dharma | hxxps://cdn[.]discordapp[.]com/attachments/1213587833852399626/1324736758402777199/Loaderrrr[.]rar?ex=67793cbf&is=6777eb3f&hm=c05a85f90c27d945c6cf25e7ea24783e87f58f22626e4d68cc0f8ac9668baa95&

Resubmissions

09-01-2025 08:27

250109-kcm92axjep 10

09-01-2025 08:25

250109-kblptaxjcp 10

Analysis

max time kernel
342s
max time network
336s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-01-2025 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1213587833852399626/1324736758402777199/Loaderrrr.rar?ex=67793cbf&is=6777eb3f&hm=c05a85f90c27d945c6cf25e7ea24783e87f58f22626e4d68cc0f8ac9668baa95&

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (558) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe

Executes dropped EXE 4 IoCs

pid	Process
3852	WinNuke.98 (1).exe
5544	WinNuke.98 (1).exe
3064	CoronaVirus.exe
23304	CoronaVirus.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3973800497-2716210218-310192997-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3973800497-2716210218-310192997-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
114	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\rename.svg	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-100_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-64.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-40.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-20_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\x86\MSWebp_store.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\AUTHORS.txt	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\hyph_en_CA.dic.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\EXPSRV.DLL.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\FFmpegInterop.winmd	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zy______.pfm.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintWideTile.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.scale-200.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\standards_poster.png.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected]	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-16_altform-lightunplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\PREVIEW.GIF.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\ui-strings.js.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close.png.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft_WebMediaExtensions.winmd	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-48_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\customizations\customizable.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Data.ConnectionUI.Dialog.dll.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\ui-strings.js.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.id-3D8F25EF.[[email protected]].ncov	CoronaVirus.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98 (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98 (1).exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
18456	vssadmin.exe
13768	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 890903.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 645028.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98 (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\You-are-an-idiot (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 14536.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4924	msedge.exe
4924	msedge.exe
3328	identity_helper.exe
3328	identity_helper.exe
2400	msedge.exe
2400	msedge.exe
764	msedge.exe
764	msedge.exe
6072	msedge.exe
6072	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
424	msedge.exe
424	msedge.exe
660	identity_helper.exe
660	identity_helper.exe
5272	msedge.exe
5272	msedge.exe
6028	msedge.exe
6028	msedge.exe
5412	msedge.exe
5412	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe
3064	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeBackupPrivilege	11808	vssvc.exe
Token: SeRestorePrivilege	11808	vssvc.exe
Token: SeAuditPrivilege	11808	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1592	Google Chrome.exe
1592	Google Chrome.exe
4916	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4232	4924	msedge.exe	77
PID 4924 wrote to memory of 4232	4924	msedge.exe	77
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 128	4924	msedge.exe	78
PID 4924 wrote to memory of 4540	4924	msedge.exe	79
PID 4924 wrote to memory of 4540	4924	msedge.exe	79
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80
PID 4924 wrote to memory of 3352	4924	msedge.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1213587833852399626/1324736758402777199/Loaderrrr.rar?ex=67793cbf&is=6777eb3f&hm=c05a85f90c27d945c6cf25e7ea24783e87f58f22626e4d68cc0f8ac9668baa95&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff989cf3cb8,0x7ff989cf3cc8,0x7ff989cf3cd8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,1263433505446025725,11058251744018057216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:904

C:\Users\Admin\AppData\Local\Temp\Temp1_You-are-an-idiot.zip\Google Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_You-are-an-idiot.zip\Google Chrome.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\f9b537259d984909b71226f31d3295aa /t 1128 /p 1592
1⤵
PID:432

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4192
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd1af553-7beb-483a-b3ec-6061e7d92882} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" gpu
    3⤵
    PID:1816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {947a9df9-ac12-477e-bd8f-d1bdcfbacb5a} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" socket
    3⤵
    - Checks processor information in registry
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 3180 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0050ee1e-7442-4c93-96a4-90ece732707e} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4016 -childID 2 -isForBrowser -prefsHandle 3416 -prefMapHandle 3676 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c91ac00-e49b-425e-91f9-432431acf86d} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:4456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4884 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4860 -prefMapHandle 4872 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78829f50-e4ad-4bce-9b90-2f44eef3a31c} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" utility
    3⤵
    - Checks processor information in registry
    PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 3 -isForBrowser -prefsHandle 5276 -prefMapHandle 5324 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ff18e82-af96-4045-b0d7-64b7b2bd74a9} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5552 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36532ae9-a5b3-4b05-b842-9c5bdfd26411} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5752 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75fcd219-a0a5-48e2-977e-795f23625267} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6164 -childID 6 -isForBrowser -prefsHandle 6168 -prefMapHandle 6176 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a06f290-5e33-4833-a068-862356b29379} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff989cf3cb8,0x7ff989cf3cc8,0x7ff989cf3cd8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1788 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5272
- C:\Users\Admin\Downloads\WinNuke.98 (1).exe
  "C:\Users\Admin\Downloads\WinNuke.98 (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Users\Admin\Downloads\WinNuke.98 (1).exe
  "C:\Users\Admin\Downloads\WinNuke.98 (1).exe"
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:2820
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:2016
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:18456
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:16356
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:13344
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:13768
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:14040
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:14440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,12818134898177137404,17381114088833513919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:23304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:11808

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\f12afa64786e4e3cb92110b8370a34ae /t 14516 /p 14440
1⤵
PID:24036

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\ca18bb6b80384297ba175d16e74b954c /t 14052 /p 14040
1⤵
PID:23280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-3D8F25EF.[[email protected]].ncov

Filesize
2.7MB

MD5
d4bef6f274ca66a0e38e9e2ad78221dd

SHA1
c30e863204cd81daa6ac7a377a06165f8a001aba

SHA256
9fd36e863f5b91d880c0aa25e2dc80384c54aef4ff753e43cd00bc8e7dfc1b2c

SHA512
b2808c6f27fd78a1b94147ee288576ac9bade379c0063d81c6e527053dd31df89f2da5f407a4feade9bd47245db0add5f52d48dfa64a472b8e00661b7801c06f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\489dc69e-18fb-40f8-ba47-2e0c9facebd5.tmp

Filesize
11KB

MD5
670ec031b835d25565af8a41c7099281

SHA1
4968dca9730d01600b41a2da3e252cc6a2a99fd8

SHA256
1b4d82cfb6e14b98cbaae73e2199b29de4feaff5b425af9ead0743fc7a857c95

SHA512
4693476b16c0f9f0ec6ae4e05bdafb53562cadc9d9e205bf6c8cfb91dac1d7d5432b9cb96566f72312a395f662b7d05647daf76e88a925bb50c0278bff95beea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
410fde919479d17da1105a828e6724a6

SHA1
a41f9f3644adadb417c0f9c06e17440bf3cdc850

SHA256
5ac15685d0d74bbe0baef804e60fef91dcf0eac76505ade260d0b4a928c67d75

SHA512
6b891b8f34d7304adf2b7f11f5d28561da4ef1a13e36ee55a7603b2af7dd7e453fdffecff28c726e717fac95fd46e8b0e9fabaef833e9ab25c237bcccdce8fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbd524450da966513985d564d0631433

SHA1
6d8de79a1e2e481b81c318167bffe72e4d8a6ae3

SHA256
475c57e75e8aa3b0ce3da34b7fa0859c897c3499b28abe316ec422829304c2b5

SHA512
c5946d42a5d32583765b922e34f7cdb9101ba672554fa9824705f224f101ee141ed170e5f2efc1f7946a1e28b6c9963347a98619211d24c96caec12693598ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
4aec0c1abbd648a0d355d7a06a0f7daf

SHA1
21c69bfe663c7b76c9448d4e78ecf4ed63940018

SHA256
42f69dd5fc269f084141e391a71932442e6804d9b0b5dfc745ebd7a8e1e4deee

SHA512
5bb248703f996bd409b19da4c8352abaa1357ed070ce87112b41b8c585ece96f1bd42a8ee276e7a3ab1e18d67ab3729b8e920c483719ea91ed990d7dff110c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
bdd3ae9a337355df3b6e944657d4e289

SHA1
71e5217a25123e6daaa92dc2b3bcc5b1dbb7887f

SHA256
e8c581aa50b95969672ede258e6b52efebda161a69030a0bb269c0c847f803db

SHA512
91863c70d08c68ed80aff2b3da5b71307c77bda48142f46a70312e411c06b45acb46d3a91a0bbec5336dcaa8894102e4041f22cf169fae573cfe527015d8961b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
99ec3065a3df4e19e7ff69cc4fb39706

SHA1
c150e74ab58f243f630ce80d794d0285d35e3cab

SHA256
1f6adb1c9ea1c9fe6183562765e72d86ee1f61b3795822268538f84d662a25e9

SHA512
9fc861754b9c5622665f7f165d1357bc30eb1ae973c2cfbff348c63518d9b528625c12d0daa8843960235badee3aa47975e88c5180c2d7ded79c119fc3121bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
27c33208ddddf273b2a7c73c509c1726

SHA1
fb41b15f9aa5b36b8a0f5ec7f61ea70882ca12ee

SHA256
67b7211acb408098e0dcd4ba9f57b664bd7d17c47ee502602e008ba12d688d3d

SHA512
e0a0a82f7e85e3fc42e32946f339c3626cffea5cd7180e9dfaf2b4094207685c0c04622e3fff52289db6e8077dbc56edca2d159201bb3816f177464e19962e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
f6488dd8ca574711ef6eab498ff2bf34

SHA1
690beaa7f70db79331633d83ce06f4918cac8014

SHA256
2ed066c30e8aa214d3963ca5c6a069164d97f9f894ad1c0072a9f9d747d41263

SHA512
6cc612d4733e4c7ba66a0b896cd7c798549d4f5d5c35285193ac1aa059a271d62d26f37ca528b11f57eb0186a9a348da6f611190bcf6fe25654f3aaed48652d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
86ed9a79d63f63f238381a75b11cfd12

SHA1
8ca79647d4680deacb1f1b6c7d14dbd846e3117e

SHA256
43cc665a69f8c9775f9d2fa0b9495a3b014155e8167b5efd166105f521394158

SHA512
85e1c1e946a5c5589ff431a6d617c0925c2516f9f01e8991e68ac01242f6498c14cd743856b0b8bbb9c34c94edda64776c6b272e09a7ffe2e7bcf193fd66483b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
378aa97c7acb184d2faa6cef65c237d5

SHA1
35755bc18481c5ac0e2194f28c1c46b055820130

SHA256
729c7cc04909981173c0b13156182044cad056c70195025062958206c76e4cb8

SHA512
5fc8cca599075e9349f3a17a68d0991fe63d72aceeaf273da5a678a60c36e89b3893993f1f4d50f8b44015ebd0b88ed656f7887503008b6905cb285dddfeb41f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
c2a77ae6537c4d7e1daa8113ea3c057c

SHA1
c9b79924f0f0ed1499a8b8a30cb7d7625c828e70

SHA256
7b547d122b4cdd71e69a01c18a3ef0e808e0dc026712b5fd082076260f57c927

SHA512
2b33f874d0c8221f3c438d45d6d4048644fcbdcdab81cf833b2df913bcf7d2947f44c168f7aafb4c79f2032285a4fc234d8f1e5fdf7e51d5c473cf4a01c9a74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
0efa297087a1af49ea9116423824c61f

SHA1
691439e7387ce186b657d39946dd00b2bc079735

SHA256
94b1daaca81d3b7e287be77e0cdadc80ebba3baa25d6d194d690fd82aa2b17d4

SHA512
895c72811d780b175d96e81031e081f7d239e73731ad08f54d1c3a05c7f2f4844438c887fa141be877b13ec64dae9b4c256d52edaab44c023d3fc245a2eebaf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
66cea98beeb36968f48d7b3d7a1e0fd4

SHA1
4ac2c8bf11b05d0ac0ebca6e4269b8692741b300

SHA256
643735fea10f1157b58bf997f200b5f5f5a4d268f2a280a4329fe864712dc772

SHA512
afa4e871aa16a1d0dfc990f627c4b9fb77e4477010866020c8deacb40aca33df886c98cdc4b00622ac328d9965da3cb530a80b3c7ac258f5a405098972e2e2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
d577d3f812bba55099b014c07ac35fee

SHA1
a448fd1298db2050c56c7a3563117d3992a73701

SHA256
6e88191c79bf0ead062049b44e6a240bb3ea291c5850860f8ddf9c18bea6a6a6

SHA512
35b3386740e6798ed19a0222a5c422e4ad821e97182c4165f6b2dae94461355a32ecd43735a0014c4f15169f38e5894ca32107a006f1f11bfa95b0fc0a3595b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
12KB

MD5
26d57ad49cb2931add6b00d8e7a435f2

SHA1
36e742ff9534e1fb663389e931b657160df7405d

SHA256
6224d6fa3f5e38953cf2379dbcac0389840b503f803aca06a968de46080635cd

SHA512
e465a25154e90474c99c58cdfbe8d419bed9f23ac7d911d1009c80c9eb758f4dc2357c0d77059b1ebcf2adc8567c048130a288473602d516f414ea5f031b4961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
55dd3cd7cabf2a8b6b3605c60d293da3

SHA1
7ec591bb96ef787fba6147503e037ca5f1aea59b

SHA256
78a4d759d40c35a28e524e3c9400686227d734e1aa3fe9ea27b9ddeb85309749

SHA512
534231033af571ff09ef2c8e73f66bb36f1f36f2cc2fe00a7a0dc1dbdbe3448ff39f9e3003c0ac28ce9938bd482228ec26e107f7c379f23c6b85447b66d2daaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aa92f689af5f3181877c2df4af3e9a4d

SHA1
68de1d4c1d2274b281301a7fe9895193395d2cea

SHA256
f91f290322479f74febbcf1b6e949ce59a12db2d2f90ffc190be21f1f82810bf

SHA512
f7302d010a8bc46da4f0d7dc998b9a24bd17941d84797affeab81f3524df44d1ffee76b658618889673ed9eb67e8a8e9263965d6bd4d628b62ac9f8fd624348d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4359c1fe031d6c7373017d3fd182133f

SHA1
756d0f1e69dd01e4ee3b076c4bcd1b08ea9c5122

SHA256
35a07d9c865a35d96ccd1507cfc67c6967b04668bc468ab152d3a5c7733b2ed7

SHA512
e1cb60091d3320dfd72d83a456ced5af46bb0b561cb6b415b8ebd3de38c7b362f348afdbac73419031fe0923da18b21ccd54ecc1b73694d5d9272747c5e7adaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2b71b9ae6ae47e62611d42187ef4c32a

SHA1
6a6e1d0842a63492fc739ec6226262fe005783b3

SHA256
d8f6876f55c20c48f1d004635e2051881d4c716b66724b61c866cb4f68f3bd9a

SHA512
72c30ee842316fd757e439f3506d33225bbda9a5b991073fecf0dcf3d287b01757bf4f39addc5ff1fc254054fbcf8d39179bd958100f252f431563b62c20a093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d7728c5215df5d5312b71ea64176c241

SHA1
850dd9ca68b949e77686d28a4af69273e803e5bf

SHA256
d0535003958c57fa4170f2e4018feeef536a1d1369c38559073dd506400b4c56

SHA512
64ee0d886dd33c1f284a09c4737959eac77079a18bb5893a077d856a2086a3a4f45fa763be9986521a4a0dc1798d5e1705287415ed146bf7fd6b8af1a208710e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5fdf756621662121116c551503bc4ad5

SHA1
3c07ab46b62e5da15dd7710c4ba5de612e4a572e

SHA256
04d62d23ef21a8f0a6aa83d3089cbf6a595d3b84d3e1e02902ca3140f1f68848

SHA512
33941e9caff0d52a26a178cb8d6d9273beb3e8efd1414cbf866e21006050d550d92dc25234d34d05257e2dca6aa5fe747d0f09478ed65abfcf47eb01b7db4e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7b3d0b67ed3e94fb151a9fafc90f6b53

SHA1
d5b746eb6fcb681b1ea354357d80f9f771aa2b41

SHA256
cd6539affb4cfa8b9ab15e1e65adc6a03b797afbb5a11ae376ee553bd0957e7e

SHA512
5bb647affc496a8d2eb194cb59525e6becea2358a50635d98a4d634d8a2d6e5262ee29fc8331242469adfd8c921f154923a8d3603798af7a54c780d94281ea69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dd82a9d0fee29c449d87b3ee579d143e

SHA1
e4c9c37c52ad97d858a3e12182385f5ea16b5604

SHA256
e08905dcf251b540eaf24b2a6f98f4a7b20711b57b96916e59939ef8216c5392

SHA512
e3dfdd92751ee6db75a266e3cb12d39057d469724f5945ad3e1ceb6cb974b001395012410db808d298d21e742965376defcffda7d3d0427af77d7b18831dc3e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8407ba40959a0c366a117813f70c957b

SHA1
227ae2a5f85528e3926fbeb6ee2ce4b87ddd5406

SHA256
41185036c2b243d41110c2652187518af83ebd9a347d3602252a6b688a5c2a8e

SHA512
73af9ede62eb37f0422a203b6296e2a46dbf1ab4903738f50461c2882c99c3f1a34d7e6a77ab31c102c6eb65e9701fe972f1bc01b0909e72752c9c9aa7574ac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8a209e66b74948dd51b3bfc750d0e1d8

SHA1
c9bba939fd36249857d15fba029c11895b175eb2

SHA256
bf80245b2568cef14202638ee581e64ff6e0f8a845fb5822789b81a87cf4b291

SHA512
d828841be6ce4fb10e9c45652a5cb3c98b70a9f4d346069b34d0883633de15c76b710af9702a6093bef2283455d023ad1039284545dac95b11a06252667355e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fc6f948e275f668c79265ca27986d539

SHA1
6427e78fbd7ffee265e3f5f14d4428fb0bba7dae

SHA256
5ecbe3ad88141bd1b4a39fc9385dc7459937f54234bad7fcf0a471b037c7cbe8

SHA512
e1f5d735e74794b17579bda6fe2a2e11c2a139a2231e6c40efb3f63c61359a801999d456e03b4ac8a6329bd795d26fdca3e9aaf0340ec72e70e416ea82a75045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f5a7e586fa46835d3598383b574385bd

SHA1
4a7f5666263fc1344ec0c5bab8108d1e0ff21e6f

SHA256
1fe096103643a9eee340dae96afe60015b281c82dfd5707eb89290eb320115e5

SHA512
04e9f49c370ca9aa993db7cc0755e15dcb8f189eb963777e14db81fcda75da26951d4a42470be39a70168e6038daee11f88e22306c5f26ccab2e8ab285941f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dafd3ad64fe54e6eee400999964f7888

SHA1
12c2ef650a4e37aef4ada4062b0e6a390f64e618

SHA256
816355a93d824ce2e23da01d5c1d375f8c845fc0a004bd7c67c5e926b22e88e1

SHA512
7ed5bd40bfe9370875fc06c54b53f278237c05ea4a1a71d3fb58c3af55d60f938144eef62bfbcfaf4120fdc27951055c38de025bfc41bbbfb402a792f5839d95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000005.ldb

Filesize
272KB

MD5
ff7d0eb44978bd383438196a40b9750c

SHA1
ace8a1fae5b3e8065025efe9849c225a7a048add

SHA256
08a8f51bbf207a114c6e9ae9589608c36143d27b67ee2168aecb9070a31bdedc

SHA512
54da9a5b04089d61f52b28c4154c209b39505220e4263ebb4c5f37311b65a1699d4b4803ce5126674920a1b1f74104f0746e4d5897466d30a0323a3737b761a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000006.log

Filesize
1KB

MD5
e3e39e9505c01986fbfc98e1186b0ad6

SHA1
af39cc5e6290477db8da0e100d7e07c53e90f152

SHA256
3d525c6dc2951824ac318f51bf6c04d8d9d3532fb33427e2c322c1ea4f5e14b3

SHA512
d721657a3845354918a8bf8a21e03c4fb3f1f954d688b9de89218de97c2564f8afedb3d9a3541be756fb93ff05ad01e46a1c5b70556a78764a7f5d6c4b1a856a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000007.ldb

Filesize
268KB

MD5
29dde73ff261bf26bb75aafeb543e906

SHA1
72f66764bf370125aeda1162611b7a234a50b869

SHA256
14c768fc2bae83b533c48f11f8559604feba924319a53eb32b3fc190b00d007f

SHA512
851a1080f930f4a846a83f1b597e9caa6b6d18e7b6a62540acf42fb0e8db3ed6f475b120b5bc49ff08e160927dfebbe391f502891b47d30377516f16e851f88f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
650B

MD5
791990fc925cb4c644275602b12c6d75

SHA1
b37d2b44d883b06a38692c4344cb383bc696b42c

SHA256
106f58d6ddd6ce24811b50949e4c03fb4714017d3979071fd9e5cfc12c57334b

SHA512
1004de217504d6d88c242b0f6284b7e0f61d042aba18352030a14732dbc7b2d948e4b508f91a6dedbb62d4788860f14cae3e25ca47bbb6a02f7abdc28333c76a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
159B

MD5
3fc31ff1e33d056ca7520917f2689dfc

SHA1
94cbcc9f1d7c1fa9bdd718b21592d5952eb5393b

SHA256
97dab17cda8bd0c03273e52bc392300f642fd58cdbc33e967a270ef5c215673c

SHA512
7bcfb7e28f13e8df292ea427ef3d2c33af3df4a2313b01d575542fedd0c98ab69197f41dfb08b8ca5d5a106ac7e6026c45e76a6b61df625d80fbbf21cd3ffa3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13380884863357426

Filesize
16KB

MD5
7906a1895ee96f2dd5f6840a5d4b1358

SHA1
1f47ed83d543cf3913fde57b1eb59d1ff06db986

SHA256
ec86882af954c4c2b93c04564f27c956ebfb8bd49c22413e790ffa9744c23775

SHA512
ac9fbfd3b681eca83ee7733480df7bb395b98eb9f88567f5c8939b8d9ed06a6534eb92a7e6fdfb1442e86a5455f2d6fcb2abbd5ce1f2cc7e69a5a1eecea3f306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
316B

MD5
8fcdbcead635818c5ee56712f5da5009

SHA1
a4e1209ed9059843eeb22d9e8a8fcae040ef87e7

SHA256
d8514de843e0337da63f1f8f2bf0c85621e907fbec236394932710a81dadf0b7

SHA512
73c064ba83803cc75cdf5163109373a8ba01764bc7fb2197f67d62ba4f02244be98ca00dc880129790e7016ebf35afe577a95d61e2a07ec62cbd698035cb6a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
db9dff25ed41f0dd2b8d85d0c7619cde

SHA1
863a2b3b61fe9e7f0ff6dbb138e61142fbc42ec8

SHA256
ae72c0c7413cdac16a6d64705b9aeb3f2b602c2315dcd6a070a34c76fe5830cb

SHA512
14f51b9cfb832f208491866923e5da9c0f6562df48e44275f5814f8ca78858f937a61fd4d35946797f624396e34eb3e9fd04e67f2d23234d174e8adfc5812b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
507f457a2b8dc50a6df95c4386d9ae20

SHA1
919e05f7f9b71d719b639a411ecfc7358fb9e2f8

SHA256
e561c4cdc7722f33a1ee877733985c6cf40aaaf7faf81bb9095ee4310565c53f

SHA512
e04928cdee16c9f9ed5c34eaf0c6c38be98163be27a493326539b16fa9c852c1d7880457cdc6cc11fbe2baa38a1c18097385c24d31c12b046d25881963bcd3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
08d3afd53d091cb2c651e65c6d4d099f

SHA1
9f3cd0b1024696f8a05179203e114032eebce7a8

SHA256
394697db3f5f6ec34f2b4cad465713677f60b334c75c27451e0dbff7662ffafc

SHA512
7a3a0fb1ddb15e858e379b19e224bad7dd1a784ca251a1d7424dac4e026efddae0310cfd64b7b05e90291738408a92308f453391fc0f82c683d67bfaf496c25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd9e04624e6cd351d46e939460ab8a35

SHA1
f7b7cca520457e72b16c2d7112d74da24fcf59d5

SHA256
8396e0a9d954b33e932a2cc64f69059c8b81427b8fe9fbc448b065a123f19174

SHA512
645d6f9ce1fd1f45b18b49df367e754520168213aba678dba29fd08dc5d30d0f45ceb8108bfa5bc49fdf0d25d2cc5d9319733493d5379f54c675ae646db7ad6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a13a7f8bf148b159c7831697b850693e

SHA1
977e07217ca39b5ac4079f015e1ddbd0c9bc9a49

SHA256
787464cfe83e4d5fc1ded573d74c7b7e8274619c123f86316848032345f88650

SHA512
c868be3912fb4e803939e3caf551fb0f8fe69d52265bbf7c53a2260bc1597d27bab0c1d861b7ef83bc57fcfcb470e994cac5eb2cff6d2c96d23cd8ba79f970d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1786f6b71440c86a4f83a5ee2a50cf05

SHA1
3c19d92f635d61bfd712bddb0f6670befbf831e4

SHA256
0ecad57e607c98c516266c0dc876924e0558b287e74f308840d210871924bf02

SHA512
343596858ded519430b3fb8e93a417b21a6ea477b9472c7c41c2d2c12f1faeb01ea188bfcf04cf101cf122f0fd7c4cf22ae5b2d85365ba76f8f28d1a077ceed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1403e2bedb123c923865ad70b8a0765

SHA1
165ba8ed80b14fec75915211a5e27158e247b8e7

SHA256
518de12218321df939d117d8b6dfe06d843f2fd47e3c12f170dcdd6706a73e26

SHA512
ced731a04caaeb4dc463dce0e37eefc48ae52807f60291bc443bd222ad8974b0a634f2c4b3a079247522d82c85270c99278a333949ae35d47c104af1b08f7985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ebff82f3b1b0b96822b9c5508c1ab671

SHA1
90836f23fcdbccba8ad86e7288c2907dfcd80945

SHA256
503ce2a168acd047a20dd083784747322c770fa9a7c9c3de1c81fe5e900cebbc

SHA512
cc84989ca4217d0654b4464787c5f25064663afda861ccc675223b8df3ec526552258c8c12d7a5920a024321af3153126331aef7947ff0f5c7c65cd47fbb93f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
597701d2150431e2672f655cba27cf63

SHA1
00817838355a475e2089ea70555c33ec899ebee8

SHA256
f7ea69b9b2269c4448201a1bb4e8aae5416877ebe3f66c00d27dc45ba36a7e62

SHA512
28b0204e29e2161a45de2d3530a441f5d29f8a3d7be07be246aad3364085347bb30a1ba165430842d45b67f6ccb2ba48a3bdb9fa7ef8694beacbc1be8261439a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
006f12f2f3cab60a3e6984ea9f35c4b0

SHA1
83d74bd1349d1ad2ed0743a3195002d219f2ddc8

SHA256
82a82c900866ba8916998abf5325bdae1d4fc44cf0ae1cfe6252ad3986fc7058

SHA512
f7ae06c533a709f557fa5dbbe39b36c82b52ea68b376a20b19bade3be75acd0b3c388d512b8bca9bd1afc1aad6e61b2f0703e72d604c6237b816537d8fa656c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6dc478bf7c9bc1f975d8dfaffe68886d

SHA1
89d63ee2ef7bad2bbf6f5042d83f38b61f5e6674

SHA256
c86b120c57ee7107efba4f96c4ec871a397fd99bd5d4da370d71af69dadf9087

SHA512
a5eca8bdbe3a94852c102396ceec1c49df7c79f7cbd89f53cad98f3f2dd402b7b94701f67d94d4354c291be8d68fe9b2680f346b375b01870a9cc4f3f98233d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bfe5.TMP

Filesize
536B

MD5
c4703bd2c8e21cc40a82f4639838c70a

SHA1
c2bcf3eec764bbca604c93b1a7f84ee509583995

SHA256
131650ef79d6805c551a0f4184cee1ffb560044a563da96c9882bfe3d0a5c9cc

SHA512
dd057f326a7b878f626f5b7caea82e960215a4499b422949b1ecbfc0e9d7754c7fee3af3c253ded6e1ed3a0a1a7d0e8bec5128575721a21ee9376ca3ec3d5999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
cc1dc2ef4cf6e049cedf9bf5b5f2b9b2

SHA1
6586375afbcbcb3a26c396d00556ff22154cef23

SHA256
e5617bb4a2f17ce76e7a3f3964ef1a8e80aa4825730a7043cf0d0326c7c74bbc

SHA512
a68b347f190a9ec5e92d127311989db9018d069f2f5c7e9a760e99154031a12e7c080d87c4b081acdedbcabaaf3ea5fbac8c08924351c105c235652f4428ed3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
9c6eac30ab99a8a40d07a3b47d400a5c

SHA1
e6debea939c895b358a8c439f55fb50b13a7f65b

SHA256
6a83e11ae140c52f6c0190d92c87edc9ae70100604c7fde9ff3a2bdd645ba5eb

SHA512
d6181e532aa8c6e85ad7e27124b48b1ea0e5d8c951bbddf8fdce5358b7ee208a8b2a963666ebcbb10301073891983f1e32c21a0f8d9955a9b6874b6894a6ab35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
00f700220d47ef8a2f26c0929ef63369

SHA1
6d3078b87d3229eed3c832c2d2328e6c7d7961bc

SHA256
e4082f3acd10dd1683c30924ba229039cf8a9c117d2da5e80dfc254bf62c310c

SHA512
90574433b7557d87abad7eb3a266dd4ff82d86ba7dfb5a3ec37b6dcae8cea715ba518be0dc91c4fc5210194e29eadb812480f81c55ad09981830ba57d19ece50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
5KB

MD5
2d84b16d24c0011f30828c4bf7b2a993

SHA1
231fb87fd633a6616636e8fb625c895450def5be

SHA256
7d22fbe231b6f4b95754f62ed73d31abb2ca17728735bd59f5c3f8abb95edd97

SHA512
c9925e78438ade2be36102d8f2e600e0100b5f7c79efd2e6d881ad0485e9b26dfc9e2264e1e7b8c4dda44e4d786f217990343d03e18905658a8859abfb8b803e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
f9abb779689609297f10cc061865c51b

SHA1
9101fe6feaa67d74488a706bac0c58e8eb5866c7

SHA256
202f434ae59b414f00fd37e5d5733d961522ab2c55be823604a28b2b7c5b97ad

SHA512
fb20d7a0ee8d6bf2ed11d19832437ad9de8090945beb56d36ff4cf34849d7550b3067ff3e99809b0cfbbb9dff0921a377d617b5d2912a1abf68f032ccb072cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
cd5faa1dbe691706d354b40604d06d6d

SHA1
c5143531b007bc83d39fd4c9a214e41735fe868b

SHA256
0888b9ae58a08c3ed23e54fa3d26af00152038a7475544c6596093716769d7bc

SHA512
4386b2804b722ff512508488da6041c82549580b3fa30d1f8c35b74eb8cfeadcaf56f75432b213b34e6030b1b9244abb2cbb5488ad914c3d7478d701e8121b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
ff9a424c5f00cf7c8ab8c8a458ecdcd6

SHA1
284d27b8d8d9cc6dbe13ddb136ff361877ecc39b

SHA256
24110362c25bfd191e1dd70525c2c1c57bea75594291a20174a7cabd1335d50f

SHA512
a7388e2aed94fd9a8a1311f1b87cb1b8f6b7f10ecda76e92e3ccdde523b37522d9ff69d0a5905372e1dcd89fc62cbe2f16e8a7a2f30e6b3ab93684bbf4dd861c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
65738a86ea94c8062f8bc2d0d7fa311d

SHA1
ba26b3b8b8914d4fb29518f5e868f4660011c3ba

SHA256
6a61026e24f79118ff0956f6ebf18fc0e783f2eb779711487b2a2dc132907396

SHA512
58a153f88029bf05e54ef7a91c2c3dafff1ef4af530ecbe66473a1feb324852edb13e392db67ffced9546822facb85cebaba644e47fc56ec9913dd5f84a50570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
2091f3b68a05fe4d9eb2e356ee00206f

SHA1
2afcbe3fcd8b4ace86bd48c4774c9aecb46bb715

SHA256
2b4020580757af7d1cb94868a13cf071f1cf2c5fc0bf04aa4cf19c208f7095ca

SHA512
8561d77525468c9b3f8cb4c27a04eeacc1b684886b4443c0e0a0da101fbb8f32de03b170f0da8286b8acd1f4476914522894b1dd3b4dad1102bf6ef6358a1cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
f6cacc7fda02a5e1363d8f9509a29fe6

SHA1
3e63f1a97f56a41b6a056a4c9d2d144f71d22529

SHA256
6db89a15e60e2d6b940960009ae8d765e530a9b82575ffe3b375e26894e0a7b4

SHA512
0388f34448ae9fdd961acbc185f1be13fc6da59e5f598fc18d52a12d542ddb40708161af3e0890b37adf8bc16e163f1c954586345114d9c92b3ebabe8e0efdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aaa50563db8542daebfde9395f74b3f4

SHA1
305803b0242ef737e660ff54a5b4ffe3017f7fbb

SHA256
3a8b47f083cd28efbbbe3d94a5960165fd77f2e02efdf5856dd8179750b765ba

SHA512
3a7a2075c0606d0713c3dd0f5a0974e94c7b41054a0c6d1431e2ac8341daacf512b5b51483406ae53b40bfec90a254bc1a2a917f36a3aec4e0df7d8aad27ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
502d5ee9c68a1382b671f043dfc15b24

SHA1
1c129e3305abfb12d754bbfe6b0a7da4f3558ced

SHA256
25d97247d407b1500faecd397a866fb034cd462d0fb3d33428de6fbc61801431

SHA512
287092cc95e79038b6dd75f8099c853adf158be48d6128f4b48e7ed5e9a34c10cf19804f7dd49e01acd797ff5cddaabcdcb8076a6e61701ae6929223dff64c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bdf11a2263f08aa31f380f576dce4c1f

SHA1
145a9b226dc4044465b0e878266c893e1e9a812a

SHA256
4068680fc6eb734552369d8549cbbd6da538ef4271149bed9fc838da1602771b

SHA512
ea0c0d84f4ddc933a3edd6a33db864a24a0794286365d11a8a6b597fc63b9f5da086163678aee1888853914e4b0f654e35092687af1d8f5515bbe44e85027ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19dc239eea8df9057d276a0f179f14ca

SHA1
6971ff7d07628ca71b0294c3ef96427850ee5558

SHA256
e6e5f3f3ef247aa2e272c37bd3be1d2b34ea07d6ab6e0dc2d66d94cc893a443a

SHA512
a4c43f976ebc7a09d425d49940e798dcbc84bc694be0544737d3f58b4473084401b9defe60ce617668e00c8f46b0bfc0adc53ba598fa54c5444e4ed3468f2cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
12d55532ea11e73f4b4fe8de8e91779d

SHA1
5bf85573157125b1bc4961956664d4158619a099

SHA256
b3ac20c6bae75b65829e6474ec5dfc59b9d861f6568893b71aa25dda03e239d4

SHA512
d87fd7fb0c7fd119f435c3e7118f52e305571e7c94d4624cf702f9d3300ffab9117b9d90294e6c8951a6b03fbdc4510ba6afb18e0094eda9104de3ead2a6390f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
25b0b42ceae64674cac1f9e3a6d8559b

SHA1
6bfb6cc1c2b685affe86bdebddff059ff01eb9a8

SHA256
73db9f5ee017dcdc35b593cfde5f0c89a2040f0c9ee0ab7a7713b42c3d9d59cf

SHA512
5b2596accd72baa4730c554104f490223c0218e9b7b5b76d2b843ada4725a55cba0dc5f94e9b043f4e76e3d354c22d06b93c2a59d6915e989da0edab9844ae6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
9fe8c378b75ad32b2eea80fd75553eae

SHA1
f6110fd36eefbedf43800d8042ec10c5edd8df94

SHA256
9642dfc86db63d46f9b2e95818eff22fadd9a2e68689e134ce86059801e55142

SHA512
471963e632825cf843c49b677c13d06ec7ef7482c73096e4ff4edd33dfbcc4448faabe2c22f01ac52830f38057d376203f4c623eab3acf6669bbc20522ba748b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f03cd207d9208a0843d057d523d3f82d

SHA1
ab70045f9ddbdaa5434e94cb1f1eee4f3030933f

SHA256
f8ad32fde27c4c26d560078a3701382023230ffc64de8d5cc5bef0ae3f9bdbf4

SHA512
f84afbcfc80bb48f42e7098d27ce32f034bd8539883fa6002fe7a5b7a10eba69178e6c12f05856ba9d275b988236bdcb5b47f46d1de2bba38a2df0e8ab6fabf4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
12c60486682d1a79fcde6d48ee72278a

SHA1
fbddf3a82d39db3ffc4c2dd4229aea0e00dec632

SHA256
fca07317b9b328884a727dd756024635d056a230dbef87701fe687aa9f8da80f

SHA512
653abd1d48586f38ec975a1bc2888b07fb7d2676d7c04ddcce6a27f72b3f1def82ac3c54656872f1966b2cfbb784e49087891980b11743c313d74aa021b1f9c9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\728a69ff-87e3-4a1c-a209-a675e7c05469.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\AlternateServices.bin

Filesize
12KB

MD5
479ef1c3e258ffe6f52b97d5c9fd4a63

SHA1
0504af8aa270c48a9368c472217606d02da4c5b5

SHA256
9db2b7e8450dab8528fde5cbda44835c80cd551121f08b9de10545db2b9c19f9

SHA512
891045501866993f7bcfad7a581b5dc8ee7af316d55e24e683dd0b4418d3531d964de82e07e75c8b5acc1bff98c3ec2dee41e2b3d24c5e9fdffcb0fae0b49a68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\AlternateServices.bin

Filesize
6KB

MD5
d250d320b8bb2eb2bbd8c43d95bd9655

SHA1
574d8119a16934e382f9fb28fb9fdcbdec520186

SHA256
83686ad612ecdeaa5d36187df40194e01755a85adacc20bd44af892e5c993813

SHA512
e1add2c6e69649cadc20bfc6a62f3d30a76c522829e249cdcc518bd91ede90106c3e7ea41e3856118846207b47931e1dc44902b4e03d786e9a21cb81435d787b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
17KB

MD5
56937850199b1a33e8021d1a08d88622

SHA1
1e50174aba0228b6efdd60c994c86f1d2862a963

SHA256
8c45e6c5d837d88f8740f1d25c73ebc3acd22d5262ac2a09b0ad1797250c9170

SHA512
c1f8d8c146e51dfaabe36d12e4cb3cf49847540dffb689f7ba837f894d1a9457497146b1f4f676436fc1c5edc757047974122f5830b7dc06d6ce00dc5ba10de1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
9c4dd1dbd177c82b4d61f687de32ffc8

SHA1
92fa6107d1475e12453d21dbd81e59058fbb82b3

SHA256
b0ad91f043a998b73af8b2c0f75d2654d52e0dc8a4fd7d8e513282306cbcf074

SHA512
3e2844cca6d1f0354d0d4c3fd7dbcbb4d4a0dda72cb5318a0a209cd856d38c6a35e79ae016ed881f1f14cf3410f451edd65327cb04df7f3d8f5ad7383a3bcdc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
03dee8b8a5ae8d066ab81aab5de9f421

SHA1
66c2968d779da15de8563e0c60981f458336bcdd

SHA256
694365afb09dbba3ff427f3b177ce891c07b90e21d875200420dc5d3f301a165

SHA512
9d42cd227261813263664fa04d995096b7e3cb0ad8f18241801a5649e5dfa9007f72daf19ea4fd0a415146d815505b91a3d16ea7debcedee79d205f4b7dd5c01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\datareporting\glean\pending_pings\50022e28-2eb2-4693-a23d-b9fe7209bbce

Filesize
671B

MD5
16b4de0e3feb2fd99c07553a762aa3a1

SHA1
d7eda4db5c9c4201db6b22453a474fc24367220e

SHA256
bbbf8700eb4ac915b4bea4c74a159f56c874bda49dae6993bf360de63134ad0a

SHA512
1e151c73ad02099a8c233286429c03982ba256a49c3440ac3f40f065e8b3095dd4a712293174220d1b620110f481520fd4354121fc9667edaae424e64f2bbb71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\datareporting\glean\pending_pings\6fa560da-c95d-4310-897d-7a21188a7d72

Filesize
982B

MD5
796404be1b05890455e8a095c0e2eeb6

SHA1
ba549ddcebba56a6e35fce53aa82617bcdef3b2d

SHA256
88eecabf75a07f7f30a0ce714029b801991c392cbbcb1df80006a3b6d36e3c5d

SHA512
8f71ad66b76ccdd05baeda131b98778ed67ac9f112839c5c0dea92a0e163b6d808caab8644742a5f8bcbf4d9ec9b89bba49ab3fef3c6fc9d0f33def6687c37da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\datareporting\glean\pending_pings\f1a8a7fd-0ecf-4ab1-8b82-402f9c5a82d4

Filesize
26KB

MD5
1ef348b853a54a3c2c855e9b3182a4a0

SHA1
713dec28a122e06b32de6a918ec9fda1066b3c72

SHA256
744e16c2d276e4f47656d3705eceafeed4b2b751324c99767ff8f3cab45e5f37

SHA512
2f7e9e960e0141900b2aa09eb1b6edb051a6387b939a1fdc425435b3d46f9433dbad623838f5e182c5abd154ba36275f8c41dce5115daba70f8e093b76d86b39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\prefs.js

Filesize
10KB

MD5
b91694f92d001be3b39a77f0986f7d92

SHA1
4512afa2c90b2c13c54b72eb5a56d86da62d86c4

SHA256
92b2bbc8d2d1eddfe75e188e22676ae78916ae2c556d8a70e02f7ee6cf6a1645

SHA512
a676c3fa71d465fcb1150939dbc21e974c2c6429fb699c25788f47a4652b539461b8660e65edc8ac2f728b6e7d040873866ad1c65fcfcdbd28ed30674ca6040e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\prefs.js

Filesize
10KB

MD5
9d2ad8d70c605a067ffdb4dbbb7ff04e

SHA1
e36daa29213334a6c85999b31b1a35d2e47232db

SHA256
7af58bc7d43dd00079060d36f1e07ccd7727043e5afd4c4d3332edfb2af5afeb

SHA512
1099d6536c17c36b1fea1f559bc60a1f12eee2728e49f43dfa1cb6244185821d4a9f91dd5e9f87cbb709fb9aa94eabde73662e45f77d70eb8b7368ff0d66a020

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\prefs.js

Filesize
10KB

MD5
2fa082164503571e70d1846ff80880b0

SHA1
67410153ca277c8ca555bcd91cdf0146e044f89c

SHA256
40c9da7095bf936211a8f33c98aa19fdcff0a54622b34fffc485ef2deb8e94fa

SHA512
f73498f2c83e9610d450361b4b5f347fc2ddf783efae44340874788ca69ac771df3031448f22d73cd75cc85d0c83abba820123a71116a0a105ba8d6e4cbf8ce5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ohbz3gv9.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
35afeaed8cd3b7bf4e96ca1b42a92362

SHA1
b33b57cd59d70fdd6056712b09fb205dd163188f

SHA256
a9fd219cb001091f6f68a9faffdd6eafb7c870a9c9a8e96841cf1450d0561112

SHA512
d1cdbf3273a4b82bc5c9daf44f4440052b5dc397c683855e51f975fc3720cfa7a33ce4c8ac1dd5a2735051308c5ed332e3fab5b905bd7c669c7aa8811a7ca84e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 14536.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 890903.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\You-are-an-idiot.zip

Filesize
33KB

MD5
4acd75f2bfeb99226a8c9cc721284208

SHA1
4c5fc527d8825952a6f45d4fcbab3bdb074e9713

SHA256
47dca4e070081df4b70053c858a851dbd720845d4ac579eb5e7334a44ffa16c7

SHA512
ba18b878ad12916ae75dd1f5fbee09bbdfef4776d243fa4e9d7b34a113978b529a242c66e868c52cbb0cab4198d0b356e83dc36355f9452e03e7fbd4e0f9f6e0

Download Submit
C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier

Filesize
624B

MD5
46b942f36116735deda626164e72fb21

SHA1
4be718bd64c4b739a154470fb689622c30a08aea

SHA256
f4db00d73a1de85574edac3a1fc14e7cfdf82a5e83fc1e0d84ebc4386ffd57e3

SHA512
7e03b7973a1add1239ef45a4d713731cb6f76525ce18ea9afb4c188d66df7c9380b7b18d8388b3d348cc67c4bdb9d7d9c0ebe0e85501a727b744e1f873a86300

Download Submit
memory/1592-435-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/1592-447-0x0000000005860000-0x000000000586A000-memory.dmp

Filesize
40KB

Download
memory/1592-436-0x0000000005E70000-0x0000000006416000-memory.dmp

Filesize
5.6MB

Download
memory/1592-437-0x00000000058C0000-0x0000000005952000-memory.dmp

Filesize
584KB

Download
memory/3064-7183-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3064-1673-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3064-1670-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/23304-22196-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/23304-27080-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/23304-27082-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download