3690bc42c1c05331b2ea1374f99230cfe82d71bb72098d679575df6cdf6ad308

Analysis

max time kernel
472s
max time network
462s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
09-12-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Virus.exe
Size

6.7MB
MD5

7934cac1097c699a3d4b2e683eb53014
SHA1

8f0709fd999200f1bfdd3d35f4a7adab3911e1e1
SHA256

3690bc42c1c05331b2ea1374f99230cfe82d71bb72098d679575df6cdf6ad308
SHA512

41dfd120ddc50b95daaea7b663b6dc088083916f158f438807681e991e170399da47591e43a4b5c5d76c5238a605ac3244e36a0d064582fc0b8eca8a73638d55
SSDEEP

196608:FCXlY8XMCHGLLc54i1wN+lPIcu9KYK39sI3PPJNMRRccx:kXdXMCHWUjqcuI3/PJNe

Score

8^/10

microsoft discovery persistence phishing privilege_escalation upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 2 IoCs

pid	Process
4112	Virus.exe
4112	Virus.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	chrome.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4820-0-0x00007FF7BAFA0000-0x00007FF7BB000000-memory.dmp	upx
behavioral1/memory/4112-28-0x00007FF7BAFA0000-0x00007FF7BB000000-memory.dmp	upx
behavioral1/memory/4820-30-0x00007FF7BAFA0000-0x00007FF7BB000000-memory.dmp	upx

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "183"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a00000040010000904f1e8459ff164d8947e81bbffab36d02000000c0000000904f1e8459ff164d8947e81bbffab36d0b0000005000000030f125b7ef471a10a5f102608c9eebac0c00000050000000537def0c64fad111a2030000f81fedee0800000080000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\FFlags = "18874449"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e007180000000000000000000006abe817b2bce7646a29eeb907a5126c50000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{708860E0-F641-4611-8895-7D867DD3675B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39080000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Mode = "4"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\shell\open\command	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win64	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByKey:PID = "0"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\Application	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeHTML\DefaultIcon	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\FFlags = "18874433"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\LogicalViewMode = "1"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4252	explorer.exe
4896	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2488	setup.exe
2488	setup.exe
2488	setup.exe
2488	setup.exe
4708	msedge.exe
4708	msedge.exe
1608	msedge.exe
1608	msedge.exe
3912	msedge.exe
3912	msedge.exe
1796	msedge.exe
1796	msedge.exe
2412	identity_helper.exe
2412	identity_helper.exe
988	msedge.exe
988	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5928	msedge.exe
5928	msedge.exe
5476	msedge.exe
5476	msedge.exe
4976	msedge.exe
4976	msedge.exe
3440	msedge.exe
3440	msedge.exe
1040	msedge.exe
1040	msedge.exe
1200	identity_helper.exe
1200	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4252	explorer.exe
5812	xwizard.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3440	chrome.exe
Token: SeCreatePagefilePrivilege	3440	chrome.exe
Token: SeBackupPrivilege	2488	setup.exe
Token: SeRestorePrivilege	2488	setup.exe
Token: 33	2564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2564	AUDIODG.EXE
Token: SeManageVolumePrivilege	2552	svchost.exe
Token: SeShutdownPrivilege	5356	LogonUI.exe
Token: SeCreatePagefilePrivilege	5356	LogonUI.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4252	explorer.exe
3440	chrome.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	setup.exe
1828	setup.exe
4896	POWERPNT.EXE
4896	POWERPNT.EXE
5724	MiniSearchHost.exe
5356	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4112	4820	Virus.exe	78
PID 4820 wrote to memory of 4112	4820	Virus.exe	78
PID 3372 wrote to memory of 2488	3372	DllHost.exe	85
PID 3372 wrote to memory of 2488	3372	DllHost.exe	85
PID 2488 wrote to memory of 1828	2488	setup.exe	88
PID 2488 wrote to memory of 1828	2488	setup.exe	88
PID 2488 wrote to memory of 3440	2488	setup.exe	89
PID 2488 wrote to memory of 3440	2488	setup.exe	89
PID 3440 wrote to memory of 2052	3440	chrome.exe	90
PID 3440 wrote to memory of 2052	3440	chrome.exe	90
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 3652	3440	chrome.exe	91
PID 3440 wrote to memory of 4712	3440	chrome.exe	92
PID 3440 wrote to memory of 4712	3440	chrome.exe	92
PID 2488 wrote to memory of 1608	2488	setup.exe	93
PID 2488 wrote to memory of 1608	2488	setup.exe	93
PID 1608 wrote to memory of 4112	1608	msedge.exe	94
PID 1608 wrote to memory of 4112	1608	msedge.exe	94
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96
PID 1608 wrote to memory of 4984	1608	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\Virus.exe
"C:\Users\Admin\AppData\Local\Temp\Virus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\Virus.exe
  "C:\Users\Admin\AppData\Local\Temp\Virus.exe"
  2⤵
  - Loads dropped DLL
  PID:4112

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4252

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3460

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --uninstall --system-level
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff7b4a44698,0x7ff7b4a446a4,0x7ff7b4a446b0
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --uninstall
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbc5a7cc40,0x7ffbc5a7cc4c,0x7ffbc5a7cc58
      4⤵
      PID:2052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,4345548720223304371,15178409097950391292,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1796 /prefetch:2
      4⤵
      PID:3652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2004,i,4345548720223304371,15178409097950391292,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:3
      4⤵
      PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.google.com/chrome?p=chrome_uninstall_survey&crversion=123.0.6312.123&os=10.0.22000
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbc5a83cb8,0x7ffbc5a83cc8,0x7ffbc5a83cd8
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,10962564404250542996,3937690201916776514,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,10962564404250542996,3937690201916776514,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,10962564404250542996,3937690201916776514,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10962564404250542996,3937690201916776514,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10962564404250542996,3937690201916776514,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffbc5a83cb8,0x7ffbc5a83cc8,0x7ffbc5a83cd8
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,8909779771991402635,9042832353079235569,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc5a83cb8,0x7ffbc5a83cc8,0x7ffbc5a83cd8
  2⤵
  PID:3096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004B8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5776

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5836

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2157238
1⤵
PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffbc5a83cb8,0x7ffbc5a83cc8,0x7ffbc5a83cd8
  2⤵
  PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=335789
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffbc5a83cb8,0x7ffbc5a83cc8,0x7ffbc5a83cd8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,11753635625124697675,14295509090747314831,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,11753635625124697675,14295509090747314831,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,11753635625124697675,14295509090747314831,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11753635625124697675,14295509090747314831,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11753635625124697675,14295509090747314831,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11753635625124697675,14295509090747314831,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\system32\xwizard.exe
"C:\Windows\system32\xwizard.exe" RunWizard {7071ECE0-663B-4bc1-A1FA-B97F3B917C55}
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5812

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc5a83cb8,0x7ffbc5a83cc8,0x7ffbc5a83cd8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,15175693185439010497,8727819612067709377,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5724

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa394d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-3587106988-279496464-3440778474-1000\ReadOnly\LockScreen_Z\LockScreen___1280_0720_notdimmed.jpg

Filesize
62KB

MD5
6cb7e9f13c79d1dd975a8aa005ab0256

SHA1
eac7fc28cc13ac1e9c85f828215cd61f0c698ae3

SHA256
af2537d470fddbeda270c965b8dbdf7e9ccf480ed2f525012e2f1035112a6d67

SHA512
3a40359d8e4cc8792be78a022dc04daed5c1cc55d78fe9cf3e061ea5587baa15023ce2152238f5be5cc5124cd468f220cf9dab54344d93edd3dfcd400b24469d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
11d253b3a6f1f94b363fcb04e607acd2

SHA1
9917081d96e0d89a6c6997cc2d4aad6366ecfcbc

SHA256
20152f2fc1ca7717b9b858435b3658ce0879f28944bf822210e5ac5e148cc7ff

SHA512
101086c8c2805dcb8bb4e2a3c979574fea1cf0268859804c350f05a85945216de51bce90981a11d08c9a7043efee5130ede5c5a376cd86707dcc90c0e4f45334

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
b71c0d9b853f2beb13f55f212766bf1d

SHA1
4dc5cede2b4b8bb9d76d112a34779acb3d9e15fe

SHA256
767b606e6b5a87f832e8e7ed309aefb37bd302153ebc2ae6a9864ffef7d850e1

SHA512
56b866872b2e4e65149727495009d047c2b1bef623548e0783cfe3b04e6da2bbac6a956c273344c32cc45742c5c114eeec933a622b06da58235785fa28b09bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab88f3e6cee8593b15f4b19429473290

SHA1
fd6ff2a4fcbf05b6c40fb3f11210c7a635748050

SHA256
4cc880fbcfde015dda6f503ee3343fd71df571d7dac737dde6f9ab5f89b5aa59

SHA512
f81870cb7e7dca67f4408ddaa3c12a0e0354bedb23f88ed0da8df77097f36f253d3196bbef05c26992a38e3a10a34991f50c95ab6614392c8e9d5b48e021c169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e7913544a6285623aa0c84e32f52119

SHA1
024741d1f7b18a5887c0a1f8a84d8485305fe64b

SHA256
9daac6de4d6030708cc5a4f3af370a3745dead583e80b524ee45f3537db7560f

SHA512
a7768d408230ffb9450c2fe661000ad22513e5a28b4a3afb7a96a21dc6c3085018edbc8b2196ad6f26cbfa22d847f099531afaf5a7809763cccccd508569675a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24945104fc04a4953f05407e71df7533

SHA1
f20efff1d294ec306fa5b367ffc2b96c69c9fb1b

SHA256
13f3f502278dc178379e2720017ccd5d13d7fc11d253907795bcea7c30b160ac

SHA512
f24e37d054858b3a9a80f8981c6c841e0c3cbe7aef9eddfacc24c5ddf8d2d084bc1cb1c5dc99cbb79cdcad22dde4ecb4c602f0defa7202f732eb602886fe6b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4647844a-9bf1-484b-a7fd-c06ac5ea0174.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
234KB

MD5
ad1c700628954f1c1a69f9279e71c19c

SHA1
17719ba875d63b25a2723a9cae756d0cf58d2726

SHA256
3ef62ad0afedd2207724280a05a7dc31fde16bdc0d9f76d58719e2ebb5385aab

SHA512
e738ae2a17541f18a876cdbdd4dbd3fa1a3b29b1972496a9b6011c72116f60416428f6a5876b9e78e8e3070c3eeb8a2a68697aca803cca643f72fd1fcb182bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
49KB

MD5
de5328d357dc9f98dbc6dc40df72f972

SHA1
df45ee27cafdcaee71dcfa1349ae81000fbab986

SHA256
852c945dbb044c95ba57800046e7027dde7aae81837802ca542541e8a3209541

SHA512
0a0dd78ec5c8c7c0e690f435e2e067252ff947effb403682ca6411f150e0159beae6c02e81652c25c16eb97e33b32ff0ab885d98279ec6148b26951f32c6ed1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
618KB

MD5
5ecfc250674085f190eb19a9e3f752ea

SHA1
7136bb5a91d1ae506f8ea31fac9d5bea75c13934

SHA256
115f5987458911aee7a96b6c45b170c97254f8ff4fef2c097fa72bcd6b1588b3

SHA512
a0240c0e0efce6d23dd2038a3cfab2d263e0e458e8d4187ad4e80533fc617776d50ace893fc7175f7b54101eb4c9ea789a0895c7e8dd7ecb86b8083e6963ecaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
33KB

MD5
0baeb062d91df0f2b09be26eebe1f153

SHA1
b6ce75f73384992516b0481f3d672155ad0b6ecb

SHA256
6a2543bd2f9f7ab21619318e974d590f0aa72b2ba53a32307b93e0b5ad3bd614

SHA512
11060d69eaab60cc2c9badd7d4a020574b6989c5d5b2e4afc866785a6c3e33f13f9a7f853115c90e25235c14ced0846e95d882a59274d089d257b43b623823b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
33KB

MD5
19d255e17e57577477973a03d5d10921

SHA1
376e60d2a78117c1e2390a8af90699f628257053

SHA256
eb44224e7d59506c97b8a301cccc253a50c66733cc6fc1034aa1d341ba1d1204

SHA512
001ddd4c127684b362bc357e8665102966e8935bbe1d36debb65e03b4e0a14530ec031555341493e41f53cdfb042f58f3eb61dd7d48f5dc9e100f83002c26143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d326dff1803832dde506702824695f95

SHA1
085dc0c337a1b096bd08670b79fbb93545ad5eda

SHA256
4283541cc29c3abfb798be1317fe96da41250620a3accbc1ec4462f2f621d746

SHA512
82102878682381a377c57201be89a8fdcaf0d4eb71542eb3364561c70e5ef2c906bc52178218ee4465e8d63e586755ca73f90d1db8ca19c7840aa084214fac0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3c013e6ece13c7f0c58e73d3eec257c9

SHA1
c709865428c077f1ff4831430c64240d2c07f899

SHA256
177af829a10a5c4100c5969c6fe0eb2f4d6ef83d4e74a9df3adef02ed31fa672

SHA512
a73360f2c255f67f530f39bd582727e1ff611cd345972ea1fff79910eff29fa091c268f203ee73a8ed9259cb817fa3206e589bb3fd155e5ff558301d227b2fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
53ccc0eea3f1d0882a02c9fa41a44420

SHA1
5a5dcc64241c76a69112d7b0374b4974a67dec3a

SHA256
b42a3070b07f4f0306e7aa1c5c2c408450907ff05c915b7e8c12c2cef22b2306

SHA512
460cf497604b6101989756b7d0a1bf52e04f10c43b58c13143f6997da780fb2dfccefc2e770665be8e1b6a71e5fbf96974c1a46286503d3fb2c9bdfdf9441f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b00f89b4026e7aa932ab4188f73bf376

SHA1
71bc1c7687d84dd66fe1ceeb409cb1bbb9b7ded2

SHA256
f99bcf80dbe8839d931f164c82e6f445050a1f239f3cc7df126189a7e1a0b28a

SHA512
2eb54bf276eee359ace16559df2993f89aba11c8911291d6e68521ad218bcce424df476228f7c1ac53ce29ff8072826e3e5fecafbe015c6cce3ab9cb90e4a021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
974251716e75c55c1889efd741b77062

SHA1
83501f5962d6c72574640d01727dc3cae30bcb21

SHA256
462b59551ab252e5f138e0a406d4eefa9b096a76a7151067c0b4de6fb9c9fc2b

SHA512
b6034d61f1323c33396cc19d7eeaafaef1b62e202db74242dd37bc2d1c8c9a2420ace6b58561fff5e392e1152648aae9a41f35701b00c10aa5ebd3fecf1e8ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c531a306804f180ef920f57bcc990653

SHA1
c76798c490e6c9bb159a32698909bcf47aacbf7d

SHA256
ee8dbcac7d13a72dac5d6b3c0e435d2b8630a78815e83eaee4576249a7740711

SHA512
7f3e9f1e809adc93feba3a7944028fa0df3001ad377bfc8e68a33f0e6683b38f2b0fa401bbbb835cb9745f5d1209aa658ba9b8c6273969c8e0088acea7ac95e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
45a4e7aab9f35e3e7a8fb4f0740a2e5c

SHA1
eb86f279aa2bbbec9b9c548d85646c38fa1489c6

SHA256
8a2e5ac3519047db71eea499cb37bf5e08b92705417d16ea99dbe3295e32b7d7

SHA512
800279bb690848740a9aa6fc5f5ef3c19a34a91ecc2c189a316e78e9c81079cb94cc534c710cd4d81ca8dfd881c7fe681fd008362b36bc434ad9530efa0d2ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3458e5b279a138ed8a9810b6ce108147

SHA1
8ad62e88801d74ef9bf2f88e612e8d28ee4a0efc

SHA256
e280961404a7ccce010d0c535ab353b42c0ca0b47399fb765668dc594a448063

SHA512
8e4ab7b7680b403b2d21c24fd307fd2e44a4ee16be050d1a733c21ecba5d71616c3154e1601881c3de1e5e6b33a1f240fefd01becfdcd7d7512b93e2cef9a81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
55e362ab984287d45f89766db72df1be

SHA1
2f772723b80bda42437bb844d089a8c8a28ffa83

SHA256
6c7fa35d650dd78bfe40161696752b675b2b002841d0c2c391eee27e58ecd7cc

SHA512
d9ab82e22bca9b5befb8486a4c025603e63889da654dff0b6348e491689a65cf19ff5a02f3e15beea43372419378fd1d35d84047fbf08547e3845c217a00aa27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf85f6923db8f6dd5ecdfad5900bab21

SHA1
168a216b409e9c5a3d60a06e7931d669e6cd7dc2

SHA256
e9375502a6d945ed0c51e12a723e0af64f64c61858fc2f0cf183cb076770eaed

SHA512
01fbab762a678ec53a305c887397c08953e4f95bd23bd727a63abf24f1e9d0dc029b67b5fb513e313d8fbf773666a0f9cd855ca848b47257d35f22150ef638f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e52437243b4c67fcac9875a0b1abd471

SHA1
dedad906c4cea99c2f6da5cba8c874c2e8f5f6d4

SHA256
d7a176bc4641c11360f9578143371537ecd3fbf3deb91cf749a445d85afe0521

SHA512
031b5c6153a7c2322add9ad86dd939b58cc4628e33d75f0008641474dfe2ac5435b698b746d009af2555d6dd6b051140f2439942b63ccb97ded466591512a2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
595eba8aa1d48635cd0127bddc5a4a07

SHA1
86336797fe8920febac7e64c49a34b20c7b584e5

SHA256
22c68ceae967d552d8521fa6ac6f256994e5090fbcda05f6f3092fbeeb6013aa

SHA512
aea2301eba6354eaf67b2c49939c76c5f597175ead2f07b62c5e0e82c315e9da02f8b46168096999c55b1e1c27cc14fc6ac919b5268b6adb5267a76eb1a50c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bf4fbd92842e09f456a9da48c5ea14cf

SHA1
a53d3a0dc571f5cf46bdc1c886da9d4e4bf6948f

SHA256
d99a8752b863d184b934b8b324aeeb5f17b434b5211da8fde14a5f48ab5b3504

SHA512
333f310d93b7fe1b48a53080f69ae05692921ba6c7c7870c2049d96ea20707000ea2beefb4816491e574d3cad894e8b50a4e9f72f158044b863373cfeac65a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77c88c0cf5ca9a05341aca9783e05330

SHA1
5baf9e6d6533e1b29dcad2d9387486dcd3eced5e

SHA256
c19d4bc499578f9b6dd23adb95cc134ca4d9c92613f25b70b19279c7abb55744

SHA512
f04ab281ec4d3fdf2ba81b7d71a378cd67ca2458259f0a1488b458b4b895188ce84da039b46afc54b7bb2769c43d8c1304ae16c3bac528cf814c6f6466d23ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
92230681918b118fae55b9094f5f6ed0

SHA1
dfc99ba01e394a8409c184977e142d38f8b4791a

SHA256
7def8c10a9a57cd3338cba8678b37bb182f3480316d8bc1b6f8ccbea119ac595

SHA512
501e120f5c4bc764308bdfecfef918eef6e6321456bab37b43ddd6f26b0a284295118bc5e837e0aa3482bbcd92c94a590c078d4be73bf39493923368b188687b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
015a612eb2eaf82903fbdc26e927bbf4

SHA1
98a6b33ab5789b8f73b2494dcfb666de083ff33d

SHA256
9ea78c01cb4912e2d9a22303537cd75958deee010ccb2f516b65db0e5ba35eea

SHA512
54d5de8d21dc212eebe14c615efaec0a9849214ad80df1b7f735e22631137710ff318675ee6110495b1ca22b575de42e9c4f0e662c9165d0e8639e48454f8a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9d3e1d6ffd770740f66dd164dc15e724

SHA1
9e77116a5806e9c80e33b9ff841a3cbe1d31801a

SHA256
9f59fb4792ec554a6e8f60972cadfe1767242ee472413198af699e8a333093ec

SHA512
0a70dc04df6001375982da41c22c06e1c6b7de00f615c9da714da60b3912c55e28ec31154ef29d430c29280b98b0449c4fbd51a4dc01201c3bb092fa20f4df98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
348a2d03bdce92707f6f7988e359b955

SHA1
6a3187fddff9f739a4dff095bdb6c017fd5e3e5f

SHA256
4d54462dfe0e57cbdce0c19bff19d7e508f4c3d075ab8c436ff3247be6184fba

SHA512
5ee20117eab5e46872b17bffbba65d905f2c99eb0e82f9c46c37afb865524657d98b51089646f0d1dd32015a7946965d8fd7980166636c14e28297f3a86e2727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
dfd9fa43b1897e7da53b91bc3e2c547d

SHA1
46ce4d4a37458886d1ae56e37f7da05693e8d905

SHA256
4af5a4021d0e89bd95f27362ab0b537c05c7e0f5d924f72f2667c7460b9a73ea

SHA512
7e5b9f8d0214a1c77b0525353a7a0f7e709b40f39cc88499a9c967ad4e1d8676c6162b46d3c6a2d7a40bc8c8754a2061fce8022c0b7a1054b58643cdd74d1704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c4389ac0126dd90f8547609e090755b1

SHA1
24143cc47d7383e8362ad9ccac7e2c1222ccb11f

SHA256
7703490f2fa58e0c20a20e76348da97c3a4f70215df6a9acc2157578e5665a49

SHA512
091566266ce4324b9eb856d99b9ac9c030605d2532921cfca9401748aeaad95262e544e4cba27a81039a45777a90d8f8ed7684022e055ac8d432e29ca85f3622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8a1234a3df180d38033b5e7247eaf195

SHA1
5ba07cb4b64c12fe13952cbb360bc6ebcaad2d0f

SHA256
4a4e0f2e4d55c4ec5112cce10837f8852d281a121f2480c1386c5046ff752813

SHA512
ed5af23796a17075d04692a54e59754691163943b31e8157c23b718b889e69d6a2bd75f06de5bbbfa147d5f109544060082b30eb18eb5baccc89adca79cc7de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ef6d7855cb473dcce8da178019277c46

SHA1
dc0b87ac89f41b1de668241fcf59500f945d1f9e

SHA256
57f087551cbe600dc6134cd8df14420c935e0b4869775759f19b52248f77745c

SHA512
aa56eb8f7b987d748148012c1985bcf776c653a66ae4770b8086637d0867b8c138ec4927969bfed102d951fd3c973c61102f8a0743a3be50043256a1c4e32a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\25467c0e-5a94-485a-a5ff-6e04a3e2328b\index-dir\the-real-index

Filesize
3KB

MD5
4fc7bed72c321e34e92500486d85e998

SHA1
e747afb3aedabad19bbefcf3e414e028aba53b1f

SHA256
886b45643c24f16792628ccbb8ec963dc2665aeaba5d3619b6e481f0959e5f38

SHA512
21122fc9c40d51c43811b4cc1949646cabe352ccf8bb8c541a034986501013f18b8ecb57fc67271306fd393c63ec6cbb089679023b472483d41b83af939cc1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\25467c0e-5a94-485a-a5ff-6e04a3e2328b\index-dir\the-real-index

Filesize
2KB

MD5
d2b5e9738fda6dd6b0d5743d04dd386b

SHA1
50a21ec7148a8d9758cd02cb8ac60cac578e9b4b

SHA256
730e3f2095750f7312f463e618bfa958f6ab9e53f9eacb5824df8d3ad722da49

SHA512
8e3cc7ebbb981fe1aa42ee202da407ba4e9a710e917ae3c5659b7f0bc2cfcd0f97719105c3b87c3b0f6e425212419fa124c4d525e2e6f6fbd57b7677e65230cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\25467c0e-5a94-485a-a5ff-6e04a3e2328b\index-dir\the-real-index~RFe5b78f5.TMP

Filesize
48B

MD5
989305aab416bc1b6ec28f3e520de31a

SHA1
6fd429864d6c37a6b84181a63731615a1102a76b

SHA256
c78c6b055da7ff6c0eed3b5fbea04277aa4e769f2ef8dbfed88a388b8aab344d

SHA512
8c22998202436dcb7fee5adcbc305f987b453dc60f8d825428f58c7d4931910f9c851f002a26871fc196f9ee710d94d1214bbf263f3421912b79a90489eef46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9dd5be10-5ee1-43cf-806b-85ba2a8cfe31\c524bd5005bfb5f6_0

Filesize
2KB

MD5
33c25532d54a55052648912d1e5531b6

SHA1
9c4525cc7ce494000e5c97576e70c6bef5d3a664

SHA256
1db7204f4504d820d3cc0b7812d3c7e5acc3d95db9b6b5c64dacfdbe95003131

SHA512
6ead008e8f25c6478d244a888e046a3278d1f758ff874db149059088167f6e01788fafcfa657022d2f7fdb20551d751efdecca02af33b76cd702baafbbbf7eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9dd5be10-5ee1-43cf-806b-85ba2a8cfe31\index-dir\the-real-index

Filesize
624B

MD5
6f088ed97ce0cd9c915d5591fe8aec89

SHA1
3767661f69ec9b426d9cc12be92032c24d57af44

SHA256
e6afd50fa4f57e597ff72461bb1fef481aff3a26c074fd9fc41ce161f81f9220

SHA512
749f44db1701f2cf432785fdb0059868b7ba35ee10251b517b623b38e62b11ce8ce8b288078f0d734efc5dcd357219d261ccf2f7ff489c27e4c19670bb9c8eff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9dd5be10-5ee1-43cf-806b-85ba2a8cfe31\index-dir\the-real-index~RFe5bd185.TMP

Filesize
48B

MD5
ec34f23474eadb3408751ff3217160fc

SHA1
8940c423c5eca3e1f1d4f4611a8f9697afd0d424

SHA256
8abcd69fa6728ef667588d64e5acc0ddf6e3df53ffe774b68ed5d4d0b2c4caa4

SHA512
be3192ee1f17dfa9b9928a53185ded2d04582132f12af5078b05e4c2f79d7244e68d8da4b2aecf4d1dd8425aa14546594c02724fdb50af4e47944d3735d93052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bb2bedad-85d4-4aa5-a8a6-806587e70237\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
5e48683fb8e59a117b028be3728208d7

SHA1
3be18c629f73bdf9d6f8bde13d5d52ac0d35f700

SHA256
06cc68804498d69e3acdb473fc855fabff9b41678c1cb0e758c7406b61897602

SHA512
6f8340019cefb0d9e23160a5d70c653d71d765129be66a5d5d419d82920354eefc8e51118f7e802b53ddd69e50404b8999641415f50348ea65f788d88f1a5881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
6af33e3082c9f22cd1581ada122d5660

SHA1
01daba416a185eb9bb0fe471ec57339a56dfd345

SHA256
f477dbd2174b7592dd6bb118639732b4362ec6cfce3085cda64b287bf32589e6

SHA512
4933286dd2219d67c84366a3e6bc43892629fbd2d22151bedeaccee27bf4c8c3cd5ffca26251df87be25d40906ed03562e5133f344a77557f86dc492c90e4798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
88494338418b167c611e08f74431a29e

SHA1
acaadda38732b3126f2146875bebca2ab06a7cc3

SHA256
6d5d0763ba7e3b6beb557ca68cfce8fe111e3fd8dde6a257c13238fd9a63290d

SHA512
f67688ac0678c2e4fe687641747ba9ab6cc6f0313ff8a3de3cc3b0b6b5e3c3f1480a461244e6f9c0bdf425b5043eb47def48a42e3b12e42f1d3469f34f26b950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
9fef286c125a29b7d7cd00f154a91e46

SHA1
f15748beecdcefa7a025074114ecd50608b64849

SHA256
852d9bfc3317eb6674bc0ac5379c26b3ec00640a3a09e48c662863516e9cfc93

SHA512
71355345fdd012dade1a3779406a8926a8af642649d18546c768ceae79bf13f665f8d643c3614b0758349a1d7e4e540f83554ead66cec36f26c11e12c9f6879b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
d34588f7203c6c25fd0f2ea6563bd5b3

SHA1
2011d74bff445dd38768279b65eed29082695c12

SHA256
deee732efc98c734a5dc0ff4ddf37f6c2319b16c8d4aad1d516dfc6d46a26bb0

SHA512
4188e10c7e887637bd375b2e772f7200888c4df55cd010f65c7ad157efd7acd0fa0d308c387de4abb3b6271547075b585590bca85afae44ba5adee23290b5cc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
2e5a6782002ada326549ecfc0720e532

SHA1
a36a27bd42690b69f564a5e24c48bb22c6f6f828

SHA256
cbec9bbe767f7644558802aafab38aef3a04471596ff6a547a0dd9190d6dba5b

SHA512
c7058e49ac994e4103f2cc2940d87c525230b5918e896c41828f37788ac8e8aad908cc749984d46d90b2283fa8264d57b0644c9057e8358482cf112e9805334e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
94901572e551b179eba9f47514a5a6b5

SHA1
fc56307fd35a7796ee3393d3172cd208eb96373f

SHA256
e7c33e2797bfad4cf09da2cf21dbb62975ef7d5f7401bc43c08dcc20353bea3b

SHA512
23a2707139d8d119a5cb1d89b1a23e885d205a9181cde41e5835309ed5bf01ecf7bf411c6a259f438ad2f025c3e38509737745f8a8f9b92c5b512caf6282b2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
8d3aff6e9d9ecd7a3d5b618bddff1a09

SHA1
366085e5fbb0c1ff30bc1871a97be380bd436be4

SHA256
78d5145feca40d5b61f01ba4f71b57dda9b0dc388cf81b716a5f61ad69ce52cb

SHA512
b313d5715b133ad83445bbb23f6b1a15bb4a32ba1338af87b72d88d20ac6338e83824f7fe1e71c43b7b0c968add92d5fd66c274e3cd5c7e9b81c2199e9543c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bcba9.TMP

Filesize
48B

MD5
ab86159a5c5f43a1ce09250dd688d915

SHA1
2eb321f8e65089e85f6e6e3a36fad79c46174424

SHA256
17b272a854c7fff4b6f3267e1c6da975e323c5d3d66705f0989bae7d1a1d42a6

SHA512
d5630c021bf1c558881cabff1522044951f99230e555a95ace8b34bae67773f818736a4c85a7a54036e7f400c37800f00810353ec89098286b03bb4980cadd19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
76b34faf85034445e50f1409fca3ecec

SHA1
5f8a959b872eb39001360c29051558698ad5a9c9

SHA256
0028fea935092385de45f396970a33953d37338b41d9c484f68f8bc2e06812aa

SHA512
3fe770ac983ce661cad3c0a0c1389cb910d8d934753907b8cd6a46e8b7455a978cb51a1d349b103de2321152af6821dc64e023f935b9eafd0203f9c26b97d54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
cbda13ac130660a592b33fa551d9b500

SHA1
eb170a2364f1ec96de98a43c04b1be92f23cb2de

SHA256
5413197baf9cb1ca8f0a38175dc02da0771c0123d8f0811e9bbfcc1ec468e877

SHA512
25b67d83095d4cd2c7562306545fec3c98a1fd518a2780dce0cebf63fa45c7e4837335e7efe303b5d010ebace5598254d78622a9ed1a0c743d8c08919137a1dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
66ee0c875175d0308c629eae7597cfc4

SHA1
bc67df8213109d6f1f0f45fd475a3177067b0fe3

SHA256
5420888eb04cf58cd5099fd5a8b60f11c8c51bac79330bf07b5b96dd6a5e2d03

SHA512
f2b67d93f977893d3a50818b85b98aaa089353d4363deb719aa9cf7b6d46625fccfb5d7d902b2dad8651ae3ca5afd869596b700e79cb531d60731c04d8deb2bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
acc3d94841b4fb9eea3a214c183a3ec0

SHA1
927b92fe045316afd6d823b53b42ec96b82f266c

SHA256
a222e9deddedd45c817ab28f37914a658503b6bf2689fb6ff580f51a6d731828

SHA512
7026ccc9c63dcfdb0a4e6a4c13accb7ccdd28b51900ccfea99f1ff86c27c2291d624156597aa32e4f22ce4698e1c7acc44d039810d50743b42307ece951fdca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7bc5055636cf1ed1dcb39e590925e675

SHA1
ce87dbba84ae894016f3cd7504d8fabbcba0fea2

SHA256
dcf166d8ff2cbcc3c09634c1df6a7e75e20ad0d023ace66ce9429081d951f9e6

SHA512
f20d132028f98dd4db673b3a33c7d37e57a83a9dba9457f23fa5f11725f2aad6777dc732ac99f3bfb40033c8fe76e924044a176b76a3827d568c634d3f898d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c9968cdbe31a4a6e2f2816faf0208b38

SHA1
73c8ad6d4b370fb83e52973a50b19e6c3435451d

SHA256
fa5b8af4b24666d780e02217073678f058878aae00132ce07af107f8f096031b

SHA512
111715220ec5b82d83c71b00c1b029884fcf1e471305a9671afd63a6d595f37e80d4a1050fe480ffe379ad317380bcf7add222b319ae5c87d8bdd79ea5558389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
252d200f2138b292f0b72e16780cef26

SHA1
3232a6e80833626c84504239183a586cb108e7e4

SHA256
563daaee6e97cc43e0c0cf8c2590b5efb592071c80a3a2b993db13dc4b7439a7

SHA512
c2a85650a4a1b6ab6640ce02b23c351dc9a8bbaa3618eebe9b102c8ad78c5dadd9c03e6f2cde6bf3ad0d8913b9fadda1bdf95a60743177b1c556e9c9fe4d7e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27212167c69a5443d176b0b5f9dcbd7b

SHA1
5e58b2e7aa567fe33245e0216eab29e7b836a813

SHA256
5a41a5c9a6aed1d6a158d51aaa110824690a825ac280ebfdde52d428cd78ca32

SHA512
28fa508b87d25883c92568cd2586f383cb7912ffa83575fd70683c5b44ccbd764f431ef2d337ee69864f096ff1bca115ccd7305e53f036e7e82475943b433c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
80b81ec78f73b03c4e04475425fdc605

SHA1
b7e2de3c0fa155981279eeb6ce12a5cc85cb8078

SHA256
92b0e1fd8229b71b90c312ce06abfe0791591bde45fbfc0c9cdb9519dc4f3f55

SHA512
3bcccae5c2e837507b227bc44451d9ebe0ecf92cf4b05aff2bff26463b110513d46dbe7e98741f117616c0591dbbbcde0f808e73eabfd14a426c745884dd26a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5df7740aed0d45f5cb3a3f6a3cf486eb

SHA1
286e13590e08cd9b7fb7e47d37fe6809d7ecfaa9

SHA256
a400e91fc7a906fd4d9a6f74b7d4ee69a8498835fcee2254ecccbafc9c830d98

SHA512
4d4ff718a39f90178afe3206ba305ee9614327516c7fa10ee2a6ec8d3aff8a294bcb8c0fd19be5268f9f042f94b992afff71e0dba01fa14bfc66c8c948f210e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b67d6355ca50de2fbc918beeab1e80c2

SHA1
207a7edeb533d1fc63ca9692cf7c03f1fd4faf4f

SHA256
ba69bc235a6235b98741c6c8860f3bf234f37e18e572a643217577c748bfc90f

SHA512
c7047b323c387c357ae18997b42dc037204ab2db8bf6ca57ae359d81400f072906b4121f697c8b77c8f6be607963a411e231af6f8c885d307b2541b5c9ea5803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2790e86bde012c9f379f9c9c3575362f

SHA1
26f6a493a3c4a68cb7989090b38ae295a1bb508c

SHA256
87ac66a1ec6a6ed871f1010e901741ead9175b66bceed00a6275d9df9a9e92bc

SHA512
ff13131ee6dbe8d55077f64773b68d0cd311f3d8a8578b8e45c0b9bae62163f18cb79b46bdac0974945aab7d3581bea222aed8851a31b9a88ff92871c8815b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b22ba68e5ea3cf3b0dd02013cd611a1

SHA1
582b2f8ded7d3b7f0e9210880f3abed69f5d6550

SHA256
28f76277a69ce17cca83a96632cdd8f2745423012fc934ca8d0e804bb99bd3c9

SHA512
9f43852871925794ceb42340f593e79f3d563612b9af9f866ab5198eb7dc4105ed9f182039332b46da778881e301a8fb36462f75fac090a5a72bfc2d12422143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f1f3ba520a45fbbc71a125f3837bee3

SHA1
4a8837b9f32c09887ff7a8f4c25389db2195a3f4

SHA256
778f5e2dcd790e878d42100616e9a40440948fcf8da2892275df94651b53f8db

SHA512
9523fcc82216f9c890a3bcceaa6e41b5097817f7f0345bb02a0a7303c84e9c5c98510a97eb59b02cbbc525afa8ade34e25b40ca80c20b4f31fd2991fb60580b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a44852b7dda7e7b62afa8d5c9f1f9a06

SHA1
bf1d3f18e592309bf55a8b7ac3c1e7d7637e4d23

SHA256
59d0358a57c40d8a7e37f7d6993eab7e60014800ea6330613e9c8ed275168e00

SHA512
3198a96da83cdc9fd8d49694984f9a3c6ebed6690a1aaf4c273680e7c1a2819c111e18167758ec935bcd9bfa8262fd6cac84885d3e0a8e97240b08ca915383e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\Virus Informatico.ico

Filesize
33KB

MD5
6e431eb17d14e55803405d13302822a2

SHA1
daec8f52874aef463f9f9244ae78bb51bf455f21

SHA256
e8f553869277e8443bd2aa8e637cf48715f2a0e5a70ad96052f24a72ba4d599a

SHA512
f555b980bdc8c49d35c862212470c221f667dc73ea2e0b11d7ac492f7351320422fbfa114c54e7b013dc931dff5875f5f55452579761690b25e4fc77a60c3b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_bz2.pyd

Filesize
82KB

MD5
cb8c06c8fa9e61e4ac5f22eebf7f1d00

SHA1
d8e0dfc8127749947b09f17c8848166bac659f0d

SHA256
fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640

SHA512
e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_decimal.pyd

Filesize
271KB

MD5
f3377f3de29579140e2bbaeefd334d4f

SHA1
b3076c564dbdfd4ca1b7cc76f36448b0088e2341

SHA256
b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91

SHA512
34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_hashlib.pyd

Filesize
62KB

MD5
32d76c9abd65a5d2671aeede189bc290

SHA1
0d4440c9652b92b40bb92c20f3474f14e34f8d62

SHA256
838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c

SHA512
49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_lzma.pyd

Filesize
154KB

MD5
1ba022d42024a655cf289544ae461fb8

SHA1
9772a31083223ecf66751ff3851d2e3303a0764c

SHA256
d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06

SHA512
2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_socket.pyd

Filesize
81KB

MD5
fe896371430bd9551717ef12a3e7e818

SHA1
e2a7716e9ce840e53e8fc79d50a77f40b353c954

SHA256
35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b

SHA512
67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\base_library.zip

Filesize
1.3MB

MD5
a9cbd0455b46c7d14194d1f18ca8719e

SHA1
e1b0c30bccd9583949c247854f617ac8a14cbac7

SHA256
df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

SHA512
b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\libcrypto-3.dll

Filesize
5.0MB

MD5
123ad0908c76ccba4789c084f7a6b8d0

SHA1
86de58289c8200ed8c1fc51d5f00e38e32c1aad5

SHA256
4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43

SHA512
80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\python313.dll

Filesize
5.8MB

MD5
b9de917b925dd246b709bb4233777efd

SHA1
775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2

SHA256
0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99

SHA512
f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\select.pyd

Filesize
30KB

MD5
20831703486869b470006941b4d996f2

SHA1
28851dfd43706542cd3ef1b88b5e2749562dfee0

SHA256
78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb

SHA512
4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\unicodedata.pyd

Filesize
693KB

MD5
0902d299a2a487a7b0c2d75862b13640

SHA1
04bcbd5a11861a03a0d323a8050a677c3a88be13

SHA256
2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20

SHA512
8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3

Download Submit
C:\Users\Admin\Desktop\ApproveSubmit.jtx

Filesize
261KB

MD5
90e76156fc7056cf5c0609611ff928d3

SHA1
6b21d7ae7b97aa329c7c6a708e8edb2e9aba7a99

SHA256
3e4a5981c4c8a1af8ab65ea821c39ddecc0ef134464cffdc671a7f9c92f2a488

SHA512
988912cbd7a4b485b9b0bc68503431692036b43d50337a08ac58334f0b3ba56e6e034e2349c08abbd38171334a02ac0bf1991492e8cf0d932c24fc2cc4f6925f

Download Submit
C:\Users\Admin\Desktop\AssertRestart.dotm

Filesize
337KB

MD5
56d0705837d98f109034f3c3e0c1c740

SHA1
89af0d57dfdfdf29707b1a7ec0380eb3a94c7e53

SHA256
6130866a132338b029792baf7fa7d0cdfacb80b4057c2f9132b0b4c615a31e27

SHA512
c4d0b6a2af19816e981bb19f30de523c2674b1daa388977d5c206334a7759bc17e993a42ad55def546448626007d4945dd95396e195a9f58c563afd3f025b313

Download Submit
C:\Users\Admin\Desktop\CompressUnlock.aifc

Filesize
215KB

MD5
18ea2f6a1a743b8e5548d80ccd8b85a4

SHA1
c67a74a3c6b3c326e8b1046bc1fa3fc98607fa8d

SHA256
65e7cb08172c478a47df92f2cd4933f8be8f252efa7f1f4729dd72cbcf0d70c7

SHA512
1549b706939f4a18197dace60c37e617df417296e809d615e3527d83982e7c97b6a4e5c5f396aa0dc185d99a415e915e837d658182a2ed194f5393fb72befec2

Download Submit
C:\Users\Admin\Desktop\ConvertInstall.docx

Filesize
20KB

MD5
573f65a565758df1a97281966208ba66

SHA1
35f7b68c9bbb00f5b1bf44cd645b0232fa956b44

SHA256
65f71c5e84efe15f1c062c10c09235e984c869db205177488ffcb5014c4fa880

SHA512
90c3eb7ec468239ed2cb93ba9beaaf13b11d1a33c47abeee6abffd141b16bd80054fa0a9ba0ce397084416ae9b286c00468089477a4d58ade25e2809869ece4c

Download Submit
C:\Users\Admin\Desktop\ConvertRedo.jpg

Filesize
245KB

MD5
ae40a7b79b9c4df33b3fe43b4f2bdb08

SHA1
80d907a6fea487bab777a223f055bf3055383281

SHA256
8e37bb60ae6068fd85c0d8ad1c32f91d81c82657d23f76fe4536a6d8669a2d31

SHA512
5142e19ef947741f81213b85439d4d663dd4061f40ab2b1fc170530a64b8562bada3cea18b91d03eb37e9d00f497481418d0b49b0a5ab5862ec7a08a272709ba

Download Submit
C:\Users\Admin\Desktop\DenyReceive.rm

Filesize
199KB

MD5
29bb387d6426483e19b32073c352d288

SHA1
f471f313ea20e717109efb098bc37547161c3526

SHA256
44f6814b25310295e7aa1e3c69464d826e4b7184baae60a69648548e48e59f96

SHA512
9bfc6c4a1111f8477afe0b4b27837614c58d66b2d4d3e9cd3017edae2e55776a49eb545ada7dd911ee307063ffa3b026865fcf503f832100a0f8ff0c4335b305

Download Submit
C:\Users\Admin\Desktop\EnableRequest.css

Filesize
399KB

MD5
a9ea79abc79049dc680f95ff8200d388

SHA1
b0fd21487b4e29ca20265f14cedcbe8bc57b970b

SHA256
64c25bb6f16d424ad1a69f9aaee75da0be0a376a0ca65f2cb4d7399d950fd7cc

SHA512
ad5b947b782d6531b21da3481f4818c27a8f8772bd3c174ad80bf3f26123c8e701a5ba24fa9e6c849a1d0e7cb899c9e6ca8791bc523b75e7cdc7db4d987a89f6

Download Submit
C:\Users\Admin\Desktop\ExitRepair.m1v

Filesize
168KB

MD5
a52b0065c38da9fb3a10d40ab9082aad

SHA1
d0482c04329cf72de0bda21641ba6c1a1f3e4dde

SHA256
c6470f4cae2e072a54b352ff8e09f85c6a1a52f051713c7f97471ce4bc1caef7

SHA512
e98e6bb9d6182b01dd377d57a2a3d437d68816d056e671c25df3023a285d6a1a2110503c7504d1036240061ca183f2d80758431358140153501eec5cc5d1c84a

Download Submit
C:\Users\Admin\Desktop\ExitSet.pptx

Filesize
384KB

MD5
ce3b485fefa114039870f3f27825dfe8

SHA1
31a604029d1e871d5aae21c0765b784c9812a74b

SHA256
13f4ef084c6a3ad940961c69dadbd2b396ce2e8e05dead891afad3823c1a457c

SHA512
fee68ec1173b0d14d8a202105951fabc321888644ae3a1281aa0bbc335fde9f6fb89a819906370d6de25b5b9efbdf8887ba19805e987e18d98d41892f8ebc158

Download Submit
C:\Users\Admin\Desktop\FindClose.ps1

Filesize
322KB

MD5
0896f5e48db39ce717c0a1f211d22bb3

SHA1
7102746f7dcd4b0d6e8af47dba345ec2cdd3c3e9

SHA256
95746ab2a75a872dd91b8f9f01ce956d3a0fe3e33c2312b7b37c6ced6bcb476b

SHA512
264b0679e7a31abe38200d66f3a679a73870a09fe6626869f7bba9d64e99fc0744c4a3f845ed02cd7d99252db67f634f706da2d426e4dcaad78f2ac21fa2af1c

Download Submit
C:\Users\Admin\Desktop\GetFormat.jtx

Filesize
291KB

MD5
a412b3989b5a16743144cd13f725295b

SHA1
64eb163a59397e69da4ace82988529ec58ee5851

SHA256
1e0d8cbd461747be8f33e20ecdac94db9c44eb6cb7ac2d371897310a58899e9e

SHA512
9ab1b614f483443c68ecb777675b267b78be43eda0dfbe5335be0e59a8bd188ea183903dc9bc751f835e7a4542cc9024087e7dcebe75d2fc2dedc98bee7524e5

Download Submit
C:\Users\Admin\Desktop\GroupNew.docx

Filesize
13KB

MD5
0162886d6d4e6cd284a27ecd2ef778cf

SHA1
119ecc1348225ec420e3384674870c0d082d9c41

SHA256
066ffb2b3dfbd23120ba3ec89c934daf78e2be3c08d851310fc74b31899d12d4

SHA512
7e248e27f4d5fc50eff39a49ff8680fc961e4250fc468869959fd357dcada945c87fbdfbd4112020d862f39336c68c5206edc9ea658b87022b22ec8a98385ab1

Download Submit
C:\Users\Admin\Desktop\InvokeStep.docx

Filesize
19KB

MD5
28725c6694bd8c40e98e485e5c4ae1d6

SHA1
828595c4d71ebc3290e4c3385aefe61112299114

SHA256
ded975e251576abca5130bcea9992da340fba289b7433058a8a8844866ef0ae3

SHA512
f0c4214729379f4dfc09caf7b0f54159210bc88501b59064ebe5ab2b964fb35991220e18f1226d26f49925b4ea2cc609eaea700e36d44dd50d653ba7fc90a2b8

Download Submit
C:\Users\Admin\Desktop\LockWait.pdf

Filesize
184KB

MD5
695901af1f9b4a012e3ccec084de1144

SHA1
342723d3aec73bf3dd502d3f1c8295dded125f3e

SHA256
26132d8dc982b9fc19f1b9d49a67568c2e75f9247236facd39300f7de7637424

SHA512
ac0114dc4472f817f3b79200c7d476395bd60dd11a8cb8347dd8cb10a6b4693c8c68a5a8995cee02c0d05697647915f1976ccdee3ff20963e92d6bbc56dc4356

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
0b22c716886171dbc2217fd2b2e948f3

SHA1
0ac82c4bdb11cdf03f5c7b86b530b955cf12cda3

SHA256
53ed9a3ce83607fd78f1127e35a4d01e59e81ff19692e76a9b21e5617d041e92

SHA512
2114e0886d428aacde6664463d98c6aa977eb1b00c5293bfcc8cf91ecde6cad0860de53edc7a04d0494dfacfc2f3b5935eed1884c1e45852a1bea0e0e1ac9d83

Download Submit
C:\Users\Admin\Desktop\MoveClear.mpeg3

Filesize
307KB

MD5
6ed9ee08e3ffee38c7d73d8408fe4deb

SHA1
5fae0f70a9e51d42fa95c0fb3e50650c9d836046

SHA256
ff880ffaebbf6a763ef8c8236b741e9d6f2c6388b43e68429632088a43d69e21

SHA512
3ecebe5e22de6dd7bdf6d7b6a3ff6855c3dc0818ae7ae9229c318b669ee47c80c14f22329191ab1c866247051abe6fe00f942c3bf4dc0fa04a98e4695d0b1f0b

Download Submit
C:\Users\Admin\Desktop\RemoveUnlock.asp

Filesize
414KB

MD5
72eb44069fb7b85d7f2fd27ebb9c3cf3

SHA1
376904569890b4a8dbc8a8361f8c7aeb070aa498

SHA256
02a8735fee8479d54de62de859f09689c9451f11fb92ef93b71ed5b61791812a

SHA512
caded3dfb037ff5464885f70b639e3d1e37587f4a943162f7104238b3ce80b2b6806bd73ff7cf5707ec980d5076d20261766b065167abb5702cf9289b9dfb2fd

Download Submit
C:\Users\Admin\Desktop\RenameSync.crw

Filesize
230KB

MD5
c47117cd4aad35920d4847bc6a16a997

SHA1
7de0b1c808460f01306897d9d57224c4545f6be2

SHA256
938d90fdd008311c3825cb4d5a22e3e9713802bbfc40f061b0b0aa47e70239c2

SHA512
86675dad89c818d612377814bcdadc9fb0108462774b495f56bcb17a2f339681200749361bb7808691ac87fa249acb966aec8701b5c9bc7da1c9907329ef8d29

Download Submit
C:\Users\Admin\Desktop\RepairConvertFrom.ps1

Filesize
430KB

MD5
618ee9a82d72fba6a1442ba31e9059ed

SHA1
2bf09b27db4235eb601a8348274db7a91b59f135

SHA256
0972362972977884ea9c5915ea1577a61efdc5ec838a3a7b2694d8f2b48fd7bf

SHA512
2262658ecfd7d2182bd1fd125830c929c150e15c1a7640da2ec4471be0257ca3a75e57aa936299339e1f9efb554bf27d1ae5bc8ed3a6b48bf4e425185be8e0b8

Download Submit
C:\Users\Admin\Desktop\RestoreJoin.aif

Filesize
353KB

MD5
e9676f75c343a71d07a828b850584820

SHA1
73f395aeb7d235b56ef133095ca46449550d2ac1

SHA256
bfbb3a22c4415690339299a99f4966934ed641be8717e2649f7ee07833903441

SHA512
4f499a3cb11f45a0dd0fe8842ff9ab4a71919bd7fd7dbf11ada79efd2f721217eb40ab194c62749d903c837b951ff68f1194f07b650e5dc6e5219c67383cd75d

Download Submit
C:\Users\Admin\Desktop\SearchConvertTo.mid

Filesize
598KB

MD5
b7a11b9d8a09161000cd634199dfa6f0

SHA1
44cc253036034fa5f036bdf1e50197d4702f2865

SHA256
14606873d6f1473df9ad2e83988a42fe62b14015f0c297c3ae1473ca0379f250

SHA512
04e35f03fc8ecac8d6b51ec3c86c6a66f950298162f817c8496a8d4f95ab05ee263b4b031375004520c921fc192f4126235fa3bf2e7df8812d54e77fef895726

Download Submit
C:\Users\Admin\Desktop\StartInitialize.jtx

Filesize
276KB

MD5
5668ddbbf5e06f811f8cf0d302760d9b

SHA1
050cf2cd4d3a28611c3095b8e8ddc94dbd7a37eb

SHA256
6469cff60cf783ef2b409e065c9d0fa2349a54fced96dfb9c55824fca7c68502

SHA512
ee3021dda07b068efaeeb00ba4c09f931b9528bdf530b038304e7a09f0e8cdbbaecba68fec83b56e5dd539e1420c48047464d9d357acd3b042f5660de68f0468

Download Submit
C:\Users\Admin\Desktop\SubmitShow.docx

Filesize
19KB

MD5
dc66ff7cbe2c542bb0a25ac962fca0c5

SHA1
7aee05900f8fd840cea25fd5408c94136ffa7609

SHA256
cc70b5f2fd2099afc5669278ecdac1220b7587d1d6bc89a107f6777f8c0f2248

SHA512
3c596fac96780d7622e2ddf298a8237444ae40ad417eb02cfea20bc7ae14cba6ad3f0f2c5e0e780778a0ab218e8c911b8c983280d79367880f9031b0f8bfc4ff

Download Submit
C:\Users\Admin\Desktop\UninstallRename.snd

Filesize
368KB

MD5
db9bfb47968d1446d91cc674c194b600

SHA1
d0df433a3f09bf9f3fd9886de44e03fd80c1dbca

SHA256
8f0c66e22c31118a1170089cae06b37a4222deb6f7e1978cd63207f718e1184f

SHA512
71466c5a6a832f9947dd3bf74471beac482a049857dfe632f0ea353db80426c406b1ed7326659af16041d484f2370b3f530fea517711feafd5cba48cee4743c9

Download Submit
C:\Users\Admin\Desktop\UnlockUnprotect.xlsx

Filesize
9KB

MD5
29080116dae4fd5f2ef2da62f76da923

SHA1
d1390145eca2730ea4dbd973c05bf4753ff550a0

SHA256
9058d29cd00c556bc7705e2967be8d855bc3bc8f965dbb72ad8ff22ad27e27a6

SHA512
bccdcbfdd2e72738d13428a66c52889ba29561bff8994f8853cd8eadeb5ed1279cf315ecb58911042a6b06b1ecac91c581cf0c7f1d2ebb426a53378d8926ee12

Download Submit
C:\Users\Admin\Desktop\UnpublishInitialize.otf

Filesize
153KB

MD5
d36c077332ac2267f94ce01da961c9e9

SHA1
6726be118d6f152d446127d573f299312a985651

SHA256
dec527a5a0a3ae7a4773dd01b54a2055f26f7b42b9d08b753b96be0cbbc60e69

SHA512
cce65b53de67ded23661ca8e6442de13a0c1ba9ac481964f794ecb869c280fd88a4dbbd9013ac856ac2c5180c15c589b760b632514a53606ff21867f472a3ba8

Download Submit
C:\Users\Admin\Desktop\UnregisterWrite.xlsx

Filesize
10KB

MD5
3d96322643ff9fe7377ca00af89d2f23

SHA1
3651143fe3b673f6606856123a34024a91182f33

SHA256
44e90228cbb22b3a9c8fee1841b7cad1488c71e4d152584740c66caa7ceeb05c

SHA512
a09b675d438f44dd8b3fb8d0afaeb2ebdc44dccafe004abff75a191efd592e9241b7603d470efeb42cf91273743d8df00e49485fc6e84678e78610972732dc42

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
128b1f634cb9a731af9f695fdd4122fc

SHA1
47efea8bb28041ebc629a7b3db6e8b4a5ba4c8c1

SHA256
031a06b635c6c81cf717c7bb0ef253b00876651d50c08613294cbb7f155441b6

SHA512
4bd06a1b9c02aa7272ee41e70de4daec4b1a24a6e295b2a3f35f1e33581f25a3221659914c0120435b9fb21bbcd01e0a0831a98e7a51621ce0c57098637d78a9

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
e4ed99cf1b3d02a86ff4285b1138aea5

SHA1
2a722a0605224bbf855167c417155d4e849515bb

SHA256
7d40f69acf195ec5fc99675d63362825656e96741695a5dd8a1cbbd5ef888e66

SHA512
73c355fef4d74a75122b4d8ae3698d1d01beabd7150fb1d2d4c231f7c6f7147ea13fbb43999a6cad77ee47461339d6fee30075431915d86100a5ccc52e006ede

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
70f72598a0065c529c0cd1bfb9e76080

SHA1
abfb3ac518c280e5b8adbaac0b934c8d099625cd

SHA256
b30387198347d0e3373fc48b5a857fcfd108d6b981423c1929fa61f3ee519a30

SHA512
978df990c9238cba212dbfa901074ededc2b8bf682c7b70e770bb934c760a89f99aa816a8e40c8f6f37fb7d5db2ff7a3c71db5d80a039433efdfa699a4dff2e6

Download Submit
memory/2552-1184-0x00000215BFBC0000-0x00000215BFBC1000-memory.dmp

Filesize
4KB

Download
memory/2552-1181-0x00000215BFBB0000-0x00000215BFBB1000-memory.dmp

Filesize
4KB

Download
memory/2552-1189-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1190-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1191-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1192-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1193-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1194-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1157-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1156-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1154-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1153-0x00000215BFE30000-0x00000215BFE31000-memory.dmp

Filesize
4KB

Download
memory/2552-1121-0x00000215B7740000-0x00000215B7750000-memory.dmp

Filesize
64KB

Download
memory/2552-1137-0x00000215B7840000-0x00000215B7850000-memory.dmp

Filesize
64KB

Download
memory/2552-1187-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1186-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1185-0x00000215BFCD0000-0x00000215BFCD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1188-0x00000215BFBD0000-0x00000215BFBD1000-memory.dmp

Filesize
4KB

Download
memory/2552-1183-0x00000215BFBC0000-0x00000215BFBC1000-memory.dmp

Filesize
4KB

Download
memory/2552-1155-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1173-0x00000215BF9B0000-0x00000215BF9B1000-memory.dmp

Filesize
4KB

Download
memory/2552-1170-0x00000215BFA70000-0x00000215BFA71000-memory.dmp

Filesize
4KB

Download
memory/2552-1167-0x00000215BFA80000-0x00000215BFA81000-memory.dmp

Filesize
4KB

Download
memory/2552-1164-0x00000215BFA80000-0x00000215BFA81000-memory.dmp

Filesize
4KB

Download
memory/2552-1165-0x00000215BFA70000-0x00000215BFA71000-memory.dmp

Filesize
4KB

Download
memory/2552-1163-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1162-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1161-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1160-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1158-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/2552-1159-0x00000215BFE50000-0x00000215BFE51000-memory.dmp

Filesize
4KB

Download
memory/4112-28-0x00007FF7BAFA0000-0x00007FF7BB000000-memory.dmp

Filesize
384KB

Download
memory/4820-0-0x00007FF7BAFA0000-0x00007FF7BB000000-memory.dmp

Filesize
384KB

Download
memory/4820-30-0x00007FF7BAFA0000-0x00007FF7BB000000-memory.dmp

Filesize
384KB

Download