lumma | hxxps://youtu[.]be/QtSYjqc7n0Y?si=5whvOC6IN0rxqT-p

Analysis

max time kernel
517s
max time network
519s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youtu.be/QtSYjqc7n0Y?si=5whvOC6IN0rxqT-p

Score

10^/10

lumma discovery persistence phishing privilege_escalation stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	winzip76-mf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 28 IoCs

pid	Process
4088	winzip76-mf.exe
5884	winzip76-mf.exe
2356	winzip76-mf.exe
4764	winzip76-mf.exe
3488	winzip76-mf.exe
5504	winzip76-mf.exe
4404	MicrosoftEdgeWebview2Setup.exe
3272	MicrosoftEdgeUpdate.exe
5824	MicrosoftEdgeUpdate.exe
180	MicrosoftEdgeUpdate.exe
2836	MicrosoftEdgeUpdateComRegisterShell64.exe
5336	MicrosoftEdgeUpdateComRegisterShell64.exe
1264	MicrosoftEdgeUpdateComRegisterShell64.exe
3696	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe
4812	MicrosoftEdgeUpdate.exe
3360	MicrosoftEdgeUpdate.exe
5376	MicrosoftEdge_X64_131.0.2903.112.exe
4032	setup.exe
336	setup.exe
5824	Believed.com
5948	MicrosoftEdgeUpdate.exe
1292	Believed.com
5032	Believed.com
5440	Believed.com
180	Believed.com
5504	Believed.com
5316	Believed.com

Loads dropped DLL 16 IoCs

pid	Process
3272	MicrosoftEdgeUpdate.exe
5824	MicrosoftEdgeUpdate.exe
180	MicrosoftEdgeUpdate.exe
2836	MicrosoftEdgeUpdateComRegisterShell64.exe
180	MicrosoftEdgeUpdate.exe
5336	MicrosoftEdgeUpdateComRegisterShell64.exe
180	MicrosoftEdgeUpdate.exe
1264	MicrosoftEdgeUpdateComRegisterShell64.exe
180	MicrosoftEdgeUpdate.exe
3696	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe
4812	MicrosoftEdgeUpdate.exe
4812	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe
3360	MicrosoftEdgeUpdate.exe
5948	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Enumerates processes with tasklist 1 TTPs 14 IoCs

discovery

Process Discovery

T1057

pid	Process
4296	tasklist.exe
4612	tasklist.exe
3928	tasklist.exe
2764	tasklist.exe
5956	tasklist.exe
1788	tasklist.exe
5648	tasklist.exe
5172	tasklist.exe
5464	tasklist.exe
2292	tasklist.exe
1936	tasklist.exe
5876	tasklist.exe
4656	tasklist.exe
1908	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\eventlog_provider.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\mk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\ru.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\msedge_200_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Locales\tt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\or.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Locales\az.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\show_third_party_software_licenses.bat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\dxil.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\identity_proxy\resources.pri	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_en.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\131.0.2903.112\MicrosoftEdge_X64_131.0.2903.112.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\sr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Locales\fa.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\as.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\msedge_proxy.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\ro.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Trust Protection Lists\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\psuser_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_ms.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\bs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Trust Protection Lists\Sigma\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\vi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Trust Protection Lists\Sigma\Other	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\dxcompiler.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\lv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\delegatedWebFeatures.sccd	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\resources.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\libEGL.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\notification_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\vcruntime140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Locales\zh-CN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\es.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\zh-CN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\BHO\ie_to_edge_bho.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Locales\nl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\Locales\as.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\onramp.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.112\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\HansenWv	Loader.exe
File opened for modification	C:\Windows\HomepageWarehouse	Loader.exe
File opened for modification	C:\Windows\AchievementGlobe	Loader.exe
File opened for modification	C:\Windows\HomepageWarehouse	Loader.exe
File opened for modification	C:\Windows\HansenWv	Loader.exe
File opened for modification	C:\Windows\HansenWv	Loader.exe
File opened for modification	C:\Windows\AnybodyBuf	Loader.exe
File opened for modification	C:\Windows\HansenWv	Loader.exe
File opened for modification	C:\Windows\LowsInflation	Loader.exe
File opened for modification	C:\Windows\AchievementGlobe	Loader.exe
File opened for modification	C:\Windows\AnybodyBuf	Loader.exe
File opened for modification	C:\Windows\AchievementGlobe	Loader.exe
File opened for modification	C:\Windows\AchievementGlobe	Loader.exe
File opened for modification	C:\Windows\LowsInflation	Loader.exe
File opened for modification	C:\Windows\HomepageWarehouse	Loader.exe
File opened for modification	C:\Windows\HomepageWarehouse	Loader.exe
File opened for modification	C:\Windows\AnybodyBuf	Loader.exe
File opened for modification	C:\Windows\HomepageWarehouse	Loader.exe
File opened for modification	C:\Windows\HansenWv	Loader.exe
File opened for modification	C:\Windows\LowsInflation	Loader.exe
File opened for modification	C:\Windows\HansenWv	Loader.exe
File opened for modification	C:\Windows\AchievementGlobe	Loader.exe
File opened for modification	C:\Windows\HansenWv	Loader.exe
File opened for modification	C:\Windows\HomepageWarehouse	Loader.exe
File opened for modification	C:\Windows\LowsInflation	Loader.exe
File opened for modification	C:\Windows\AchievementGlobe	Loader.exe
File opened for modification	C:\Windows\LowsInflation	Loader.exe
File opened for modification	C:\Windows\AnybodyBuf	Loader.exe
File opened for modification	C:\Windows\LowsInflation	Loader.exe
File opened for modification	C:\Windows\AnybodyBuf	Loader.exe
File opened for modification	C:\Windows\LowsInflation	Loader.exe
File opened for modification	C:\Windows\AnybodyBuf	Loader.exe
File opened for modification	C:\Windows\HomepageWarehouse	Loader.exe
File opened for modification	C:\Windows\AnybodyBuf	Loader.exe
File opened for modification	C:\Windows\AchievementGlobe	Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Believed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winzip76-mf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winzip76-mf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winzip76-mf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Believed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Believed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Believed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winzip76-mf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Believed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winzip76-mf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Believed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3696	MicrosoftEdgeUpdate.exe
3360	MicrosoftEdgeUpdate.exe
5948	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 20838.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\e5bffb9\winzip76-mf.exe\:SmartScreen:$DATA	winzip76-mf.exe
File created	C:\Users\Admin\AppData\Local\Temp\e5c075a\winzip76-mf.exe\:SmartScreen:$DATA	winzip76-mf.exe
File created	C:\Users\Admin\AppData\Local\Temp\e5c0a39\winzip76-mf.exe\:SmartScreen:$DATA	winzip76-mf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
2024	msedge.exe
2024	msedge.exe
4540	identity_helper.exe
4540	identity_helper.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
4000	msedge.exe
4000	msedge.exe
8	msedge.exe
8	msedge.exe
3272	MicrosoftEdgeUpdate.exe
3272	MicrosoftEdgeUpdate.exe
5704	msedge.exe
5704	msedge.exe
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
5824	Believed.com
3272	MicrosoftEdgeUpdate.exe
3272	MicrosoftEdgeUpdate.exe
3272	MicrosoftEdgeUpdate.exe
3272	MicrosoftEdgeUpdate.exe
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5440	Believed.com
5440	Believed.com
5440	Believed.com
5440	Believed.com
5440	Believed.com
5440	Believed.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: 33	1384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1384	AUDIODG.EXE
Token: SeDebugPrivilege	3272	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5172	tasklist.exe
Token: SeDebugPrivilege	5464	tasklist.exe
Token: SeDebugPrivilege	3272	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	2292	tasklist.exe
Token: SeDebugPrivilege	1936	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	5956	tasklist.exe
Token: SeDebugPrivilege	3928	tasklist.exe
Token: SeDebugPrivilege	1788	tasklist.exe
Token: SeDebugPrivilege	1908	tasklist.exe
Token: SeDebugPrivilege	5876	tasklist.exe
Token: SeDebugPrivilege	4656	tasklist.exe
Token: SeDebugPrivilege	2764	tasklist.exe
Token: SeDebugPrivilege	5648	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
5824	Believed.com
5824	Believed.com
5824	Believed.com
1292	Believed.com
1292	Believed.com
1292	Believed.com
5032	Believed.com
5032	Believed.com
5032	Believed.com
5440	Believed.com
5440	Believed.com
5440	Believed.com
5504	Believed.com
5504	Believed.com
5504	Believed.com
5316	Believed.com
5316	Believed.com
5316	Believed.com

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4088	winzip76-mf.exe
5884	winzip76-mf.exe
2356	winzip76-mf.exe
4764	winzip76-mf.exe
3488	winzip76-mf.exe
5504	winzip76-mf.exe
4404	MicrosoftEdgeWebview2Setup.exe
3272	MicrosoftEdgeUpdate.exe
5824	MicrosoftEdgeUpdate.exe
180	MicrosoftEdgeUpdate.exe
3696	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3464	2024	msedge.exe	86
PID 2024 wrote to memory of 3464	2024	msedge.exe	86
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 2804	2024	msedge.exe	87
PID 2024 wrote to memory of 1852	2024	msedge.exe	88
PID 2024 wrote to memory of 1852	2024	msedge.exe	88
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89
PID 2024 wrote to memory of 4204	2024	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://youtu.be/QtSYjqc7n0Y?si=5whvOC6IN0rxqT-p
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc5c646f8,0x7ffcc5c64708,0x7ffcc5c64718
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7544 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Users\Admin\Downloads\winzip76-mf.exe
  "C:\Users\Admin\Downloads\winzip76-mf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:4088
- - C:\Users\Admin\AppData\Local\Temp\e5bffb9\winzip76-mf.exe
    run=1 shortcut="C:\Users\Admin\Downloads\winzip76-mf.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4404
    - - C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3272
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:5824
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:180
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2836
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1264
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDBGRThCQTItM0M0Ri00REY3LTg0MTYtMzgyRTdGMjY3NEJFfSIgdXNlcmlkPSJ7MTUyMjE2RkItQzI5NC00REQ3LTg1NTctQ0RBMkYwMzE3QzY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4OTc2NkM1Qy1GQkFFLTQ3QzYtOTBDNS1ERjIyRkM5NzRCMUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjQzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzIxNDIyOTkyIiBpbnN0YWxsX3RpbWVfbXM9IjY4OSIvPjwvYXBwPjwvcmVxdWVzdD4
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3696
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{40FE8BA2-3C4F-4DF7-8416-382E7F2674BE}"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3644
- C:\Users\Admin\Downloads\winzip76-mf.exe
  "C:\Users\Admin\Downloads\winzip76-mf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\e5c075a\winzip76-mf.exe
    run=1 shortcut="C:\Users\Admin\Downloads\winzip76-mf.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4764
- C:\Users\Admin\Downloads\winzip76-mf.exe
  "C:\Users\Admin\Downloads\winzip76-mf.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\e5c0a39\winzip76-mf.exe
    run=1 shortcut="C:\Users\Admin\Downloads\winzip76-mf.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2240,6602774452865463510,11390715777558713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4812
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDBGRThCQTItM0M0Ri00REY3LTg0MTYtMzgyRTdGMjY3NEJFfSIgdXNlcmlkPSJ7MTUyMjE2RkItQzI5NC00REQ3LTg1NTctQ0RBMkYwMzE3QzY3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MEQ2REI3MEYtMzhGQS00NDk2LUEwMzQtQjQ5MkVDNDBEQzdCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2NCWUVZWDg3MXRzR3VLSmFvNjNYalV0NXZKRTlYeENUbkU3SDBQZ1VqS0U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI4NiIgaW5zdGFsbGRhdGV0aW1lPSIxNzI4MjkzNTczIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNzI3NjYxMzQ3NDUwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzcyNzMwMzQ2MyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3360
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\MicrosoftEdge_X64_131.0.2903.112.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:5376
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\EDGEMITMP_668B9.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\EDGEMITMP_668B9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\MicrosoftEdge_X64_131.0.2903.112.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4032
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\EDGEMITMP_668B9.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\EDGEMITMP_668B9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.205 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4FDFAEBA-EBE9-40C3-9F01-05EF91DA8A2B}\EDGEMITMP_668B9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.112 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff7b26a2918,0x7ff7b26a2924,0x7ff7b26a2930
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:336
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDBGRThCQTItM0M0Ri00REY3LTg0MTYtMzgyRTdGMjY3NEJFfSIgdXNlcmlkPSJ7MTUyMjE2RkItQzI5NC00REQ3LTg1NTctQ0RBMkYwMzE3QzY3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyN0FCMDU0OC0yM0JDLTQyNzEtQTE4RS01QTJDNjEzMDkyQjN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy4xMTIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3NTc1ODMxMzUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzU3NzUzMjE1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODAxMjQ2MzU5MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvN2Q5Y2Q5M2MtMWQ1ZS00NDliLTlhZDctZjFlOGQ2YjkwNTA5P1AxPTE3MzYzNjUxODYmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZWZXZUdKZ1I5SnU5SnZBQTFXcFBZSWp1UU9Va1BaUVY4N0hlb1lkMzV4TXVGWEhrZFhSdDkzSTR6ZUZoTTMzOFBLWkNqRlJpeEtTWjdPa0pmN2RKcHclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzY4NzA5NzYiIHRvdGFsPSIxNzY4NzA5NzYiIGRvd25sb2FkX3RpbWVfbXM9IjE4NjUwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODAxMjU3Mzc4NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgwMjY2NDI4OTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg2MzkxMjQ1NDYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyNTAyIiBkb3dubG9hZF90aW1lX21zPSIyNTQ2MCIgZG93bmxvYWRlZD0iMTc2ODcwOTc2IiB0b3RhbD0iMTc2ODcwOTc2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MTI0OCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4116

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
PID:5272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reynolds Reynolds.cmd & Reynolds.cmd
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 231667
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Explorer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3504
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Object" Camcorder
    3⤵
    PID:424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 231667\Believed.com + Capable + Highlight + Paid + Text + Com + Mfg + Expenditures + Central + Monday 231667\Believed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Pets + ..\Workforce + ..\Belt + ..\Endorsed + ..\Told + ..\Demands + ..\Brighton o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4800
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\Believed.com
    Believed.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:5824
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4316

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reynolds Reynolds.cmd & Reynolds.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2220
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4380
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 231667
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5292
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Explorer
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 231667\Believed.com + Capable + Highlight + Paid + Text + Com + Mfg + Expenditures + Central + Monday 231667\Believed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Pets + ..\Workforce + ..\Belt + ..\Endorsed + ..\Told + ..\Demands + ..\Brighton o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\Believed.com
    Believed.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:1292
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    PID:5264

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reynolds Reynolds.cmd & Reynolds.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1092
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 231667
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6112
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Explorer
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 231667\Believed.com + Capable + Highlight + Paid + Text + Com + Mfg + Expenditures + Central + Monday 231667\Believed.com
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Pets + ..\Workforce + ..\Belt + ..\Endorsed + ..\Told + ..\Demands + ..\Brighton o
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\Believed.com
    Believed.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:5032
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reynolds Reynolds.cmd & Reynolds.cmd
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5956
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 231667
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Explorer
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 231667\Believed.com + Capable + Highlight + Paid + Text + Com + Mfg + Expenditures + Central + Monday 231667\Believed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Pets + ..\Workforce + ..\Belt + ..\Endorsed + ..\Told + ..\Demands + ..\Brighton o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3456
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\Believed.com
    Believed.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:5440
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2288

C:\Users\Admin\AppData\Local\Temp\Temp2_GalaxyPr00j33ct2.53v.zip\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_GalaxyPr00j33ct2.53v.zip\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reynolds Reynolds.cmd & Reynolds.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4208
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    PID:412
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 231667
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3832
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Explorer
    3⤵
    PID:756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 231667\Believed.com + Capable + Highlight + Paid + Text + Com + Mfg + Expenditures + Central + Monday 231667\Believed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Pets + ..\Workforce + ..\Belt + ..\Endorsed + ..\Told + ..\Demands + ..\Brighton o
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\Believed.com
    Believed.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:180
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3076

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reynolds Reynolds.cmd & Reynolds.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1816
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    PID:4780
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 231667
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Explorer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 231667\Believed.com + Capable + Highlight + Paid + Text + Com + Mfg + Expenditures + Central + Monday 231667\Believed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Pets + ..\Workforce + ..\Belt + ..\Endorsed + ..\Told + ..\Demands + ..\Brighton o
    3⤵
    PID:700
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\Believed.com
    Believed.com o
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SendNotifyMessage
    PID:5504
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    PID:1588

C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe
"C:\Users\Admin\Documents\GalaxyPr00j33ct2.53v1\GalaxyPr00j33ct2.53v\Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reynolds Reynolds.cmd & Reynolds.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2212
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 231667
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Explorer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 231667\Believed.com + Capable + Highlight + Paid + Text + Com + Mfg + Expenditures + Central + Monday 231667\Believed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Pets + ..\Workforce + ..\Belt + ..\Endorsed + ..\Told + ..\Demands + ..\Brighton o
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\Believed.com
    Believed.com o
    3⤵
    - Executes dropped EXE
    - Suspicious use of SendNotifyMessage
    PID:5316
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    PID:6032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.112\Installer\setup.exe

Filesize
6.6MB

MD5
f0dc48bc6e1b1a2b0b15c769d4c01835

SHA1
66c1ba4912ae18b18e2ae33830a6ba0939bb9ef1

SHA256
7ada85f31a3b501eaecd2aa37b8df1f74b470b355279b5db2d1fbc0bb7de4889

SHA512
d2ceeaf987446f7463e84a6286dc1c8f50a80466af641f77d174826189ff5a56b048e616ad8d97ddb12a2f68e182af80309be717367224605c06dcf74a84cc0f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
8f7c44e937ecc243d05eab5bb218440b

SHA1
57cd89be48efe4cad975044315916cf5060bc096

SHA256
bc3cdd57a892ce1841787061e23e526ad46575460cd66c1dc6dcf0f811563d59

SHA512
9f0020b81d1945fea12efe1a0a5e59caae4a01432429e065e35c73b15db873253094b2ff1f8903a348446dfc9c9fb658f8bfed8c25bc56e8b546c16304a385a3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
70cc35c7fb88d650902e7a5611219931

SHA1
85a28c8f49e36583a2fa9969e616ec85da1345b8

SHA256
7eca199201273f0bcff1e26778cb535e69c74a69064e7759ff8dad86954d42b1

SHA512
3906ddb96b4b1b68b8c2acc940a62c856e8c3415a1b459f17cf2afc09e05751e0086f8e4e5e0ddd8e45cfb61f811bbe4dd96198db68072b45b6379c88d9ea055

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
714c34fe6098b45a3303c611c4323eae

SHA1
9dc52906814314cad35d3408427c28801b816203

SHA256
fbf495968c4a385ff0790e6b65d26610ef917a2b36a5387eff7ae79d7a980ac5

SHA512
68a65496275a1511b2d3bd98ac5592cb1c1eb9df0448471a8985cb2f458c66163e6d55545940de72dea80118ff8ec7ba0ad3276f51095f55c1243fb9f3311345

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
c8b26176e536e1bce918ae8b1af951a2

SHA1
7d31be0c3398d3bad91d2b7c9bc410f4e45f37be

SHA256
be6ab7dd506e44a0a9eb0dd531929bd8aa0796d85a0353e6944bc6bf1630b717

SHA512
5a362cbabebbffbb0797646576b65e2934a3b0a30306d74078ef2448fea3940df14f0b8f149691a100cc170bd548c9b420dcc8aa41eb1ea0700c9f155626c565

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
40cd707dd3011a9845ff9c42256ea7e3

SHA1
4045ae709979f75b1cf32142c1137b4be2ab9908

SHA256
9f4c7072716e0be1be08207a7024a5e41162e288e677d805be8e5469a8bd4909

SHA512
bf1ada8a0d9c3d9f39fb739d05fc4a61f0a7e0e1bb5eb44e6f0f5f58381ee6d80aad89dbc3211b70a6294fc69d5820c70fa8488ef2f793a3710ecff5ee90422e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
e91e279752e741b25cf473338d5aac88

SHA1
2b8ea61868a26408cd1dd351cca5139a046bbb7b

SHA256
5635ecedd84330f070a9d6f4cea8b8b81e9dad8592d336ebfd236b7d67e58acc

SHA512
7404cdb82309351a21415b045fc7165137492aa262d00fd0f74bad4262ce10e86c3bde1718c38757b7133e41d044035e731c52cccea285d659c4a570776ae535

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
bd175cb3dfc1d43944223bd5d7177539

SHA1
193623dc372937f31a545344d340360665b8d69a

SHA256
bf0d65cebe0c29f15a616a0dda2f1a414e3f96fe7a28ff7876e811855be6621b

SHA512
f5742352852837ce16f3cf1655e4d41e301f0351b68c7346457978aa310b95b69b1070741fc2ab8be5ff449f6fd44660df3b15811630efc1420ced1455fcaf5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
42015aafd53012b9c8afa009ee501fa0

SHA1
c1fc049feab4fb4b87faf96c31b3d1160f1c1d39

SHA256
86858a1807e6cf0b91565ed7a5a15db24720b0a7f60ae41e67dbf9faeb6ef2fa

SHA512
9ce323da000b51480ee35973872fc7d181e1f69e820ac737c62c36eaa81eb99965bae39fdd394459adfaf8f746f5dc3b768015e01d8724e2d0718f5286c29389

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
8a54873d54a41442b62f9fea9492d3a6

SHA1
fb19af151b15f4bdb7a555924f1835b0337ff1d7

SHA256
af9bdd050b27b8883f72e3596179fe244a6a2e3545950c82889aac7198cf3c32

SHA512
7cc0a578586853afd027264c3898cb1460b23a47eab9c79e064b9f327fbdee6e3f9bc7043a5a76a710ada05edae4ac0b47529be3ae67ca9b5afaaa16151797c7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
e47db9afb646fb31cc8650837f487134

SHA1
f304204c908ea1fe2bcaf76040d5d1f13f1e99e0

SHA256
4e03ed7a538793fdcd4c646c62ddd278c46911099e6485bb2644a17ad3a8ecf6

SHA512
b2b01c86c78ec3450635c0fdef9666ce302600956e8def3bb02d205ba2a11b3d422520a64361c6f666998bd82b5557ec96cbcaba9e1b712c756e75128c8f9bc0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
5887cd452245dc7bd0389a0ad5db98e0

SHA1
6486d0ae59ba338e8bce87b438f86691e955840d

SHA256
922a102cae4e74bfc0b402bbb136116eddc71a8adcf7f1268d48006c858d1d60

SHA512
0720aaebca04e84d8af2d7b153b0fc51e5651cf664051b8c4b44159ed4c6328eb237ba4f4c97bebedbb1a45ca5c1d0f249cdccac76c6d5619e0e761d12aaaba1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
6aab6d42c7b7a90523a3272ad3916096

SHA1
cc638bd6ec6478734b243de2daa4a80f03f37564

SHA256
67180722f255985e849ec3ab313dcdc0bf2834bad7b6163a0b14587fdf4b4c66

SHA512
ebc17e0ef86b8e5bb938040ad78b299e33d1228c730666526aab27e464626b71ea900cb6dbe074bda5e42e77cd569b083637e233d757b8b0bdee2df2e0c509f2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
abc20df0545611a835dcd895d2832cca

SHA1
39e90363156c461e5aef64a714ba43cc61617ee5

SHA256
75d8c2e259b4d113c0967615af61e8f54eafb49c498767291627faae9fcf504b

SHA512
732f31d175f08c5c69b9cf540e2b0e72b8986b44d1ebfdf0e56eb56b68bea64e6446932a546f1fc30dbbbad4ccaf6bc935177a6348c5280ef786d6d8dfa7b325

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
327e92c7a55ec996ce09dfcf8c89e753

SHA1
2a51c99519257ddebf0d8280d46e0c0fd416e7a5

SHA256
2b61608a7aca43b7ea4374b79acc6e15deb382eef0fa8751c8e57e03e061cab0

SHA512
ac3ca0f66b899759f0d23ba64ff291486edb1e1d3bb626ad3efe3e3a6fd2aa4081411546e4849ff1645dcd26161f35defbd8442278e6d6f66311780c60474296

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
e0d2675c6de1b8d4e5e463246529a304

SHA1
132dace535b9cdc7a4e5f6137407d5becb23c4c6

SHA256
4af082aa0193b9b15622eba1f6165d0b6032b4dab17ba16a8a9affb267ebec34

SHA512
afafc1ca5abc636066ee98a6c68356d68f506fe3734a4b3e68073eed1f2ddc51840464e91d3cd3b28648fcc26b9457ef6484100f9543739220ad75a9eecb1e90

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
bfac1c3869df5375aedb24458cf321b7

SHA1
848232c155c7dca65f6cb22d27a72f2c78e964d8

SHA256
a9f5cf25b9512e1d30ecb769a5eeb694888b72b7f05b78c417814802c5aedbd7

SHA512
732270e8e8036f8ec59c214ca3804c6c67420bcf5fd633347c764f90b06b25fd73a0c7aa75ec42461ae3d3570fbfec5c5a7eee10e8d494b805b7c7e0d4aa227e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
c5681c3b4a8145d3b6cbf51e3f0b12fb

SHA1
908a0546ce091906aa5e7728660b838bf1e619e4

SHA256
2b47a6c19ec492149eca6afb03ca82ac1418a727f35cb641bce9f22136dd3459

SHA512
06c850119b5199bfcec41abe2b5e6929e0a960b69337c6048e0dbdd37ca56401885785de96cec235093a4d6536d9de55178a4c739a6ebd5e34514e12635b6d31

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
3206ad1fbe5c53d278607da7767b1996

SHA1
6964da8787c299e71f8428b22ed8ff6909912034

SHA256
9ea2727ca92f74c7c35ea22287f13ef262241a905567b908e2860f19e044a848

SHA512
38281ab3590a2e6210d1d9c0d1f5a4a3ef19772065f87d94570bb448fb83ea0579aa8bac9e94b05ba2b6bb2bb882f1be6d45c921c52ca2f0608056512fb3338c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU142C.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
cfb71031c56d9e8b9490d01fbe86302c

SHA1
9e11ecf5efc88e0beee1db46620bebc73f86dd21

SHA256
b18e14d0e24546193822b83996c5b311500ca213beb4d497cbd1dda9dac9db2f

SHA512
9cf993ea53673e416eead78d45a6d700b74001b69b1b987d479e77348ea8dc151f4ba6d6b1220db21ce792f9da51b9c83f33663621f9350b848a766ceae92370

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
c0a77d9a27afe157033204eee99670d6

SHA1
60dd57ab8dca10dc658129b9e76561b227d4a452

SHA256
85a5e7f2e5bdd8bcf35cbe68a9b8d32ea064997399371df7a71504223e86e41d

SHA512
26f9681216e03128717ba8829aa8209a29d03440b8799176c99ef6c3e9a7526c2ae5923ae4bf065ecc814e2dfe3382d6f1418e1996ae64dbbb14c480a47e9bdb

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
90KB

MD5
05963ddde828bb059e802938daa30832

SHA1
8bacad657568f2d9b9d4cad8b2bf539b0bd9dc98

SHA256
ac051aef2cb4f669b62575b0b3c0924feb41801c7014d43fce47332c587bde2c

SHA512
1bad6f03e9e5ef0fbafc376d447ca7172204c1f76dcedeca93a76474de9580237cd36f53c494f2dfa89b10fe561110882bc29ac10da02cea79d2204cda1f6634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
49KB

MD5
7ca090d5f0c1a9e7d42edb60ad4ec5e8

SHA1
7278dcacb472ec8a27af7fbc6f8212b21e191042

SHA256
4039fef5575ba88350a109b2c8d9aa107f583acb6cbe2ac8e609071567c4cc76

SHA512
c4f2d23eacf74f87de8dea6e4532b120253bb9ad356341532f5e1aaf2ce90d137f46b50df7de5250bce4eca1fbfb74da088accd7c626fa853dc524abad7bfe8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
239KB

MD5
5b1a50d32003745b1a936967b98f11e6

SHA1
fbe602b3997dd91a54a9a6578b2f5dac7cf50280

SHA256
177717c6a2bfd0ed22a2d249ad621321f2b901f0fce4dc118ef8e020d80d8d95

SHA512
6c49d6db209bb14e1462e655bb7d90b02750eb2ef6241110a97365799b8af2ada372b3455396ced05ecd9ca49baf007171d4a72a7b219fdea4afc16c43b7dac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
34KB

MD5
e85ac71b59dadc1488a1c888db91c5ea

SHA1
a4aa7fc9226bd867a978945a27fd78a0a82cc994

SHA256
7441da6812af01a6eb9afa5d602986b233a57700cb721343b0aa9830a15def0d

SHA512
2b4d952a258f9001c2d8a42402c98788759138669750667524df2031d3926e21836b037974ded859bebf88fd9296791a6a2de65561b8098f066f9cbb8ae719ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
34KB

MD5
6242c13ec6b35fed918ab71eb096d097

SHA1
691e6865e78afb11d9070056ba6cd99bdad7b04e

SHA256
b1c7566622f40bad557a6c5b7bc5b8ae25b4da191ac716cc7923282eef96034c

SHA512
52914b4ca7362e9ebe326ea89006f5cc096fd4d1c360cae33ca768af92fe6fdb5078d0848fb6dc092848ba0e3d3f51bfb20a292250c35e8bd2e79fd5a19dd7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
82KB

MD5
36f5a723d8ea215105e234d221701697

SHA1
328136bb1f00b00bace5e4c6cf6a7e45425c17b2

SHA256
302c7ac0af04845c20b3bcd54d3a603c607b0d6afd10ebffe5eec7deb059e748

SHA512
5f44f06ff80459b52f7d56933862790b20dcb51dae97b0e26db4bf3fec83d1f01ad862ab26129f9061841730c257a8b9969325ec385f2be9f0e39734910c40b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
51c9013bcb68d5d16848dda5b9e8834a

SHA1
bb1e10df832fc8634f7a1a768d00f39853b51c55

SHA256
53be5ee9f3cf2412f1b05927ffd807f0b6a5991a2eb16ca5e0f36ee9f7f23ab4

SHA512
ff03872d482eec02ad81ca30a23f58564291929b782a2885b46a4c815594ca8c5ba91b42818b180876495610a1646e4ad02caec5701eafb2b239b977b7c4b7d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
42af5bf0dc8a782bed5afb847cb98a33

SHA1
0c4b53ac220b917d0f830a8291841f3e7e6f46d5

SHA256
3caeb8a076429dd184e8e051db5f6920865e6da2ff836d7b2386d6163447d481

SHA512
8e58ceabca1d9623136302e91e9f693b93ede2a9fbc0f8ca5a873215fcc27b9cf501942e01fbab1c5b31c6e894800eb1545b54e37200bb7b129039abd131801d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
2275a721ce54045f5784f7344a58a55f

SHA1
6975f7c56ec728017af705de5564627ce9d57da0

SHA256
58d5e8c4e7fda5f5fd76481c5ca82b5b5b267ec118aef69d6912f175b3fd3421

SHA512
25cdd7a7f9bf169fd90796335ed4b0d2690741b67ae74fc6d80b94b5c4bec4cc5e4ec8236736d7030db950a6706c59aadbd784de2e8d58c3b14abc905dea5f36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e452f9546529267e741512e80cd00015

SHA1
55adc9d6cd6f5206ac0d88a02f6b123c491d92af

SHA256
b8cfdffc1febf1c7d9882c44c8dbfbc9ecb02bd029ec1cd21b712c43f63e04df

SHA512
89f21d6bc955fcb833b2b291679b98ae4742e9d41b3a8d1fc0d0a239b0769ffc0a7450061c2b4bd84a235cff1e8ea89359c8209fe4d9877b94c8763641a0a022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
984ee1fa7a5b1d7233e3353717b11820

SHA1
ede7c35d290a263721c2b4cd9e47fc799b6df5e2

SHA256
47ea3b2933dec3f5b79e4cb1193be2a8f8824c1d71bd8b1b0e4443607888c741

SHA512
4ca85c122a237279c652efa07e83c518eda164b203f97b21afaa8786f5a4d3e8edde9fd111f50d046160c0891d5ac195517c0f33d1f02b1c7d3206dd10f91507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
fb40fed6dea6f52693ab29be6b92b23e

SHA1
873e2a18a5f434e0b5860a781c76810364e039e8

SHA256
fd5160065a4224bf534b5863a7bd5d4f6e695d1a6e1dd4afc3e464a40a59109a

SHA512
ff8defac7f93ad54907f2e17c3bedd742aa0e47d803bd216694cbad60d9bb5766c5203f7d619fc17dbf39b22a2a4c0c9c421e4d8ab7dadd3772a52f6002eb8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9499d51ba3cda2e0ea2d3165013a98e7

SHA1
05f3eea92789b1c1ae7979944c0b9b419b7ebb18

SHA256
16e4da8e4e93212fa3e28c170770adecf05e3a7279e339e9ec2681be94a3e2fe

SHA512
b367ccc83ce9fe2447b8186b50b60214408c60fbd1c163ddba389dffb3949a1a2acd96b2b8d85718b69e7dca31e480307dea7178e2fed00fb0a89c761ec60265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a8a5f3554edc2d0fdf03561067e2aff7

SHA1
7e5189ff949db90a30fcc655598a06dd6eb76c88

SHA256
80d7cf6cefb693e02f81f5c50fc7a2ccf24cfbb8d2cff9c5d892a8241a56cc95

SHA512
f6e5e721ede2aee60371adea338ec54ca25245c6c81a9a8958b87f0315b1a7f9a399073262a76c1166a21ac608a8017cebb6525eb8d03bdca85b0533e3e5d5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
26b50705b1b0727c26e21c2ff1b28783

SHA1
782e8e7935393be7c831b8e2d1d310dd2595e389

SHA256
314ed3cb3e5452774ae8c8a93767c7682c286ffa4f1b4227193442f37cc65af1

SHA512
ac9d0f2b38585b12942c76bb988ae52761ec8a3e0236841868f1bee6bc176f1a3cb085424a1e4f7ab2d83bd459e693741c704ca693204eb879308fe7983fd4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
2e060d040dfb952b7fbe2309fd220dd0

SHA1
ef12340d4646c5da63e557d80c1ca9de4e068066

SHA256
a9929c92204312eaa074c81f93c60fa24ba27639c8d67ac7546f6e1004bb8d57

SHA512
5a278b4f5bcdbfd0bdbceb82c252f1254e721715a9137ebfa014331a5a091918b476b14ef1b0800374ff29277849bcde133c9ad0251c609908ba0f8c0b733bf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
64bfa37aa27150c48040d698175f74e2

SHA1
375a64a14c881c840305fa828a6c59eb3b348d69

SHA256
206c65353faf874ae08a280c43c24231abc9e4ab2b2dfd6819059c87efa11f6d

SHA512
de8dd79bb6031cc5d9d96b70b325de04892ee6c2e0f874702c997f29b197d361cfd9fac68b5c35611c0c6edb2cec36a5422e6f0fdf635400e42415a9070e46f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
a1886108291b3efa96a1c6433f470788

SHA1
97f119dee76c57e4902b3b642b3bdf00faeb834d

SHA256
5d37ad2972a12890e0d9617db7583de60abd7c7dcdcf4be0ace4e8cd1d592b4e

SHA512
c48f1fcdccac0a3bedeb5f70daa06d603fc5f0360a95e65ab55e5c1942bac72370365de48666ecfb30b33ccb516da52d61ba42a4c4e2d36b64736b5a264980a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
77cc039ca8b14941be1e7b6cabf97b92

SHA1
b257165835910ece24e2190822b5a51d35b72023

SHA256
4253e4685b9903b1069e08e039bfd30f3cc321fb55cc5669377edeb75b3176d9

SHA512
c763edaa4761f7fcefd284913931b25282a2d6ee3bfc403a214c07a728575d8bf6a9319bf539edf847f4dc639fe120077e36c34d54bf0da6c9f605bbd956dc9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b59474e4983f3f3eff811b32cc2123f8

SHA1
201c529bd314b595b30fcc7219593b830783a044

SHA256
c66e9751fc51c4986492cf276458b4dfc7a2823eae001038c8b48edf68e529d0

SHA512
d51483d51b05e569f9e1f77ceb6354d47fe6760bbf0dfdcd20fc84f5cfe6d9f80918142d0f033d94f5d6aa1d503fac6df72a5bf40a5eeeb26f401dbc341b1e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
483047423209314110ec4cc5b45888d8

SHA1
3bc593e0aca8ee5852e168ee4c24f413a4611015

SHA256
024780b3536a366d92b7f5473bdf61b9772c43b44958353ee5179ec7ce9cd5a4

SHA512
278846cce9e42e6be985784aa400c197b6caa9ca3d70b6903a5f76d0bcb5b4aabe7a2a3953c5c88523226795df1a39c9ad15817c57de45d37fc57ebcfabcb809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
37edf9c1330cb302f43ee2e7748a35e8

SHA1
84b98ae8bb7c5995805d736f8a58e457e9f43174

SHA256
841e0489c5e5d34f3e1a09fba5a4e62f0e790f1f78da7f8e447922ef1c919689

SHA512
06e72ea817ef5f91c96a52079cd0ae0f885b773445a71b989e671b62249b73abb0d7df1d9d04321b19ef4b9c236ab7c20c3835c2b887d0680e2654671719dad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
180638cda804506e31295b31d7a41197

SHA1
cddf4aa53b6627a52e38cb32fee620be8d8c3416

SHA256
a6e4737b06e4f8f6372b48964c9ea904a75fdcefea9f443752801bb128d86eb8

SHA512
9dc55d0afb9023b7ea781c7c1dae1195f4c4679de4f3f14d1da59363672ae4e21addd0e1ab7eb66523ee56032d1b6bab0d806fc4f26209260086246e054774ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c87812b87c5098bfdfc374eeb09bd0ac

SHA1
8807c6d0f750cec89a1a26fec100d308981fe2c7

SHA256
9c13662c88045e3905364efd3aee01605e37d0d0b02bd90725e27dfe81f89c69

SHA512
1df8881817d49c14b66a251713b76256f16e164c48738c151356ec622e0976b134c75fc62633d3fccbda87955d3b89e00592a125ac27a274910f1ee6d18f1de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
a835bc88c0627717f289b21328be7082

SHA1
8f5e1180e31f946b89cc517f065c161d4ec41d0d

SHA256
fba775c8366bca92a169ab02b4b9238b9b0763892a39a225ba19a840b9eb0606

SHA512
46b4d241af631878c62b4129dfb948575128e69c88760b96dbb017348e7ffa039ed0e5f76c8af33acef1c5354ec55c2b629182e2fd246d02e7052d4be073b0ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3fdd5b57-f972-467e-beb9-8e6e3c73c371\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\99efb571-a927-44e4-ba75-2a6abe02d722\23f39acc884671c2_0

Filesize
2KB

MD5
9115fcb600c1e008df160e09dc77fce1

SHA1
a048bdcc5c40de6d71732b380ff4085ac2d6d184

SHA256
d99ad30eec89f3a90acf17893d0a0d35b6ed9d3d814766b57e4bc5bbbf408556

SHA512
2b87ba2643e6233863026e7620eff5924592be8bcc9a0b04556193d2a5e896486c0f2e5aa2c53cef6d40eaeff159fe7e6e8628f1d2e905395fb1d9d93d3921cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\99efb571-a927-44e4-ba75-2a6abe02d722\index-dir\the-real-index

Filesize
624B

MD5
48b80c29b5dcaac5d1f8c21c1332c4af

SHA1
708a3a9d128c1770cb3b26105676d591a068fd12

SHA256
e704d53dd5b07684b9cd6eddd5c826fe7a7b0843b93241cc29a2643769708962

SHA512
094a55674b74bc4f321c3457c9dffbce9554052f6e5c5af7c40cb5a04e167f746c01a509f90cf21d171e96c2b78d4c0fac55b54d44b33b5a76164fe43820b06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\99efb571-a927-44e4-ba75-2a6abe02d722\index-dir\the-real-index~RFe58466a.TMP

Filesize
48B

MD5
4532a618f906331422cf212772ae5b09

SHA1
a5ad6e3b30b19f7d6e9a306f01d20f2285edbf0e

SHA256
cedd74f07f751bed92d52ab43d1907f354c0760376a209039f9474dda9e67ea8

SHA512
c1f2b85f317f4f6b2d5e579a68bccde85112629c496ae4f41dd0217835f8eb8297e5ef0b48d65ab2927b2b2eb22b5f3c44eef8de00c25390e48f0038c793e7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c66bfae5-1843-476e-be6c-bef1961b5f5c\index-dir\the-real-index

Filesize
2KB

MD5
81a9c8d26fa2db7b30c9d2495c4b67e2

SHA1
b62712457142687418283a05ea7b4b6124c6bb4e

SHA256
6a1ff082a22477f6bd5956e5d171cd4e875e629688eb096f6333e650bf7eabc3

SHA512
af284d6beba9add895009fe29ec1daa7be08d9f6fcf8f83bfb5de72c5ae50bfd54a65a777c4661ffc1c4503c8c4aebb7f6899a54b121ee0ef828342248b37069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c66bfae5-1843-476e-be6c-bef1961b5f5c\index-dir\the-real-index

Filesize
2KB

MD5
eecad2a02631cf521f1482c1e87cf11c

SHA1
8bf572cb7b7ffbb69393ff74a809673068eed2f3

SHA256
1873c3dc21a2647d85fe0b2696f221c6e83fc0d9d08aa5961de2911a671cf43f

SHA512
f18490d034e5757ce4a9c3da49118a2b2f68744855cc3e863554851321b045a9b9d6b1e07ee935fb52a4aca36dd3b5c9d4a9dc18701b7498e6194d3f18cfe58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c66bfae5-1843-476e-be6c-bef1961b5f5c\index-dir\the-real-index

Filesize
2KB

MD5
8d7e4e782287be47cc4dffe648231fc1

SHA1
f73bfd60d6f4617ed8467d39aa344d36fbca2724

SHA256
97c732ab0a1ea1dab3a65be0dd04c01e6b599dcb04bf07c8b89c9545972b8c57

SHA512
61daf255ef3832a58365ecc99bf86b68bd4c892919c1e66f21883907b693e1006abc4fb785a5dff91d6ebdae4fcbcb25494c68baca2e23eafcd28d8a6c23a9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c66bfae5-1843-476e-be6c-bef1961b5f5c\index-dir\the-real-index~RFe57e956.TMP

Filesize
48B

MD5
9c043f9826bc749447d0560bd0563583

SHA1
efdd4f1cfc03137c812714d843894d2bb62091b4

SHA256
1786717e4c2f24011579dcf082b8c10025f4a0771fd21ee50f67bb67c44cf1ee

SHA512
1e8a3c5ac8fbb54112863d2ea80ad12fa612c636dc510e61b48becca2bdac6cd9c8a92d31d7271d24f8ffa5ea1c5ac01539b5fd8423fb0c820a9a384234bc971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
c5d0a697b37c8d4c6b27c04866ef9dbc

SHA1
b2aeb22cc43f3ed37162a3407d613d3ccd4d7e1c

SHA256
9551a845f951fad23d69b9b1567e9a8120234e5b6754a6843a35a62a2336b646

SHA512
052d8098263215e7ab9e67899ae5fde3ece722083357b429daf04b4ae9a9fb22b1c0f76cc541fa3b4ad526d9a6f577e41c0f964ffda2c92ab6cb55720ca1ccdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
003ea1413659d766bd79258d7e7f4883

SHA1
38e078b889c5f8b1f1a692cc9a8fb53f8e1870d7

SHA256
b2ee9a398f09833ec7ebbedad817c2d572e4103a26859871694b3eeab58bbd2a

SHA512
ec42147dc02ec348f9a0df650ff19e490cf6e05479ab5259cdd66af281a4f273aa7499694f037ad22c7adaa6e3c4df412e5fb19cff39bf1f3ecbc800205fca43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
99736253bf05b857477dd18a61449252

SHA1
29e66f0f863ea91b32a1482f5f37bc839a9189b0

SHA256
09dbf5be68be9d2ab8c49c12fb8be495279e927950f5c8745a0c07100e9f3ca8

SHA512
ddc8e585769ec754d47f580229da47289bf46c98246332cde5a9eab5431cfe92e2f2112e4d19698030b725b8dc68ca30258af4ab58db63c84266e3059921d904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
d7cb1ab94b542975a50e3a49a891e521

SHA1
2f421f88eb38fbb66547abbe3fc6d20c909132c2

SHA256
4df70d7f964755f825f3ed651f65f9dfebcfbc7b5196e748ea9a82c23ddecf94

SHA512
2935464f68607c00fd921c07c8fa179bcf6400828db340b693cd26378f6b1cff20a942681dc396631a74d915c7a0dd876f4060decae1fa468870d311326744fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
2b0e67e78f1f020d790cff4950da0a55

SHA1
06fac656a9e97942140650d2e72973291464d9f1

SHA256
d6f29014999bb9bd7151b669397b55b385974871aba86f3969acf620076613e7

SHA512
84dbb4e27b1dd14b649d1ef2b6ebb05d73d689948ccb6161b9448c79e81b017d6bacb2a21de4aeafbe216e7057dc5981ccf9ad73c9d1c1477ba1d916301ca8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
ded35ccbfa427fcd2c7acbc5aa3fc555

SHA1
201e7f2d0a77d4f6a3a03f9bed07e803c44073ff

SHA256
d26654c3214fd38911a3bbfb37237d5d5935768f06929e29151cf7adb7fd3c03

SHA512
734ed69ce0c9a0490c6d5ea4d364ba436fd075af5f22cb0bbf753bbbce37a68a7d8cb56abb66dad98e26fc601b8d1b949e0779f8d3e424ee46f6615149792daf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
87db0e1a972dd6d7fabbc97bb282bda1

SHA1
fa02677272826f6dd1ae202e6785fe4b0a89dad2

SHA256
1f4529549f402f09a67ee0f5558d62cd6a3dba668096219c9778294e3910b33b

SHA512
9b79d3266f95f0a30893eaed3ef224872d1f5e18dae7be653d481c8eb274077b6be2163115e6440874e6a39c4bd54338c4f84a9938a655aff0ad469e0bcc566b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
64a7cb7bc965186610364e907ce24da4

SHA1
010364038588f41d256f4e4cc70848f2705969a8

SHA256
5ab35ad30e52187fc24ee86d975f6ed2f105be49507b1284ac587539914468f0

SHA512
0274ceab9ba7e6036ecc601f53f2f04cc1cbe9d0853e371e6f3456861aeaf5bf0bfbc00da2ed70ef09d997616333946dc6334d7f8d7c1a008219a6d667608c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57cd43.TMP

Filesize
89B

MD5
0c7027de4bcd82cd9bcbecfaacf82409

SHA1
9eb11640c4437388bcf77e3b81cee99b00b24303

SHA256
d36b3759c6e02b978df9db4dbdea43ddd0df11aa3a904ae3be9410585d2df6be

SHA512
974f1444e0a678ebd79b17d263917e752cfbd3d38c49989dc04a9120af5a31f507f2072889472e6c7d7ab6c12586780d6855240dab2de87e9dbae0ea6efb88ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
17KB

MD5
5f3b1d92ade441b65e4e515d10b10667

SHA1
2ec261d732f4691b4dae4a0edf6ac764bd11290a

SHA256
bbf3c57a5981d2c6f05d902860dfbb134c1b1afbf60a5e7a692be165bcbe2a11

SHA512
161a509ab583379688205f13342891ba635fa209f8f898ad1ae83fd11ce4afb335e2845127d45526a80165ca4d5f08cd3495846a0b7d29f7a712f45ce12b4b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

Filesize
163KB

MD5
8030a924d2ba7d020d018bf96c15e89c

SHA1
283d3274578d78d5604cab3220fa14d2b9ac5eb6

SHA256
71da4fba6196e1eee941e1f56c941cdcfcd422b5566bf93fb0f464bd9c67234f

SHA512
cd8ac99ebac68c8d7e755ffcb3896cd6a583d3bd09f81340bf91bb4ca7d8cf2d94693d72d2f08c939639bd8c2ab580e69a2b7012f01a13aeed7aab0e196ea54d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
144B

MD5
5279c23bdbb945dce362e97d11bb4aa2

SHA1
7db12f7390a6685d6e0e562999feb9e290b4da4f

SHA256
aac1b8b6f06278d7d13957c5ebe86d57b7f0f286801326d88d896da56b1175e5

SHA512
481a462784807a249e85aefbd82fe7e5022b4b9d5f4a5f641275cce2bc5ee0b16268393263215418fb5bf4b4cb4a0e9e9263bd8ac77453674ac434808e33c35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
b5d709f78bb09f9a9c290441f2bac7b6

SHA1
4a1879cb8ecb117230d00d35eee02091adc63112

SHA256
55bbb0b08a378db9fb14aaf72b83b01a7130f30e599e767f9f76adca24918817

SHA512
51f333376b48461250dd5375841b05c8384454b0b973be5f618645520c3078e8e3716d0857c59f2b61dabad6d70866600b7ae3d10563cc3cb3234a6c4e112b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
c20a6c9da1f2ec7d59c5a2282413ae53

SHA1
caa9eaf9f5270fd14d19779ee8a2423513456d52

SHA256
51943a31d705cc7b8861ed268fe750c3ff93d47898c6985fd45a86920bbc6739

SHA512
cd3a794e50177b2b2e01dd7e7462091f04feab08a7b4321f902e835b0e07ba57d14dbf3d21fc9ff41baf5257c17358e5c8b7fa3571a11d13b0604cd661993062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58406f.TMP

Filesize
48B

MD5
d5baaef6d24969de5883f16df2237c43

SHA1
2ef32414d9ea3d9eacb5c56a2e0e261324b0b91c

SHA256
9bef6701061e481aa1a2af6a34742e227640a873423e66fbbc2859a4e3767738

SHA512
701ef7cd69b8fdef145608f79ea14a2f9446647b672d47e160c3dd345177df5ec6b62cf0bc1f82dbb42a9441e7902eb022af4d48202b25b6dd7d26c202227c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0addead72578f9bc8b69060fdb03d12c

SHA1
29943dd7aca6dbb9b340b084546f91c63055fb97

SHA256
93850348522223877d10ba7937ea663c2fbb0df5971d18518224a721f888ea85

SHA512
5c741aca238f160e40149d87e6e0d32f824656188fa392f4beb631944986edbde72d63aa2ce831e40d03e7ac633eba53b51b03a7eb038f91e14c57b84c3b8f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
36331a54b57e75513bc9367ead95fc26

SHA1
34358448925fd52e3c50fc688c1a2256644171bf

SHA256
a65a90803685060d2b1cac5855a8f78a85fbfd2562eb86f4c7ebc7e1f4ee3dc0

SHA512
3b09896a5d7560aa080774dc28160f4ec620b9bea427a2c530c73cab99294e88b3953336eb6985b5ffcfb0bd2eddf49255106645d1ed904931dc25a2f9b6a97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
59d82600b81be68ed33754c2992c8863

SHA1
4f9b748c990ac25da62283dadc8a577a1e58e1a6

SHA256
52052d9748c5b2a5d0659849e3f965de97b8d3656560e58d992161496a3f245a

SHA512
ec36474bd961f289dbca6cb1524d997b66f8f7309bb23c38f987575310f1c079d17bd696c8b262751780c2f251561ddd4e806a81958d6925bf4040f4835cf81a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
c4c4dd95ff257150c394caf23c890418

SHA1
77492d45d46f459b2ec191526c566f8e44b15079

SHA256
e3f0a8cf1b4bd3ae2aa6bd9005d88eff544f0b4263da3a3a17aaac46ee522c63

SHA512
9b2405f407fb3aa269ef73e3be494066f8f7f18fc6076c6696eab9b32b94436db1a892863211378a2887163a35a5f0cd68820b62d0098d02316d1df733fb542f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
90406c6ddb315807154049ec17171fd5

SHA1
a002103084e9e42fc4a9969ee702dd7b217e7813

SHA256
54ba931e70d1e827c800c0f5d724dc608f33306d8c260a2f56e7845d0cd99a74

SHA512
020bed67f9c640c7cd352053a9683ba4fe6e92aeda878adf2834673a95a01aa960c612bca8d8d5a66fc9045ccdd09d82688e14726375b0065f010a10fb5431ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f5ad21473df33f7fbd5863618c5e74f

SHA1
257881c8d45c924388b22e0188c3ffdfcdee44aa

SHA256
437a9c4190c8e5595eaa2dd8e8fd4288b07a12a770e70c5e26f746850ebcfab9

SHA512
50d1c2e123e9815695a0b7f940e70f4471cf61756e0e4e22edf2c6cdcacf06aa90ced3b1cf5d76b15de119e2df2e13f7c0274f173b1132ddccee99659b1fed3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5811ed.TMP

Filesize
874B

MD5
da852a844639b621000479634c744a03

SHA1
7ba034adb417cc159b6d1bf40bfd3c718fd6d921

SHA256
ea794f56c894eb4865441c0498fbb015891de7bff02cb1be23b2e48c0bbb5e26

SHA512
696cc1b4ef65441b124695757a4eb17dabefa244859d16e94aaa40324ad1d899dd0a9792cbd76cb7e1bce3285e511078b8845125b7788aed7babbc396122a1d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ec4cdff0fccad6401c9f06a20cdf27e

SHA1
b1b2a40509ebbe648fa3419587144b43c80e7fb0

SHA256
86f7b0c7231ab315e357d6903bc51b1feada4895f5cd546b233e6ec783ed7917

SHA512
3d7dc64602be461e6fcdbcee080288479eeaa2f73bc940637e7414adc9aefccafc141afa9d8f06c3c1587217f8b0dddff3c47c6fdfcdba1af013ee23ed266590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e3e49174a97e0ca21346e31bd08cd37

SHA1
af718025bc0db7a9bfb6c25bf970715b6d0086e6

SHA256
b8fe5dc341233595af70de754ae42e0b71d9f9b5f832cc6110dab2c9f73ba7ca

SHA512
006103bafbe526d50bbe33e431a1adf25f0e2ba820d76e376995d1b72a9ecb5ea4f97b86303d1519c7cb781ae8c61707caad58c1e40df1cae999565725a9cded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\231667\o

Filesize
450KB

MD5
b1650ae4650d1cb76939f3093012f635

SHA1
a5009e06b8c7378b3b6ed6fb213509e8a81fa8f2

SHA256
5f2494ef5ec9b36797ed3e64bf3b07fb3fc649c6dcc1323589559ef09986139d

SHA512
47c0f2b28c1c66c34704df8584328e818c0775edede41fe1a1f86a600c092c85ca98b0f0d8025dab0b9eec8f9ccdd052cd400df25803a4134d3eed23f3a19ab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Belt

Filesize
56KB

MD5
8cb556fa55c7ccbf702f58eb6c726256

SHA1
8ed4c8f09c56f5838dfc221cdf354bd45e47eefa

SHA256
d7b5702f99e2a0e01b8675822e1bc94e18ca437e717ec3a56fd3f380bb2832a9

SHA512
8ee315412cefb788f547f65553215e92f48a8690ba998d56182925afacce71806d3f980b0db024b99465fdc628df6615dad4cd9519ac3f4b22a28f983a5484c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Brighton

Filesize
44KB

MD5
bc6a640a07a2271748864d4f9a9e99f6

SHA1
b1760dca7de014a9dd2068275993d545892c7772

SHA256
3a76245f7634b1d4e60ebf5978bd7c0ac44a292c13c1cfc28e3209b35cade15d

SHA512
5ed016fbb8d063696020a04066ca5482de80bd3fdf95a5003d1b527d42c8cd896162a9cf8fbcf58eda2b7264d09a9bcd69829608a655807531bc37b7d3e4aba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Camcorder

Filesize
1KB

MD5
e7d05679f98fd92b62e33b3ee5b1eb2c

SHA1
297ac79aeac6ae199cd320c5994fc81f60123600

SHA256
8a08c50536958b5384f70f1789c33c776ecadbc322c93e23d94e3995c24eb780

SHA512
4e00c886ea17cfc0b869e6d8f454bfd6e84cd3c2908fde1091f7cf318d90243a1b4ba237bcd8e626d2d1a8e56d945af3d2935dd98672a624d31e34752277f307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Capable

Filesize
139KB

MD5
1a4907f94055795c54966408332a1a71

SHA1
f3ebe3924aa97981c4ab3eab77b16d99e0b8164e

SHA256
6ba1f3c1e378b23ecd3e252a1cb771ab940a09025a8965f0b102ca0ee1654851

SHA512
8566f4abeb92a2dce5ae8c8b99857da620861e19b1cd9e3278e9bd3ad84fddc025b63726fbc5bc1c8b1ba462ecdc0f2c7f47e815c0724968e0f97e76d4553b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Central

Filesize
147KB

MD5
96d4622d5a64471be3a9d8b61d31f6b4

SHA1
2d2dcee68daea366b4128d6826dbc17730ee2fee

SHA256
572150ce38d8a651d95073725b56a059bdf4efef7865cb2aa3f6ffaf92495632

SHA512
0782bebfdb067ec73e8517af5cf84637444fa42287c122f80c6e6390b1e7ab447f91940891e366bebb732df944d9e645eed643b139b951d2e42ee5201b32d9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Com

Filesize
50KB

MD5
58c7a0b1e6dfba93c0f0d079b18ad3c1

SHA1
091d7f55e57df8c8f308cce4edaeb375d3b04162

SHA256
013f091d00344bba0b3dca110d87e0a6585095cc75351ed2bcec9cf3e2ee2ed2

SHA512
34b984e18354d1ec74d6faaabb6cc538c09004a126b92ebbec9e0a88802b56e684968d731b500b716edf0dacc7d574ccca8dbc2cc9d310ddb0db29cb498bfe56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Demands

Filesize
73KB

MD5
022601886b7b77d3538a8f051e1f0330

SHA1
162749d2e26034a6b25bee1336a8668c601a72e1

SHA256
8f75ab5880d446122ac8759008d6cad6b966481411cab2eb38d178145a314252

SHA512
cb167dffc6fbbc70a1252e22d6866df5cd3f075ceea5411b0aaa86bd3d7066325c380337c14f350455b996407d7ed9c185bdc9d80d946bd71d4a76ef13138c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Endorsed

Filesize
54KB

MD5
58daee8135bc2d6b7e9933c969ae1fff

SHA1
c0464122f7338b31397669cc79474ba3997f70eb

SHA256
7f02795f9c19c27eb4eec8b509631027d6fc5f24f766dc26c7446027d95e80f0

SHA512
eea1fe4b961df1369c3e78f9914f36764cfc7ea2a68213c4c37c6f5281b2c67cb84e57f7753502df385b9062beaf3a9e3d431145b366c35189bbd3507707a812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Expenditures

Filesize
72KB

MD5
651a00d1a49d91dfa91db25b259255b4

SHA1
8a917d8ff0f37d0e32f3bbad160f1755f2d1dfca

SHA256
4f0926950553214be9432eb4576589f10729656ef4292c7e90c107dacbccc4ca

SHA512
ec243fe3042b0f21bb5133b43f231a69124c697964ebe8400d7632fd1588def29e4b72edf8bc4f546f45715389b5a6fedb46566ae58bdaf06c5fdc3f22a5f66f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explorer

Filesize
478KB

MD5
0b152084d679e98467e3836f7cfcaee9

SHA1
a34599a5ac192abd34c40bb5108a4bd2d544a556

SHA256
582f63aadc204d6d75b90864310db33e8d25620f1b6ffd631af74d9af6c7313e

SHA512
b9eb658a3e14379cf007b38bbbe268589c1c65f9196fbb34061eba92f1cd49b4b8e3bc0fb2731ba3d2fbbb6ecb3e4cc8b9a22b4adae17fc7b098835d009a9917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Highlight

Filesize
126KB

MD5
5edbf031b527e206dae1f09df49e8902

SHA1
8e0985ecc512b9393ae97159abe4405f08defbf0

SHA256
d486e6bdba30c5b5c82e46394e2994be164bc93f0a0f6eca3d3e61fe0a7cd809

SHA512
d0eaeaf15df7f1883e1680c9431ab026599d5fa8e4b71f687523841203cd371ca7bc8228c930894bc0b4158e71d8c054dc6c3f44631b87881a765a947976a532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mfg

Filesize
137KB

MD5
c733a7bc5af986007e655dd1d86d1077

SHA1
e1b9b4321391e012d1088ffdcb2ba2e781f0535d

SHA256
ee1b59baf4a596554cb1a351c94d240cad30452939a2969423237df19cccf72c

SHA512
57ebc664758bb5d0cfef97524a9c56ce3b67028700a0e8d9f44bf57ee0bfcf689eff37c206b39474aa537e3e8ffb05a3d3e8a467b28d93722ea8c0f11a95fd5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Monday

Filesize
34KB

MD5
3dcc491fbb5eb2a9c870f9c670ae3dc6

SHA1
2ea0c65bfa39d086f6dd3295d367d1205477f010

SHA256
519667eedff03dfc0b0307bcc62da00e5e406170d11f1bf0f897d277c1889ca0

SHA512
1c33d26f90a7095510de563a394248680bf71329c08ed788f04d17cc91e2e729e7b7877a28df90e1d6a19e00e7eeb8d564ed73bdbddef50824a4d194d97ce85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Paid

Filesize
120KB

MD5
7ca4bd7840da4bdd697bb00fdbadae1b

SHA1
c9fe6dffb7f4442b7cacee7049b65e428acd8635

SHA256
34d7a759b6e0b03db228ea1fb4fafe2db0ff86e82376d7310fc0271a9cf30b78

SHA512
6e2455b63c59467063027025893375d8f97d39da93a42e813a03460bd896639a636eb3b017a668226cfe39906228174fd7e9c694e12a49c66e6faed715f2c72b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reynolds

Filesize
12KB

MD5
61ed71494ce1ebe389d7b65d4922f852

SHA1
6ec924aa26ab05e4ff0ffc713340b579613d3ee4

SHA256
7fdd1a7378bae3dda50b524baf25d822d3d269fbcf694dc7eafca79d527a5b29

SHA512
81508d970521fb3f0b63b2a7da352ee8631f716d04db45f27c2663e3eb86173d5c1b36e3af977917f5c883f3dd13c1920dd848a22b70f2f462aab0913d21eb47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Text

Filesize
98KB

MD5
985e92145c0698976068f911963c075d

SHA1
6482ccd430f991cd4d4d4d46a980c61aa6e3c745

SHA256
904e5b7f1825922e77a7b6a5641b9db4ee635389e83a216abe1098db630910ec

SHA512
c99d112e542f551fd5c99f306300ed45039d5e23f4a9b05ee7cef88d25358090240b9f5799d56557fa4b02870c3c7685042b33f6b235550a94102fc1f497aae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Told

Filesize
88KB

MD5
adf2a491b10d7a553a1fb41cc27e29e1

SHA1
e48e94ba3e291b23f3786a7834d625995deb75a1

SHA256
6bae9fa30ae57e2786d0d291e48d8e972486b07b744aa869c32a6393670f25b1

SHA512
628f3bf3617f9e9591df6a3565dc65e2b5635ec0edbca3994459f845eff9b9f71abf6846dd94fcd9e2b62100036bd426be56cd7c8b27a124928a04aee534e822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Workforce

Filesize
62KB

MD5
2486e65b5795633e448ca2e4df9b1e95

SHA1
edbc88ea0e5bfcf8e027eef5d20daf49cbcc8989

SHA256
8c02e3dc0912019ec713eef99ef56e7a0f5015dd01ca3a44c44b608875ddbfe0

SHA512
61122aac4278065f841f552059c60c5ba09dbcad13ca658c4157da450aa6040956b5c936b1aa858ff5d9404302abae6d4302c9ee2c35dfd8b4ecf54bd44313a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
b49d269a231bcf719d6de10f6dcf0692

SHA1
5de6eb9c7091df08529692650224d89cae8695c3

SHA256
bde514014b95c447301d9060a221efb439c3c1f5db53415f080d4419db75b27e

SHA512
8f7c76f9c8f422e80ade13ed60f9d1fabd66fef447018a19f0398f4501c0ecc9cc2c9af3cc4f55d56df8c460a755d70699634c96093885780fc2114449784b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5c01ad\Load.html

Filesize
2KB

MD5
1757c2d0841f85052f85d8d3cd03a827

SHA1
801b085330505bad85e7a5af69e6d15d962a7c3a

SHA256
3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35

SHA512
4a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5c01ad\common\js\common.js

Filesize
45KB

MD5
87daf84c22986fa441a388490e2ed220

SHA1
4eede8fb28a52e124261d8f3b10e6a40e89e5543

SHA256
787f5c13eac01bd8bbce329cc32d2f03073512e606b158e3fff07de814ea7f23

SHA512
af72a1d3757bd7731fa7dc3f820c0619e42634169643d786da5cce0c9b0d4babd4f7f57b12371180204a42fec6140a2cff0c13b37d183c9d6bbaeb8f5ce25e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5c01ad\common\js\external.js

Filesize
36B

MD5
140918feded87fe0a5563a4080071258

SHA1
9a45488c130eba3a9279393d27d4a81080d9b96a

SHA256
25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6

SHA512
56f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5c01ad\common\js\jquery-1.11.2.min.js

Filesize
93KB

MD5
9aecea3830b65ecad103ee84bd5fe294

SHA1
47ecdf62eb3cf45ba4867846cb61afa70369d23a

SHA256
a271a3f9e3cae897ced669d6652699e947928ef095e56384c4f9dd04bbb942ec

SHA512
754c25b5fc6a3e5d2027326c6814f229f9131396ea026a407dd16d092da6116bb0ee8971417463ba68268098dedc182b6fa10060ddda6ce063a5eca94be3c152

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5c01ad\config\config.js

Filesize
5KB

MD5
34f8eb4ea7d667d961dccfa7cfd8d194

SHA1
80ca002efed52a92daeed1477f40c437a6541a07

SHA256
30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d

SHA512
b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5c01ad\config\installparams.js

Filesize
564B

MD5
7ffe903488908c21e7b68296a257419f

SHA1
021b079a0351fa0e1885f71dc72ade6cfa0eb515

SHA256
e32ac52295e50f742a70c825a903f43839798543b2c43759319c365562367a87

SHA512
9ca0c517dc709b568d4d71f079680b3e6d5d3eba4562f7831d160338f1c9c1e134f5577ee198f6f766f07877dc1b97527e594a1ce210e5d8ec3a1b6be5077bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5c01ad\config\stubparams.js

Filesize
37KB

MD5
91f6304d426d676ec9365c3e1ff249d5

SHA1
05a3456160862fbaf5b4a96aeb43c722e0a148da

SHA256
823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b

SHA512
530f4fad6af5a0e600b037fcd094596652d2e3bf2f6d2ce465aae697ea90a361a0ffcc770c118102a0dd9bf12ab830ac6b459e57a268f435c88c049c127491f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 20838.crdownload

Filesize
2.8MB

MD5
6bd2bb0812c3d8fd1145edcb858f2a61

SHA1
2db8b507aa366ea6cf5b0d4935a19514d8b9b1a7

SHA256
e0a55a8a3c8734d832e04640fa55fc41fca7e6511b7a69262cbb13273594652c

SHA512
5fbffb6feecc0a2393c3cd09d240fb6e8bf2a860155e9271dfa19ef6bee27cd1639bb0adef04a8e2a462d4c23f5b245bd98a874c90c20f9cf35766245e55c3e4

Download Submit
memory/3272-1753-0x0000000000EC0000-0x0000000000EF5000-memory.dmp

Filesize
212KB

Download
memory/3272-1754-0x0000000070790000-0x00000000709B6000-memory.dmp

Filesize
2.1MB

Download
memory/3272-1810-0x0000000070790000-0x00000000709B6000-memory.dmp

Filesize
2.1MB

Download
memory/3272-1930-0x0000000000EC0000-0x0000000000EF5000-memory.dmp

Filesize
212KB

Download
memory/5824-2034-0x0000000004790000-0x00000000047E5000-memory.dmp

Filesize
340KB

Download
memory/5824-2035-0x0000000004790000-0x00000000047E5000-memory.dmp

Filesize
340KB

Download
memory/5824-2031-0x0000000004790000-0x00000000047E5000-memory.dmp

Filesize
340KB

Download
memory/5824-2033-0x0000000004790000-0x00000000047E5000-memory.dmp

Filesize
340KB

Download
memory/5824-2032-0x0000000004790000-0x00000000047E5000-memory.dmp

Filesize
340KB

Download