b7017e3a628a40c92030d9d47f3edaae230030f68ecc48f98afe70f5fa1739ea910

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
2KB

MD5
6d3b0fb263fbbea240a0685a88e84b52

SHA1
38b7cafb8bb862a2fa7510e7b6857c8f0ac8e16f

SHA256
13553f370ea65c142936e75ac3dd1d1df996471f075bf5b28057c3f4aa9152e2

SHA512
3ba8071bef3200a3a3c86851882712dfe2478c451851c115ebf148d810f2e58846b458cd8245da143cb1a0033caafb49870fb900362800b54886d9ad9b5b0d11

Download Submit
C:\Users\Admin\Downloads\474a2df9-8cdd-46ab-9f87-39a64e3b35ff.tmp

Filesize
24.3MB

MD5
90989c3e7c2e6e5dab4fde37d8fc8707

SHA1
b39b05df417ae04c980df44af8efeabc6de93bd2

SHA256
5d2bac2c2e6c925f9e175f8158070f8d78c0fb05810b30417e028d4ac4263b86

SHA512
0ffac39c8f023aba7acf488356c3745ed6d7941ff06ccd725340fe57322fc3cbcfa3f6c6dafc99eee780f69133148cba70da9e44fffbf2c2e00c6cefaf4fde6b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 410753.crdownload

Filesize
5.0MB

MD5
9a5e4420fd429b7444e7f02b2b52d0bc

SHA1
056e5ac7ef1334698f4337435985a2d6a52ae059

SHA256
44ef9c095fdc078cad8648bc9ec75f744d2c72229ee427eac65fbc1859e57172

SHA512
7728f89d67bf145106d7c86dd7a1ad27aac74898210bd86d944d7a9111c41fb3df1ab2acab5a4d5bd9cf1a6dd66d9b460368c7994bfbe8807e4c21ae142f8f5e

Download Submit
C:\Users\Admin\Downloads\Zorara.zip

Filesize
48.5MB

MD5
e4dab71c7680ca84e66ed2e0fdec8e7a

SHA1
f0d2a1f4bf92c8c29aa16ae97f67f6183f31737b

SHA256
b06be81c4f3b3a9d7717ffa9a404f3bac1875c818cb0058daaf7941370478478

SHA512
762a38c378d2573341bd97c112e4cb9d4d0d8da5e41104b4e0bef07af9f89622a9e09c091d540579fcdda5e53bc9283b3c479a82dcd3dda89ee38f508f3eaa5d

Download Submit
C:\Users\Admin\Downloads\Zorara.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/908-476-0x00000272DAC30000-0x00000272DAC31000-memory.dmp

Filesize
4KB

Download
memory/908-475-0x00000272DA6D0000-0x00000272DA822000-memory.dmp

Filesize
1.3MB

Download
memory/2508-1798-0x0000022B7C8D0000-0x0000022B7C973000-memory.dmp

Filesize
652KB

Download
memory/2872-1526-0x00007FF80FFC0000-0x00007FF80FFC1000-memory.dmp

Filesize
4KB

Download
memory/2872-1674-0x000002478F600000-0x000002478F6A3000-memory.dmp

Filesize
652KB

Download
memory/5220-1799-0x000001569FB10000-0x000001569FBB3000-memory.dmp

Filesize
652KB

Download
memory/5224-1673-0x000001D6EF2D0000-0x000001D6EF373000-memory.dmp

Filesize
652KB

Download
memory/5496-1585-0x0000021ADC100000-0x0000021ADC1A3000-memory.dmp

Filesize
652KB

Download