lumma | hxxps://www[.]google[.]com

Analysis

max time kernel
195s
max time network
195s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26/01/2025, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com

Score

10^/10

lumma discovery execution stealer

Malware Config

Extracted

Family

lumma

https://toppyneedus.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5852	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
346	5372	RL.exe

Executes dropped EXE 2 IoCs

pid	Process
2868	kosdko0.exe
4272	kosdko0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
321	bitbucket.org
322	bitbucket.org
345	raw.githubusercontent.com
346	raw.githubusercontent.com
320	bitbucket.org

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	75	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=907ff60b0c0293fb	3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 4272	2868	kosdko0.exe	153

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\53559389-6fb6-440a-b570-680991af6d4b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250126105324.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3076	2868	WerFault.exe	152

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosdko0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosdko0.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2432	msedge.exe
2432	msedge.exe
2912	identity_helper.exe
2912	identity_helper.exe
640	msedge.exe
640	msedge.exe
5852	powershell.exe
5852	powershell.exe
5852	powershell.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: 33	460	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	460	AUDIODG.EXE
Token: SeDebugPrivilege	5852	powershell.exe
Token: SeIncreaseQuotaPrivilege	5852	powershell.exe
Token: SeSecurityPrivilege	5852	powershell.exe
Token: SeTakeOwnershipPrivilege	5852	powershell.exe
Token: SeLoadDriverPrivilege	5852	powershell.exe
Token: SeSystemProfilePrivilege	5852	powershell.exe
Token: SeSystemtimePrivilege	5852	powershell.exe
Token: SeProfSingleProcessPrivilege	5852	powershell.exe
Token: SeIncBasePriorityPrivilege	5852	powershell.exe
Token: SeCreatePagefilePrivilege	5852	powershell.exe
Token: SeBackupPrivilege	5852	powershell.exe
Token: SeRestorePrivilege	5852	powershell.exe
Token: SeShutdownPrivilege	5852	powershell.exe
Token: SeDebugPrivilege	5852	powershell.exe
Token: SeSystemEnvironmentPrivilege	5852	powershell.exe
Token: SeRemoteShutdownPrivilege	5852	powershell.exe
Token: SeUndockPrivilege	5852	powershell.exe
Token: SeManageVolumePrivilege	5852	powershell.exe
Token: 33	5852	powershell.exe
Token: 34	5852	powershell.exe
Token: 35	5852	powershell.exe
Token: 36	5852	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5372	RL.exe
5372	RL.exe
5372	RL.exe
4272	kosdko0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4584	2432	msedge.exe	82
PID 2432 wrote to memory of 4584	2432	msedge.exe	82
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 4172	2432	msedge.exe	83
PID 2432 wrote to memory of 2352	2432	msedge.exe	84
PID 2432 wrote to memory of 2352	2432	msedge.exe	84
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85
PID 2432 wrote to memory of 2388	2432	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9ff4946f8,0x7ff9ff494708,0x7ff9ff494718
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff715515460,0x7ff715515470,0x7ff715515480
    3⤵
    PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8076 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16768973257317965536,18100200342961235715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5920

C:\Users\Admin\Downloads\RLauncherQ\RL.exe
"C:\Users\Admin\Downloads\RLauncherQ\RL.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetWindowsHookEx
PID:5372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell Add-MpPreference -ExclusionPath 'C:\'
  2⤵
  PID:5824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5852
- C:\Users\Admin\Documents\update\kosdko0.exe
  "C:\Users\Admin\Documents\update\kosdko0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2868
- - C:\Users\Admin\Documents\update\kosdko0.exe
    "C:\Users\Admin\Documents\update\kosdko0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 852
    3⤵
    - Program crash
    PID:3076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2868 -ip 2868
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
1KB

MD5
c6150925cfea5941ddc7ff2a0a506692

SHA1
9e99a48a9960b14926bb7f3b02e22da2b0ab7280

SHA256
28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996

SHA512
b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
c455e49afffe56d9fae557b4b9ad1db9

SHA1
0b1f50c1d4746c72c3ec3233596e3cdbdaba50cf

SHA256
cf1e04dd6226f7551f71a778de52733696b96161fef1d9bbc5b17796db9d6dd5

SHA512
375ff54a5280dac9263a9d74518aad4742728135bf72d6621936b00ebe6b1bda1a38a93260eac629e14eb958221c8961c0f0a4f5fd71d374cf726ac5831c7b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
56b1fffc97841d060ab4cecd199abc70

SHA1
f98e19c76c13fdc975e396a527aa2d4376279969

SHA256
c2ac2b2cabdf7628d6c09b40b6edfff6776fb513597946a5a326b13f12dfe15e

SHA512
f88b0f1af8967634e584a82e1c18c9fbc970dd05f6ff110ccb20979cfb2547df63297594bc853dad64bdc3dbafc27cefbe4f83ed0d9c2d17167449bd58f92e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
276B

MD5
770dd0bd1fde3f6a5e371647827554ae

SHA1
cb3ab887f6f3a136a0e55f88f37b5b229c5a82c4

SHA256
059cb6d51da3b87ff3e3d7c1c6bcc6c1b3e37f6bc59f4fd02a9daa5484d585f2

SHA512
200a07874ec7af924c47e4a7a8c23e9d2f268d68bd236638125e2ab4c27a68b0874eb2b5c1cb36d79b6d0973675bce06079767e2873d9530c4d2a6d93887561d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
254fc2a9d1a15f391d493bff79f66f08

SHA1
6165d5a9de512bb33a82d99d141a2562aa1aabfb

SHA256
2bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0

SHA512
484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5408de1548eb3231accfb9f086f2b9db

SHA1
f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a

SHA256
3052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670

SHA512
783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\020b5ce8-3232-4868-907f-78125208fdc9.tmp

Filesize
6KB

MD5
b09a44ac422f208401f2e9e259b99f9b

SHA1
ba7f9b668cb841f94c7d156ba738d5befc191c14

SHA256
c134cc683c617dcc4ada4a23963ab5651673c61482120cb7b7cdba0abf2ccc1a

SHA512
db959ced196756a81101e13476d8f1760ab075f35365ffae2a890c90d96d2e09191cf25f039a5379416dc110aebb6bcdd913a2887a33deccf8fd464e9296ef2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
7b49e7ed72d5c3ab75ea4aa12182314a

SHA1
1338fc8f099438e5465615ace45c245450f98c84

SHA256
747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6

SHA512
6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e9605728e94900845f7b0a4797c40ef3

SHA1
1323d501ff0cfbb17667ae8f8e4769d22acb3c2d

SHA256
c43530cf4f78946adb3e795f8b79c06d4c3bc6aed72a120693987b49453b7e5f

SHA512
06e8fea5d133a18e6d6c90947fe370d02f2c11aa75f8cb15737dcddb63eb843c9e478b0bd24e33fab699fee4bcedb38532f39f77324cb81951ab5cfda22de70d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6b4335f31eb547346ca4c934bd83d508

SHA1
fd48a3e5fc6678c0eb49b541f70ce06892f712c0

SHA256
f154b30bd56387227ac2ba2e98a421f4d60f8b778ffad030b555eddf941a9d42

SHA512
f7c27eb030ef87b01b2db2e99925f351c9b396d3472bfef9d12c1c2d2a423a0ddb74cbae5b970bbe31fb279ba852ccf14e31a8bc14cdce9c438f73d0cf73a909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
460a5f900711fca4d435b83a1413c22d

SHA1
8605e8056eec56771e41735a40682425f7e11bbf

SHA256
b097e4e93c07941711ca210d9df2c73fa2654336e00744c43d36e3f117337c64

SHA512
6090e9f2d9e7d4eff3c6e1ffe8758dab6351a5a0a6175d87a02a8efd59678c61011c7a803967debedba46af1c069bbc699bd18ffb3f247cab23a58d47961380a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d29f2097c585983a1590d17362b511d8

SHA1
5920e68f92886e24e1c3efed05e0f10c18764f33

SHA256
f91741004cf9c33ab11e8e397f67909a01a69f1d2faf46a208a57fb6ced584de

SHA512
11937f80ed9fba2e849d7acb87758e5b8795fb2a6c817b1418f74dd2123cb3ed8205750bec2afb131a7fb59bf08ce6117add90fe06ba662cd3606ae04144d0c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
9c22af22cc2ae664feb378184e121051

SHA1
9fbda34d93bb5393e2f7ece2a3d9b4745355103f

SHA256
28a94848be7e667a713de7f9b3690df639eebfb418b8b792b542135967ad57da

SHA512
250b4e1275e0a860cf3e19519fb3fd02754a932d78992695a3bc06a3fad67cbf1f3067db5e07c0064de2e955aba3334ceee43c745444c9dd508697c15a4bc481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
a3a836be5a465d79094273d71b1b699b

SHA1
ffdde08a7af59410625c4445c24aadc2e64bad15

SHA256
34f27bf45050cf1722871980d5d80c0bf3fed6407d88118f6cb5c99cda32f519

SHA512
1889fe0a6161ea946e71249c35c2f87e1d8615ca923b83e5c5fa7ffe012af73c615d789167ef0053d35db7a1ab3454da74ba5b56db1b762457b72b8920eae8b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe586dc8.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3cc46cf0666e5b6b4d4b257b6bd4b907

SHA1
3d993caa08e08f7fca3cad0f7ad96ef26f2759be

SHA256
daa899b02d02b698193247387849486b5f77789ac05c1e63fdbef26b9377217c

SHA512
5440c748a52960a7d5cfb0d4931b5fc6d8a9a07893872419c1e58ac129e1b4f235c72c4b57e93d29f2f0bde54f55c3a34a1179396bf3a87807527b8259a3e545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8022b8e221f1d39e7b6d25b78522169

SHA1
98005a262d85d45332f78aca5a2c28b07de4a62d

SHA256
9d504b734132a020b3c7dcbc41c202592146fbd5e7514cd15f2871947919bf83

SHA512
8bdb60798500b232c32503b48200d37c17bbfd13a91210d5b7256a36db22c3a0b62409c1df6b86b7b379d3edb994b947ef37b4b6a83db13b9cc522528f8983be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b01d990a52ec9c07a38f3cd0dd4c72a4

SHA1
7530796ae8d83c1ea93829dec85a66312544221c

SHA256
9d7fc8dc0eae371e6c4c0ab653280ec88646b5a9bbf1d7be22acbe5dfc0d3f20

SHA512
a487535a793adb7ef566feae4eae8b88471a50da8a02b8df7d340f4ff2b0e04e6cc43877a4198284e901d9aeb81f976c5840da4b370d94a91cc70dd4aa245dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
ff6ff3f31f99f698b3e4d103a0281d18

SHA1
6e607351abec95bb9dbadb183c384087813e5a21

SHA256
4f6e157aa7621f40ff5438f36a99c82279af4a7bc0521f0bd42da9765c2b9bbf

SHA512
c954c3afa5b3365f76fdfc9681efc0729a69883a65a4e86431e6e367d653e297a0bc09be607c179d86d8c8ee212384ccad58acb082ccf7093e662351dd66245d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
ae1cbba4ce2891e09f8538757ff45e29

SHA1
9d114a70caa16fa3fe961c715465f2ef11a5e8a4

SHA256
4e96971edd482b2879a6c89be54ebe1e00eed067b30678b0774d022655664649

SHA512
94d101c7407438ddd7df49d8bb5e94b9d6a830f3ab913fe3707ea49041c91b87d6dc2609ef8be598851985f793100358975f3b4b92a6e81ceb2d3c9ea97edfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
2dc001d4a8e7d9621e8b89f05029f1a9

SHA1
8fd69136cfa5e05200ca2b468f766b03f8de584f

SHA256
17ea202d74105d04523066dac8cf3a9c71d2e88fbfe03d5f1e06e77167f508be

SHA512
eb62c0b545bcdecf88afe4697f7008f05462d06cab8bcab85648747354889f7819ec4070313bf3e92dd66af29316599dacf2913deed2f0c8b03648513a188011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
3aba726af7a9f60f0aa933c676fd2e87

SHA1
7b31de79ad8fb936a94a1afe60aecf686bddf45c

SHA256
c055b3633ea41cb3ccc959c5f711f48d06570444fd75ad5cf299134ac650c7d9

SHA512
60fbfd80cdd6e50b3ee908fc6deb1f5a212685211b9d7a8717be0aa521ebd5f921ceddcbd14f0acd9033bf4b99abec24bccef3739d24522e2f16b19096773cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc3a0ca62cfef580ff9ebbb7afc92b9b

SHA1
fde9832ce521fcd53850d0701a543ef75b772e3b

SHA256
b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464

SHA512
fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
48febe0b0625901956573dfb2378e7ed

SHA1
c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24

SHA256
f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0

SHA512
fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
7396881913417fbea7db83c4a4f1676d

SHA1
670d2ffadb79d42241d0092d2b1fffc8d45756f6

SHA256
df08c042b86de705d94352bf7cd94cf5c559a5f397ad5789d8f579792f528846

SHA512
4d3e68f350eabfc05535f2f071391c0b857f9aa6389e54558dcb65938503e458eb1c994992344dd39b8e69e947a42670e6a4ed3889eb2c84f1e8f7a74a8561b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e714c10e18c678b8e2edd4e99bcedaf3

SHA1
b8f41acd76307b3f7cc331e072f3daece18a8e98

SHA256
79b7863e2a113e09e18ee166a91e2efbdfecad8a6c249d4bf67bdf6442d88519

SHA512
bce135d120545e31f852784aa0aa4fe50a53acd653d7a9e77d5b9fc43daa1dafb1fc1d03db89c5310444b87d5cf6758b41810ff5ab878d6d02ddc853654021d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dcffe7f1ec644b4ceec4cfa1e3f0131f

SHA1
da769db1cfc6037c863f127184079d0a5e00618f

SHA256
2d646f31dbd13ccb4bf63f7d4d0475b0f5cabb274b2904eae6a4603e63941b28

SHA512
92b64b12a79872b100f9166d49eecd5931ac6ecfe20b92f2b4874d01aaaf6863939784598f43ffcb3c19b9bf5a7b5b6de402f5809d474735593fe84cf7c59c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
61a0c23c83d0d236e83109e23d4ed7db

SHA1
9d043087f645bce9cfea4f411e67e4da33483a1b

SHA256
369582dd16c7146e20231eb403f30e27e20a9733d19511477d29d15e59f7b028

SHA512
eb2985b88df89ae556478e1e239a70b31be7815ca84dede21712b145aac7dfbf94f086fe90b4b421f3babf6679092cc0ea08cba9369adb14e274081e5a56cc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f667ed28568ddcdf0648f279ef47431b

SHA1
bc35904b58e31463847ca022ca08043476e1b7b5

SHA256
ebb7a51d2578ae39738cd3b3afef5fd7279c266efb6c190279cc548d9c079c1c

SHA512
a5c693e3dd798e546f97d02871bde36c9e2f229753446215a93145301d6db08730b97f0b114411aec640a6277cff03debc15851da63a55552158e54c979d6911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
61e42f61d257031b0f1e5f0dc8171324

SHA1
b158d170510ec722c03567c876acfe500aae95ac

SHA256
2899f66891bdad2c5377ca73b430e884143fe289f93caaea252dd10ef5750ebd

SHA512
0a5700dca262f93db156db1b9e2120b832ff95aab6012f51cef55cfe28672a392aa71b502df46a35b9545abda7ecefcdfe90c8925dd73996d6a466acb91305d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b556.TMP

Filesize
204B

MD5
fac7cabdcdeb84a1114c31b0957b34b9

SHA1
95c4655f95dce8e6af8b733e68ce89acb6c30618

SHA256
ea08c3bbc044555be6f7a2022b3246a52e8eddc201e2d914783ebafba54a263f

SHA512
66276c024551aefc6937cab3fcbfda20384594eebe7a80ddce26c5b3c84dc739dcee92ba2a1047c10142ee8df7a79912d0d7c0dc098e1ff47bde6564c20dab6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
fccd51d889a25cd28ca821268146f121

SHA1
af4404a5c857607ee9754f68ea5d53de65931440

SHA256
17f1d41c07f60db0fe6de80fa9bed66c20d6cef5b0a5eefbeee767d4834f76d4

SHA512
6c59d21aed76667407a6693e208cd3bbfe47b4a0e321e50da079db2f5fcfd3e44efd3bddd608886a6cefe67e0323b3cb08cbbfa8cfff16481d97a58344edae53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1abbf85907f264eef71bc6e1ca0be6cd

SHA1
83243261553a5065a6e99ee3b89fe59b79b7ef54

SHA256
d2654dcdb4c5d1b0f40d7f81b3d780b613bbc4526aca37a53991b580fcdf5248

SHA512
f6b595c93faa79a73582038226cd39f6b97f25e6184306e6970a59c1758e68d9539f6347c982c473f614f0efda59b3f8b7ad004f5ceb1933890eccceb5bae344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d734f898d67bc65190008bb35f327a8

SHA1
05500f47bf98eddbedf3d7d5f5734938397edb9c

SHA256
e3c4db1d1b735a55ab809222eddaed8211b5e616797a8faffec8e6f30fa52303

SHA512
ac910dd75abdb87be5b81f14dcab09e18d338703c0c5356b5ae15c08f628c93a2ae6da4bb942e109960a2740bdf73676e552e99496416de71f8941413d3a67ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmulllkw.c5k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4e0b5bae6b7703b52e15959c502f5dfc

SHA1
1886b06897b1ec281e594573c87748e8bbfda859

SHA256
0e1c37220140ae75be8f946605940a5039ab00fb40802f17ef5521a8ed4f2b94

SHA512
b25636e12019659cf032563452f43b72044c414e0ba5b672435628ab032004f4284f4d7ee9787d2986aa6a6dedf6c32663e7ec2fbe40829362b715ffad0f5521

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4803d61b3d58e7df92598bc92c7ed3c9

SHA1
dd695658bc058a9ec3c8bdc5989e16950c08337e

SHA256
8d3cc3d85ebac7d32e1a94d24145fbdca80cebd49d71f2810ef3d9a4e96648ed

SHA512
ce804e5b3886fed3e7b178bdcc41a8b03948d1ffff63ceba37f03d5311bcb4517bfd337667938696b6fb5c7d783840230b9fe25dc9a86f9636da6fbfbfb1ab85

Download Submit
C:\Users\Admin\Documents\update\kosdko0.exe

Filesize
516KB

MD5
6911b69e38428bb59283a99a9d1009bf

SHA1
c05b80f44c7ad2fdb84570ccb05ffa2f2540b4f7

SHA256
9aebac43486751902574540e8b329d71b47dd92d0e7bb3115b9a6cab32639508

SHA512
582586e7e3ae98449458c522d9348d98d93eef791f5cdfec026d4e61df96600c60b73b85abba91485774ebefadc5093c42e42743419ead58df5192b87e14243a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 771647.crdownload

Filesize
2.8MB

MD5
3d7dfe4e6de8645541e79672c8316aee

SHA1
7fe0071ea5fe3764b91e209e2606247657f2967f

SHA256
287c8849f6bcf6450c2124d01e83b26b910fb136a734d09c58d71cd83a7a8692

SHA512
b42df65faf3367d9fea3b8a6b956bae56d46d53a926b883f249ddea6389ab6cd22feafb93a90ad03ec3f2dc603ac24f9aa7181504434cce4b43ff6d8bb70e856

Download Submit
memory/2868-701-0x0000000005F00000-0x00000000064A6000-memory.dmp

Filesize
5.6MB

Download
memory/2868-700-0x0000000000F80000-0x0000000001008000-memory.dmp

Filesize
544KB

Download
memory/4272-705-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4272-707-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4272-703-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/5852-667-0x0000020FBC4E0000-0x0000020FBC502000-memory.dmp

Filesize
136KB

Download