lumma | c2e6ad96ec93f7931042c835e744f8262f698dfea48388daae31927a29453814

Resubmissions

28/01/2025, 15:38

250128-s3jnjawmfl 10

28/01/2025, 15:36

250128-s2bljawmcl 1

Analysis

max time kernel
979s
max time network
982s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28/01/2025, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tinytask.ini
Size

138B
MD5

d465b9cbc77ddf9824cca8f5feaae92a
SHA1

0df323d9413f003daff067c096e07cb532ce7a0f
SHA256

c2e6ad96ec93f7931042c835e744f8262f698dfea48388daae31927a29453814
SHA512

43a0f7de171bcd57140b28d2d4ddbdb5ed26f15ce83f937cea8df98205132a897dda883553bfab3ada1bc5c4c39b46ba8312a540eccdf2cc3b3510fe1e965190

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://toppyneedus.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 5 IoCs

pid	Process
5420	Entity.com
1724	Entity.com
5960	Entity.com
1676	Entity.com
6076	Entity.com

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
640	tasklist.exe
3092	tasklist.exe
5576	tasklist.exe
1704	tasklist.exe
1144	tasklist.exe
3180	tasklist.exe
5512	tasklist.exe
1192	tasklist.exe
4576	tasklist.exe
5556	tasklist.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\AhStrength	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\SpDover	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\DeeplyNet	Bootstrapper.exe
File opened for modification	C:\Windows\ConsortiumCarriers	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe
File opened for modification	C:\Windows\EarSegments	Bootstrapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Entity.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Entity.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Entity.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Entity.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Entity.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-590766166-4003350121-2036565200-1000\{FD0F7F14-3B91-441F-86DF-5D3A88FBDDC9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1808	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
3760	msedge.exe
3760	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe
4420	msedge.exe
4420	msedge.exe
5420	Entity.com
5420	Entity.com
5420	Entity.com
5420	Entity.com
5420	Entity.com
5420	Entity.com
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
1724	Entity.com
1724	Entity.com
1724	Entity.com
1724	Entity.com
1724	Entity.com
1724	Entity.com
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5660	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: 33	344	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	344	AUDIODG.EXE
Token: SeDebugPrivilege	640	tasklist.exe
Token: SeDebugPrivilege	1144	tasklist.exe
Token: SeDebugPrivilege	3180	tasklist.exe
Token: SeDebugPrivilege	3092	tasklist.exe
Token: SeDebugPrivilege	5660	taskmgr.exe
Token: SeSystemProfilePrivilege	5660	taskmgr.exe
Token: SeCreateGlobalPrivilege	5660	taskmgr.exe
Token: SeDebugPrivilege	5576	tasklist.exe
Token: SeDebugPrivilege	5512	tasklist.exe
Token: SeDebugPrivilege	1192	tasklist.exe
Token: SeDebugPrivilege	4576	tasklist.exe
Token: SeDebugPrivilege	5556	tasklist.exe
Token: SeDebugPrivilege	1704	tasklist.exe
Token: 33	5660	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5660	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
5420	Entity.com
5420	Entity.com
5420	Entity.com
3760	msedge.exe
1724	Entity.com
1724	Entity.com
1724	Entity.com
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
5420	Entity.com
5420	Entity.com
5420	Entity.com
1724	Entity.com
1724	Entity.com
1724	Entity.com
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2336	3760	msedge.exe	88
PID 3760 wrote to memory of 2336	3760	msedge.exe	88
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 2900	3760	msedge.exe	89
PID 3760 wrote to memory of 1296	3760	msedge.exe	90
PID 3760 wrote to memory of 1296	3760	msedge.exe	90
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91
PID 3760 wrote to memory of 5072	3760	msedge.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\tinytask.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffe300846f8,0x7ffe30084708,0x7ffe30084718
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1316 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2140,13664695989603302703,635082218408511790,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:1144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x3d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe300846f8,0x7ffe30084708,0x7ffe30084718
  2⤵
  PID:3172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1472

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\0P1E2N3M-x64\README.txt
1⤵
PID:5772

C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5988
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Ata" Provisions
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 18197\Entity.com + Happens + Hull + Bare + Months + Tions + Yourself + Costumes + Particles + Collaboration 18197\Entity.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Grass + ..\Mcdonald + ..\Blue + ..\All + ..\Achieve + ..\Rape + ..\Relative P
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5392
- - C:\Users\Admin\AppData\Local\Temp\18197\Entity.com
    Entity.com P
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5420
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3224

C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5916
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3304
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 18197\Entity.com + Happens + Hull + Bare + Months + Tions + Yourself + Costumes + Particles + Collaboration 18197\Entity.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Grass + ..\Mcdonald + ..\Blue + ..\All + ..\Achieve + ..\Rape + ..\Relative P
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
- - C:\Users\Admin\AppData\Local\Temp\18197\Entity.com
    Entity.com P
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1724
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5628

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\0P1E2N3M-x64\scripts\config.txt
1⤵
PID:5124

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:404
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5268
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Ata" Provisions
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 18197\Entity.com + Happens + Hull + Bare + Months + Tions + Yourself + Costumes + Particles + Collaboration 18197\Entity.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Grass + ..\Mcdonald + ..\Blue + ..\All + ..\Achieve + ..\Rape + ..\Relative P
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\18197\Entity.com
    Entity.com P
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5960
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    PID:4780

C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4368

C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2588
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6092
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4152
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Ata" Provisions
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 18197\Entity.com + Happens + Hull + Bare + Months + Tions + Yourself + Costumes + Particles + Collaboration 18197\Entity.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Grass + ..\Mcdonald + ..\Blue + ..\All + ..\Achieve + ..\Rape + ..\Relative P
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\18197\Entity.com
    Entity.com P
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1676
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5352

C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5492

C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe
"C:\Users\Admin\Downloads\0P1E2N3M-x64\Bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Soldier Soldier.cmd & Soldier.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2620
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5596
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 18197
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Marriott
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 18197\Entity.com + Happens + Hull + Bare + Months + Tions + Yourself + Costumes + Particles + Collaboration 18197\Entity.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Grass + ..\Mcdonald + ..\Blue + ..\All + ..\Achieve + ..\Rape + ..\Relative P
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\18197\Entity.com
    Entity.com P
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6076
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c11ec0c8e803f5a563c2b75e7ee2c81c

SHA1
078b929e5004c90d578ab9e4d8a76d8d14716c68

SHA256
67a4b4cd1a1cb362d05d6fd52aca388938263f07b5f469949ee66c84e6590668

SHA512
d60417e3a10ab6faee1519e6baf4d33269afb95e2fad49421c543053c05c4df6bac728315d716a3abe069b27af1fa268de15f0f68a84541cd8bc79e3b0013190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94438f8d-6265-4c60-a1b1-a13ef0a58db7.tmp

Filesize
5KB

MD5
f22f238e2f6cc82a5c3e03798f52bf33

SHA1
43efb446a6004268c15d9d285c5fb8775778c9e2

SHA256
68160bf58dc20ab465190607bf1ef992a63cec31098e70bba73509b9cb43a434

SHA512
477c5f8f10840a82ccb9da26bca626c391a3624914288dec649dcdda973afb4df5abb72de80527264326a4b2336d2c0e9b747d0e94def376eac1e4cbaca87bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
26KB

MD5
8ce06435dd74849daee31c8ab278ce07

SHA1
a8e754c3a39e0f1056044cbdb743a144bdf25564

SHA256
303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

SHA512
49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
103KB

MD5
8dff9fa1c024d95a15d60ab639395548

SHA1
9a2eb2a8704f481004cfc0e16885a70036d846d0

SHA256
bf97efc6d7605f65d682f61770fbce0a8bd66b68dac2fb084ec5ce28907fbbdb

SHA512
23dd9110887b1a9bbdbcc3ae58a9fe0b97b899ad55d9f517ff2386ea7aac481a718be54e6350f8ba29b391cc7b69808c7a7f18931758acce9fbf13b59cee3811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000065

Filesize
21KB

MD5
fbee25f2cc1050327ea502cfd611583b

SHA1
bdae0a6aa996c2dc6cda473b77414ace3c4886a7

SHA256
e43371c2eee0901d363ff2775f9c3e141e8e9aa4659f1b26039b7a7afa9891ab

SHA512
5865f1c24614f380b1f67683549b550e901af1effeaddf3a347d8a7e2731ab2f4933b287a56bc41f2dd029c6cfb1149b40d375f967f8ca4ee1c2011787d5878e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067

Filesize
44KB

MD5
ffb646268c34eea8e2d6e52111553400

SHA1
2989a95fb447736a5f160d3753dfb0cb8deecc06

SHA256
cf9afdc6d205445d44a5404d7205e6a9b6d74025e0fe1ebf61c046f1f8a8324a

SHA512
f2ebb7880074a5a5cc0a3093701de772ae2b9097be44466a0c4bfab2377b9c26658136767777a8fd3e6ec3a451b50266fd832a4664215067a02d424dd52385a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000069

Filesize
72KB

MD5
5ddb7fce235292e7e1821b4ed99143d1

SHA1
f5ea7f834244ff0e300e743a05dc4cc04b77f13e

SHA256
8e2ebfcf1bbc5d70a7e761b35135dfffc78b2d7c58c9c0efa6ecde0db9ac7f87

SHA512
125258b930735e64ea81ffaffb7cbfd9220c0114f4bd51f74efcf9b1496e5108b1e937cf9b55b1e4f881c122a9606369c32ac0a8163d816f34ad691f41d51972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
39KB

MD5
ef5fcc83ee6fb28f06e5503b2b016806

SHA1
9e571e76dfe624d7210aad95d78781cbf15a7079

SHA256
32007d4c9efc9889da70175f2624321aa8fddd12a5dd92ecf49de941d966e7fe

SHA512
4d260e5ea65f189a97637d04bd237ead2709567c7b31ff48688bbda82cc0240d0063f9c9036d79cf8879103c0bae0f288ddb1a156af30f85cb14a57fc83677f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b

Filesize
72KB

MD5
9fa6c3f3bc643f4edc2dfb508197f1c4

SHA1
c7eb9e26071463aaa96ee77dc545b370ad80fe85

SHA256
b03f88224630eb4696eff89233efbdf3b99fe3412461b4c32959353cafe05330

SHA512
fb20b2bf4494dd87933a9c7741fcf21fe96ebc81f557710884a67c08f5b7c1f7248b745d9c85736c0c2e8448a29769dc82b84b603a9f1cfd63c1b2f3ce7dcddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

Filesize
43KB

MD5
266c6ef753fdf0038602e4d1d9bc36fe

SHA1
08a369e01e79172e833f44742c1314797e09965e

SHA256
74afde1ff53e7bf5db9991531d26d9fa7ce9217a069ff30d6a89151148ca1bfb

SHA512
724d0aab361b0e5c9de352bdf1862dec99219a92373be2e5a7b0e583c6ebf99ff003abbd3f7f0c8f736a0ef548e4cdeb939eaeeec697d3a79c827d0d26eed090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006d

Filesize
30KB

MD5
7fee9bfc24f1869739812ab1cff4661d

SHA1
693f881d6c45ce11055553fab2ebbf8894358b5d

SHA256
876562a7b81904c076e7f38146d0087685043bb2bfcf5e81ca1804c5b96342be

SHA512
d536523b5fe78abb5f5afb91fdcd4a8c5b9b01279331d31d050e6b2527b81f13ec27e94571f99d935e7a17f5fd64ab871a17f1f0cd56b07cca929b68abfa7664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
7214eeacab2cfe779b3dcb44f1bafb87

SHA1
a75ff597b7f6178746ddddb032ff2aca499ff54d

SHA256
14f2f9d9d364561baf1e44a7b58319e4b8d95b63ba2617174905c0d79bbce09f

SHA512
56bc1df365f4b3d0f7b108ff0fe862ab9d6ae356cbae21198e6de218e1920d8720a7a58f070e88e5aaacd158d27861bbeef4e07e579d5c87fcf523ec11597cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
8b0f6def7f193e0e156e7793f079dcc7

SHA1
4d4e9f87719e01d20f5b8cecc1ab3afea208d9c5

SHA256
383488f6b5c77f786aadd080d57764712a024f376ef6568ac5e4b803140a0ae6

SHA512
697ce166dc8ac7fffd463631eab98d1e1850eccd971d2f60c72c86204906bbcf6f7a08532fde6abbb15f60ab784a43bf6faeb36e27b53b9e849467a9b5605cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0664c77b4a5d3e66861a0206307b41f6

SHA1
9643cf7e38ba616bad42324894b93da809c91a89

SHA256
0dac84688c9b3ae3e34cc2a2475f7db81fe55cf8aca96b030a4401297cd95238

SHA512
1c261987c8ce5562a6d3817125604cf1221c02be66ebcc33583aadbd32cbb47b3513214bf52274dc82b56e86b33e3ff78b97ecf4dc0bf4c66162248f4166111f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
6bba7e082c9559a726206d05e5f65fbc

SHA1
73d84fa618ee8186d4d7167553bad0fe5e357be4

SHA256
c151b270f319d13c8854676bab78197e163d9eea39033de1ff7160367f8ae041

SHA512
53773cbb31481dcdde8665c6f53245ed3252c30a227850092ee79e54ca158ea503745a1c3c8862a43a8336534570f036f59a939ad0acf85e7aea842ea4f9b13e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
c264bb7b7f2852efa535a8f85b8c6689

SHA1
87bd80dd893c79056304db89f5bdf753daccf5fa

SHA256
222573f054168370d468491b6e75131f669632b2712c78229d772c8885a9b049

SHA512
68948f5c36fa6a7fa540872155eaf65684a0e6a5b11fab3e5945afa58dc93891c8211ac73af118e169a7bde49af0430f46112c6f7b2e81e4f4935bbc5e02c252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
392B

MD5
8e7269065773584baa863ac27306ca93

SHA1
70bb82a87f697945c401b31aa58d2bd212430cb8

SHA256
3607ef1fbc3b9acb5f98884e98fa2f54af83cc23999f08906adc99365c4575d5

SHA512
84ca14acbb32dc0842b414e7ff18816b425f2ed05dfa327d37452ac0b4139e2361c7db7a7034983f411e00666059161e5c9393289b2e99fb73f57af5725fd0ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5bc0cc.TMP

Filesize
671B

MD5
7c46b268790fbc3dc4d04fa2ea67c34e

SHA1
9da06eef8db2d063589c3b0e4dd4558df26e5e9f

SHA256
c5d7f37fed9bc94c24726242105bc2b8a9a902d501bc3acd8963260e027074f7

SHA512
17c08c584c12c8b3147b3b33fbbc12a13730510d9679ee23306a13a8df0d94225201ac0f1403f35c8bce7aba62bc23c08b5a4d9ac301dabde05cf1b77975416a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
791f2891f56d46a34299122435f8166c

SHA1
44191a3497eb2b56ad39e22c64f008c5290292d0

SHA256
da727759154d487bda0960eb8206c8dbfdc02dad38b4b98d4bd453f908a7628d

SHA512
271a6606026e51680d7ecf0b4f59e07b8e761166ac17a7dca3e00e138ce7ed1abe34c3c9e65e8af625113fa4f1eaf21d66f50af022659b76c1d0ef9a36d6e4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
30108f05a3eb221640d1c950b9ade04c

SHA1
121314f26d551e88e722b1647106cb786e60bb68

SHA256
57a4c7febc08277d8b92b8592846fa46b55d95e45539426c500b89d058d857b0

SHA512
f824ed87c347fbc69bdfb613b8ef6c46530b23b66aaa2407b498ee57dfd654f1251ec8eb21700999c8d1bea7832a7ce9f93b74d90183397b899aa1b451122d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
89466888c3bf9a750f9b6a12ed50620f

SHA1
baefcfe9b63397632263f5e1ec7e6385e4dd31d0

SHA256
9d649b6562b900369942648a421f77c34fe01c386a25e055a5bd8704297c7f90

SHA512
918ac8bb94379f5968cc97214d18b908ba32080d893417a4bd58a5f7ca4134fcc6ab2e38b18246db4f08a2bc3725784440d727d4125c3683e3b4b219d8358bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
f53e2b0a154721d7912c607386049100

SHA1
3e3ab889ad7478e7cc912355e82f29fcd8733ded

SHA256
3315f39e79c5750864f61d6f6d7fb02abf494e816df32af3166db76c0b996113

SHA512
a6e3a4cad7a0b95c129b04bc9233dd56d53e8277a65107727dafafe5d2b1859a0107bcb3c868ba36307223678799e96dc8f7040070f7237fac541d42d8ad310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e09b08e215d12736e8978cdfe836f9a

SHA1
c4d1ff0d5f8b72cf86f8bbcabd6a15c471ee1ded

SHA256
b437e6d87acce7fbe804f8015bda7dae7dfe165642ffca36f90a10464ef5e29b

SHA512
6b8dd8b3ec45abd83330d85708323c0028d0edf09aae69a2b87e07c606034a7435ae69194c15db059270f684ba25c46cfae5695ae155fbdc0aef3cfc147a791f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9cd3e971c64323dd4b4abed6f3185db

SHA1
07fae4520289d470788ee2dd4bfd81a7b3dcf4a2

SHA256
de21e8995dc500e68a755c61b21e7cc357f4adeadf4113301388829474242958

SHA512
0bfa49381a915e477dd1d2bb8e3468c6afbf933b00ed4aa485aa3cfa4a52280ca0706e49c92364ae01b675ea796a3ecfd490d1e85b7acb1256a7a52e2a3fd5ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d896642de3b86ed312f04e5dc77455c

SHA1
1ff8aef433b5fb4b04e81feab810f948d5395897

SHA256
4a6d4edee31ec8f249c39dcdd4cd539995f60b5cb702e096dcd847c35b6d6695

SHA512
e9bba2ea29e3bd8ca178aa48cd5f69242a6902784b1cb97ba19ef7c431782106e9e8d81fc664f51669684f36d31a09dd36e1c4269778a3258db62c8b6340b1e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a162b8932af2f82f4f82ff52f33f7561

SHA1
4a0bee5fb8ac18f9323871256af29f92b0765547

SHA256
05741b7e50810263bab2313ae1356c3115e6a32f5bb28d3215905569de4808c9

SHA512
e6426520dbe45e60e5b8f6cef58eb1e55a2ad15b3ba1f5fa3cdf142b7beffc52dd83105fe08b2138141356b3c7f4420109a7e955a60ac80363dd13cdee165bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e3ead132426e2c264643b653339bd4e4

SHA1
3c3088b1acc74a5d47c0a606fe2300fced87073a

SHA256
a3a99cc27c1902d9656aa6b8ce3e46a901ed438a45fe5d6003b39937cc0ca62e

SHA512
0bf08da2099ce85ad046a3ec05b475c9d66a2ead9316f6a83d2f72eec823093a330e901dcc53480020a42549878a20ddecab226caa9ce40778a654eef6653288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7dd6e5e7e4db538c5b380662176de2bb

SHA1
034175e540e5bcfb8c16272b82289f2050d42115

SHA256
6676357efbacf863bbf4159b8ad01cace935015c783a482bf3f90cf8b2a87f4b

SHA512
6fb320da3454aabf6b67ec672b196bf74a089c3729a3eed487413d5ee8e2096ee7017db6aa22bd21d6e310bf95ca1457300feb393d40d247bdb830c2872d41dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e7fa7fb766e640802206c78cd58a5c12

SHA1
8852c9e0dad2569c30ccb345dc18c40abaa89ccf

SHA256
04128b5e42197d220cc93ebd98928b96d1e7f1384d31145857386e4f7c459c10

SHA512
07d28b8e4ab0ba0343864dd1e563074b3f30036a9d9d20ee0794f1140d367440873d44a86ea11c2ffcfd1aff38bbc7c3384afbb916b64372f7f951a22cddb50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
548af6fe01189540087229a9375cb3dd

SHA1
80a195168ef0d7b55e3825677fae73bdb5ace37c

SHA256
94c2c44733c71ddd754b5ae1e7b3f029650ccac202070b40529d1b9cddf7a1ba

SHA512
dd333dceba20bb42b9e65ff039a93a9e80f80b6ebbe6a69edcc65a6511a1d417c174e0012b3ac45ddc9f2503ff12b7a7d4bc6af50a418b306cadb439b664329b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
92722ff939691fe5825d762f1d3c8c60

SHA1
af0863666808fe2ae271dfec81916254c9f62f26

SHA256
787f5c6e1615b918ddfa00b9de7888b44cc1284bea48fb24c79f0826c2e8fc13

SHA512
41ea3d0df0a52d8ff504e4003551d7beb5c90fa1bf5c57a202f037ae6945cb58dfa3702aaa0139b1de8be2e3f4cf4f16bc4ff00ff087c7f71a7f2d9b6114bc1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
00363fa1dcce880fde7ba76ba121cfa7

SHA1
8d2cccdf6afae9c88f450293f48c9be65d978632

SHA256
f7c8c31140ed34b6fb4b3a3c126fff9f728455e26e6eb90172ceb3b11a323465

SHA512
69a003d5ea4bd70f9802989dca8bcaacf9f69165492dc4ab0fc3e01c5f48ece879ad9c75343a4cd67bacf81e83cdbf61d290fba2635ff01107143b02951edb4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
20a70887bf86381d742a15b4db6a857e

SHA1
501ebf241f27b51dab4e7098824f9cdd0d6562a2

SHA256
7018ff7bfdf04b0628177a66c22486f6cab62279381e235e6540a389a3f63fb8

SHA512
9a2e9e6e51b275c969cf70ec8d0f6242b8d78165a24ba063d62b5a46c8582cf2ea4c946be506a2bef1a3f73bf23a93a165546ca51cf07ddcd34ac8d2ff8f139b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f30a6e00f7fd8fd36ef884beb665c53a

SHA1
8ae650bd3a6bc299a9a71f800b715c8d87ba3c2b

SHA256
8444dff6d39afe5ec1019f5ada74f9d207b0f8ffb9ecde1f03f442968ab22db9

SHA512
1cb5210b4f531f88e830510d2a7a3b54dd493a427ed1baed1772c6515bb7aeef1d26ca671d30d512d970a974657dee662b30bc6fde0d708b1a97a8d079fa0990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b9764c57-c064-46be-895e-fefd8aaa7c6e\index-dir\the-real-index

Filesize
2KB

MD5
d178e1b2fedc55113716cd7f470aa486

SHA1
b88422c4de6e302d0db42286e202b8d1791f67aa

SHA256
507ab8be30f541c8583986cd01439da20c0f9c62bc4b36684a49e84630c13587

SHA512
706df08767472fd68352752526ad92999ba4c6fd3fe6e02c68adc0023861d5ab83fc05b903ce9ce9b326533776168e024fa379097910915167b09c0343816acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b9764c57-c064-46be-895e-fefd8aaa7c6e\index-dir\the-real-index~RFe5882d7.TMP

Filesize
48B

MD5
51b0717cf415a11d3ad4e762cdf50daa

SHA1
8ebf2a7385f99767c7417347c233555341231497

SHA256
26fbdb6a2d8ec7bcc6095d71529ed02a26e2c1c8b5c350549bd4450cac3539aa

SHA512
4494d3cb79b038d8cd96984502336301fc92147e5043a2c76ee7c2f472307489ad4db466e13f81fbd799a3172b798cc1d9d7fc9dd3de44569ca1ad1d6dc9c345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
3ca1109ece7372e3a9cd8abe65b2ec10

SHA1
c2f5fcaf912053ea9f6dee89a74b9e01a8957d5d

SHA256
72579aa6ae605245346a59a4f49b790ad89648ef168932ef3d9ecf44ff29bf87

SHA512
68b3a9a09eae08f639fc1b21c114725f24e292376a59b2d8561adb845f59790e25bda4d51b2302114dc7d19a3d039bd6bf6bdf8ffa75a1539cd001cf431dec67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
b33345c1c341bb47a1808c996eb1d038

SHA1
29de302bd94b4eaef2de0a8a31a128e50e85f97c

SHA256
1d39fcf261f0368320744a180a29e87c06fe1e938d7000241eb95c0ffc37e24b

SHA512
7ffdcf4d376eaf223377e036e5576c44f45d308cfe61a2aad2c90fecab1e72a93e6038d444ef73949cdf8d9a472176736bb39b7da9b8a3e017a7b3dce9ac528c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
dba54e30b4b459178f146e0d8e8a0f95

SHA1
350d9db615676ef10c9f2f5fcef42f7cf4c9f602

SHA256
7860c20af0b138815aa10dc491f0d1bc14fdb6a0a53e9f12bd9e673506601d32

SHA512
64fb84f9a65b0363dae864cfe55ff867854616b92985f7f18a2cb5e61bdb3cafe2fe67d6d403846ff38002b36cf063276505f5392bbdda99789773e7f6b84595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
3dd9b801549968e3427f70fc7e14545a

SHA1
a1b1177aa918e69414eccadccf8ceb1ebe2d94b3

SHA256
b479b4667f52070579e51ec2f1315e453eb91ef82c9b83f3ebdd3b1398ee32f5

SHA512
41ed2672dc0942e79e9662a45d09675210942a94aa484fa169df498db7c7ae39958b464296a8063dbdf23d6bd17b88385060b8c2788b0c8a7eccde549d5d589b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
2b09375538f9c0a4bd4d6a3653a7357b

SHA1
1dbf66c79c9d013b83079b7131c2f17529f0cbeb

SHA256
cc7ea643bebb11d0185aed0b303bb55a9874e39bcbb04b96e9378ed49a62b8f1

SHA512
d334833c55e0274a74c5af4f3a8b14bfe31a9440b1d0eee60cbd131ecebc7a5d4a2d68e9c5b1a9e24c2deff88d2d186821fcf2da51b8493bb75c55f9db80c72d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
feec1c8405fb2b0828a9741f6a2843e1

SHA1
f30ed1e2f394350dfa96602f99494b08146658f4

SHA256
feb112eb1aefbb5449ba6819f72d79d0b41fc19aee7dc93c1a958957bb27c7fd

SHA512
20de62b1fe77b048f6276c2c0a015b220123aeb186918e24852290d4317b4a22badcfd8ab97463adbfae23f413b55f92a365f0fed1bbbcefe95d96a5f0021b2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58368c.TMP

Filesize
48B

MD5
ab4ab326c860eb0dad0eba7732da4cab

SHA1
e61245890350585385f9be8ab7e3c7dd03d3a01b

SHA256
0b9cdc6985c714e20cf7fcb13f2f6f3d7a81190056acd72e9a3e2784a9ddc108

SHA512
da698e8e37303645f6f2fe41ce828f5004c72e6a8b19eadd3d7a9fe12418dfc017a51ece04783cc205833458330e2813f0e390b6ca8f51a73b7783e254d0e479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d2e73983aadf5b3c8feeaf6d8ab8828

SHA1
a93eb156d08b09bf7706867b3904ab7862086166

SHA256
92c0d7eaab70efb313ab484afad902b3822eff014504e91a06d72169523e90f6

SHA512
d0fd970f079d2eb62e2f4bfab8f8e1f3c8749e1f160ea8d6d21ad6c493b568938f3beb24e1f106e2c19a49fb77d80939c9e8ab50d2b508ad837f0526817c2c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8f68a70403efa4ef6600a0402f28563e

SHA1
c13c3c2279ada572e357be85bf0d4ba168bc8502

SHA256
899b3e9e64192b91e67876ba169a0126a6bc4dd42a66535a788895fcd1b16ef5

SHA512
effcbc6926112af625024372dae4183e33d380de6d2214c3144ca6f827716afc8821756f90df1cc264a1f3a1bc4a57e7ee6b14314b0cfe31960a21b6c471eb16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
df87ef891c5b414c4f68032c37e2b3b5

SHA1
2dbf4a580cebeaebd5e2016fa4d10aec1b400594

SHA256
03baaa85e37b864ab07630b0505526e845f26c81564fc4f6296aca74581c6f94

SHA512
44d9f8df727b200cc091ead9d28544252b721d97efa5a0ce8e85b09adeb4ae8e522cc0ab771c79c03051835f98106b38050313a09b83e4ef8d9b03b51fa4578a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4ea6fa026c0bc1caf52b8125a933ebef

SHA1
1e67980b808d6596d2b141de851807b68b1ca780

SHA256
9674bd23a8294248b7c245af03934baac2059df46b5f8a24fc4102b5c2476ea2

SHA512
a72027a4db960f2e7302dc80ebe7ff53b392b7abeedeb91868bb247d2c98efaca29b5be74b495b2913aeb62f6fe6ce7480de93d811f04d540f3eee5cdb9c5163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f0422a29a8fec569cdcc4b3d4c6444f0

SHA1
e3c78f976032034e4a859c6e99dc7850225d8f86

SHA256
ca2b107adf7c40ea9f3910b320f6d173e2d0b8946e18e51879a6e449789c3b5f

SHA512
a813ef39c6e36fb57b71999c8fefc0a0ab62c734b56ea9a809dd6801fd9ac8e760fd624404d017c578c6193d2a8267d34722d3f31e879db6b12c614e3d6a0c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3331a6c7b325a2ea00f53036b2eb8439

SHA1
16fa299a273d096bcef9c4de7d48685aca5cf7c2

SHA256
169ee1ee162e7a818a9f99ec49d55721ca6353d619bb7ff7196683e42302ca52

SHA512
5acee63a44eea0a8c10d424180d6a4e23534c3e2936bb70c66bdc6203b9a2a6f243b86918efe62851b89c90f99329a757ff22ca8c1033f7f438c0901f0c4739a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4d5372df8b1d9936545c461cf706db34

SHA1
ddd86a044ab066030f8f3ebc811c3e93608ae248

SHA256
1217e5d6a193322c18118243acb0c2a666de8960b7e924c2441f29c358e5bb82

SHA512
715e3e1f1ae822c30fa11e1ab4fafd44d77a086e7327bb05253018667296d542456935b3401a7b690b7e508882f015ac31df9c0b4b0b37603c531f9ea184e3ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d5a7c3825c20c27f5919865a3f77d9fb

SHA1
e6135bc93636ad2bb1b57183a22427884a862c76

SHA256
eef85fcc93b02e915810860e36bdd2affea3d1b719f17a376868581cc8c53033

SHA512
8f4ea3741649c8f9370270f586d558e060a3455a15f673ca689fdb4859968b1d47da3ce4d66a71690ae48dc022b179bfc0dd69059755f4dfdf8e43ccb8644da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
484f1ec9449357b4241a53670288a4e1

SHA1
eb2f0f4e550748e0bd2513144ec3e74c7853ada4

SHA256
fa041d6e951f5463f4832e1214c411f953a01daf76357c9093b3ace1c9387bd5

SHA512
9a29f65b06a3f549be8701d8dea1d72151edfddf5e7429a3f715d8231e7dfee4dac525b1703538dbaea36c94a29162d463f1e1e579f7c0afc6e681981ad3c097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
cd825c0a48159f42d6c45cb9a65f2911

SHA1
355208767b704bd9564e67a0809c78f70a6a79d9

SHA256
d6cc4a10de223992e2ea8454f59e1a5111f2a14cc547be0f64fbc26d8f36988a

SHA512
fc110b0bcb74187215142a60b6451ea56ac2d99834591efdfea1b9df6a7411ff10b7cf263b2b3e84ebcadf69af036c3e193dc44ad1d9e3362950aa4e65eadf66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
a834a98626234c6af8f4163f8fa0d30d

SHA1
4fbf07130e173a24b2c5cd33904077307f989cba

SHA256
1860c32a44da5f5ce19e653d95a4fc2fa18962661d35a96059aaee1e766b6c1e

SHA512
833d2325aa802cc5b8e81adf5fbfebbda3d64964d8f62be31d009a506d6c9002b324f69042ee4e8c1d1e481878cc6242f6a2cc4af0994cf199a3da4c2b175f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ff152b2ea50d11b5f2a8f14c7f1fc650

SHA1
2eb6325b3b43aebbcbbbcfc7c7b2d5369b500293

SHA256
19bdf08af56a8a5cb3925a88936131c6d378de083af8a0f4d7bf667f664fe324

SHA512
11665382494ef6af07ff23f4c86193d4e9861099e609afb799f95c580a7508523224438ddc68871f619996ecdb8bd4ec493e23241754532c29a8e7226d61a0ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
067b3785dfd18739f03cf3b7f9de0545

SHA1
2204763eb45cba3dde27e57d36cd9512b6d39d5d

SHA256
c92f603b0b24a63bdd9d86b9a628c4e9a68009a3dd510b91a63dd110b2ce6b8a

SHA512
d85a60e6229c0c31bcceb03afe03f43c8223ef31f2ffc5dc1b9f03ecddf27cafad7934433da2c5463956205a44cdacd666abee1402aa29a9d990e4e0080b58ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
be180d0440f2a47a223a74c5807b9bbf

SHA1
e5f991ea9e583bddd20233385151289770618d41

SHA256
11f8d2894961ff84e90563a3bf9b117898a96d9dc8b0f8b2e2a17f5f1b1ed174

SHA512
a2d409316d630240a9e700d2cda96ce702dd769db56ab69716eb784a48242c18943f404d5b17bbe89aa6de783eb58d3bfcbc783341e30a5c70e9a463c03b9c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0af94104a9edac055dad9f34b22e27ed

SHA1
54d51057043d8c081913c5406a570eb7fb1fe9a8

SHA256
b3414103a71e0738b96ffb45c9baeb37fa7246e3857b4fe28b7b9de034dda8a6

SHA512
9a62e964494423cd3048f6320e408e11cdb48bbd281b387139b060f9a75b4b218ec88b2e87c4df470ff09cd6911f41e9a39942a76e3ceecc2551ef2b44abd680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
735144fb3b724250ae205ecd1028edd5

SHA1
745491c82ecd8bd4e681c46444c59409c3ab8e5c

SHA256
f86cbf282e2d281c85d5163e2dfd05b2c33c36444c59cbc10bc8a34278ce1cc0

SHA512
f6a26b93248fdd310acb70cc5f4837b4b652d315ba82fbbd31633b88b2f2529eb9a482e28eaeb0cc4c511c8ec6989acec350c29e010b95f4ec88b3aba816ab8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7375a5aa2c2c0b303154ec24d8ce746b

SHA1
99ef340ddc59a75c2cb67314222b652d69716a87

SHA256
5688df1956b0494651b55566d3661148d913c96ab312584398ba14fb45c65af5

SHA512
10cff4019e64e3d8dcb41e780ac5d14b5bd515e59c157294977857372efab62c3edec2a19923b97edd2062290e0eda4190484a4c407761b57f5a26c3cded6336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7fdc996950297601578ea30f96792273

SHA1
72cd2f94f8473833c19145dbbc3a8f68eea95450

SHA256
0cee031dcbd66c4cf74e5bd7b9a0a77f683308a405977cccd3ad1daa865f8424

SHA512
5526c7894e58e4a2ff4f0ba258b6dcd96013e2fdb0b290d4399a822ef29e65cee739bdfb9e6d72dea0b6abad64a2b0d53a50c020c0ce9e129ab2db749183913d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c018d862e04436df3fe4f61498e22ae7

SHA1
337e5ca0047e5261cbcacc8597c5292ef7009f2d

SHA256
0a77e6a6b8c2478dc094724cbe6f358d288a6a1fa9ba186fb8b878894abedd98

SHA512
6f2d410c4a61054661a5f5691b86df26ffafc21707de331cf1cb835ce072c69cffd8345bf3ed5e5afd9807c0c7513e8b08622b4f3a239b6d3a75a542360dc797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3d2c4b8b9d9d87d90b337a4a943e5128

SHA1
c13396154a4c2124aadd10d3d21c1a254520904c

SHA256
083122c363a141435e8fff6ce0e2d455f350ad35bd785ecfdeec8482b8c30094

SHA512
09c1644582208a66b600cf1936bd460912bc9329f60a5bfacaf3291b9cebfb3086a20abeefa774e97b1b478c00c969a925ca9d2a139446ee6a7ab4c5652917e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
07dfe17020ca19fb31d2d053db05b50d

SHA1
872fd492356a8dbbe31e93c79a201e76b3c6d0a8

SHA256
96bee80236c6a8dd89fc9539d66a4db828dab94f2f5a9182d279a48a7243fb3e

SHA512
ac6af9ce26dbf84edbb0cfb3121468fe8b7c175d613f5fad93fc674cd85d837ab61e581af4a67b9c84063628b5268c8ff86319672c26e6ce7f8cbf2ae4a06339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
57b42ec847bcdeb641fb49e389c32041

SHA1
90edcfbdc6757fcfa57a6b3acf279a2dc55f019e

SHA256
b9950c9a4c0d47dd2f19b57ddf59a69a0b545036616c138daa2e457e8c546a6c

SHA512
e92b2d21893b8180842d91cf6585556ce1900c78823dae4d6ea652b2103930aba938ed73ce27c11405493a8d378fecc816f717c14cd2a2d536545694bf6b2772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e74.TMP

Filesize
1KB

MD5
c545be946aa76e65d8c68c056d41c4db

SHA1
c103508acbab69b1b1e0310ba3df2530badd70c9

SHA256
beb8b9e3f1ef06975025e1c65adb0dc60814f64e6c4781f1a17ef6455821e7e3

SHA512
5d5255530ccc0866290d0acb279910db716c291e5cbd85286c4033bf76ee1faea8800d8140f4c186af2652a0013f50016e534ad246ec132f6fec95b3d04a7d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1bf887ad16546ab38bee9c6b9efefdac

SHA1
332635afde77980a65d778426bc6c626582cec92

SHA256
ecf20ca6e9bd62f0fe2ebe02bf8fccf0d9fc8f60b0b6484342129c4852235ac4

SHA512
aa83cbbe55e3ef26237982f098352d42b83c154c35d946354d6ed0758a68aa0dbb2a81e573cf4417baf27eb2752f7a1e57d95e2a4d89ceca3c46a69a8005c005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db32f4f7d61d0f81a482a7f005865636

SHA1
86a11333acb4249233777f03200d977c4d4f433d

SHA256
fc32f58b490b3c3644bd28cf64247ae04718545b741cecadfb0f3401932b3da6

SHA512
75a22e3710bf85f70bb0d371946857ac26d94e1eaf22c84f62bedf3ed7af6ebd18f38900d3fae6a301c27695dcac96e273836d54847faee3298858fda8e40a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
41ff635c58a67fc5191e4e5be4c2406b

SHA1
d4c88de511e4a2867ced715a8396857f17c5b471

SHA256
58c35c50e527367a8a4dbc9eab80c27e7ef611b1464a0a6887c6f5374b2c78fb

SHA512
e7b4b1ab4ff0f26a5004b30999e79112a8d92f9297ea94e2ab371a0d80989c441bf79acf3645e5e96d416f1c3e1fd8d5a564696b983bc91c8b61b9536ee0edc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9d0213fac8584249c3e3c584f4dd0a9

SHA1
b63ab514e7cceeddcbe2e3bdaa5ce105ed9ba9f0

SHA256
1806d1120b222fa7546ec261442201e740c0e148bd453e60920a17c9f88e6dd4

SHA512
b9da63ca2ee26e9ea9dbee94a55df1be9e68dc8f008ff3b1780c5f52fb72d55f1e01fe34ce1cbf32f143cdccb3a9255c7e8721041c1c94d4c727539c37208ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cff9967de3467d142a3ab0282ed4aa99

SHA1
59f9cc07a0e06f2e13430a42bdbe740986fe1295

SHA256
2eed23a93542beec66e98036faec5e5b8e1684ef2acf9a5590f5fd7b73c765c5

SHA512
c6887be1f596ada85e9275479e2945d1cb2cbfb6dc9458a098e58ad2b544b62fc37d4e713330762b8fb38f6548b6e62be6a2348b2fcb32910668e5e3f6035073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60ebf9bd785e7471b25f370fb1e56043

SHA1
625adfec8acec0448fc8959516b9ec4f5d74cefa

SHA256
c9afed093b584f1cbc6ea7c7fc5fa1d3919842029b6ff721400649ace6486a68

SHA512
909c1fd75e551d35ebef9ee4d109a254b97513f416df7cb43e06e68622bd1006720843ffd7b13b23f19af7f417d802aca10a914eac5eb432b380f4689b28ab2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\18197\Entity.com

Filesize
1KB

MD5
97f3d19121998df330656f74ace15fa0

SHA1
e4f3e6a33aaf592555af926162d2849dfcffbfc4

SHA256
928df740c612c380f3bc7b9be4e45ace86886fd7636cfc1062e9cf4942e6c001

SHA512
72264f9f1bf689c1211020e3fa592899cdb22b8bbcab43c7308ed03d0158da86bf831b497b4713aa8c396c42cd28b85ebb04d7adee7822dc18466cba1661a6ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\18197\Entity.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\18197\P

Filesize
510KB

MD5
f54b58971255cd8bb39ac18ff2ef023c

SHA1
baae7a9c556141100c5c4ec7a58c4bd5107af00c

SHA256
3dd7212a8d4123a619aad6cd2ac66f23860a9b398ce5543cfa60937796b717d1

SHA512
51f7d10a3833ce810a8aab40c29971e9e0df36737080904952e2ac2f2c999677018524d92d79044b5e699c1561ffd23970642c2de3aad6f6df7959392d2a9022

Download Submit
C:\Users\Admin\AppData\Local\Temp\Achieve

Filesize
87KB

MD5
6b4b3d1f08334eb101b77825c2e69a0f

SHA1
5ed3cd04f8c243329e0c1df244b5557e13b9a195

SHA256
0cc867c5cc3820b661715316fc7f9cc81a3aa0633636591ad625976a7546cbd4

SHA512
c1603a50fb6967af91407a849d57d0f4816f330b6f822c85bc77a84c1a18a7197c19ce490d236bafede117c26d72a8c6144c142ddfb9661d546a596ab3bb982c

Download Submit
C:\Users\Admin\AppData\Local\Temp\All

Filesize
93KB

MD5
6c8bc112df167396aebb49ea6e22f7b4

SHA1
747ae9e043ac1c383a54053f4035231ed233d040

SHA256
2c1fc99f7b576b4882e4f01d22acdf1bda4dbccb91f3fdd8c09cf39c2f2af54b

SHA512
376fd2b86b2a1729d8150e2dbb040d2ca84a4619b75944d10749a3c1df089e565ec4cc5021785c34baa243ff2a8b57cd63967d3c414ec08552e33032bfe22ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bare

Filesize
107KB

MD5
e764237ece1583e546938d1f422e80fa

SHA1
b8cf83ade7e9a4c6bdbde6d87bcc5c81b861ad67

SHA256
c8366f16c835d58d9ef9b923c1f7654ba366605803080ba4a31e6d964403f163

SHA512
62a3d679507ea306ddd3965008c7a685198f057a6ec4def4c28e6aafe610901f5acaa14b86ba00f2c51e31eed8f8c18db168cb9a8f4fddc968f738b62c475b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Blue

Filesize
77KB

MD5
69cef765fd888bf92d8fe00d5939503f

SHA1
3a3b162245f0b6e145a33056b753f365c0d2f962

SHA256
62c493a3f99320021b2c243c1031b4f544fd839dcc5779f75127b8c718468292

SHA512
2a1308618c299fe16e9818b0e37843321ba8979844b22f5cfec2d7a5b4abf22b5e4e706db100e35c7ff61c32b0d9650caf5c5caa7a89869d8be14d062177ee14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Collaboration

Filesize
99KB

MD5
75c9533f649fc53f15fe66ad1e660837

SHA1
230640e4a5f5d11e34f93ab9268c5f2f434cf904

SHA256
7ebaf5353216d2b73bd4f9a6051a6bf6be84dadee78d99f116fa3b5ca50e9be6

SHA512
0895875b762795ece7c6682cf4055b67860c5464d56221db5754c67a2d29d7061f624e86613cb253a2f07bb5405e9454679a30f27b0a0859550d587a65cce6ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costumes

Filesize
135KB

MD5
3e6ac35562b5e256ac96255b65d73dc8

SHA1
7b75834345ab18fc06238425422081659f609dc2

SHA256
763d432416f8fa79a907904f2a118b4dd13b6b20d173564398bc430d4c3ae15e

SHA512
4fd0deb65ef349496432ed3b95f1ceeae41e10880a283b63a01eca62cac406afc496cdf17b60b0c8915f010149906f4aa5eeb89dd3aea0ace1fe15c8001d8f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Grass

Filesize
71KB

MD5
ada59761b1e7e24fc5d82a8d86b2c0fb

SHA1
2ff93f9c77edf53a994876a1526c8c042c24cdae

SHA256
bb4ec0fbe1f5e92e4d1b389119685d766c89722304525aa554bafdc2d04da778

SHA512
429d928fc8336c7e38767b2cd336cf3b493c43b89ee9f39ceacb617490e00a730e0c9acf5340d940a6d02f5579c785df4c6001009527ab85183041154430fba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Happens

Filesize
65KB

MD5
0dde3c7228dba2b77766f9a8fa8c3b8e

SHA1
8538a5646283374c9249048033227f5e78d13496

SHA256
341acf8c01839083d72f47bea36d026a8ba2e2cf73703582d1c7dc1918e89e9b

SHA512
5f6abf298608321e493d14ba320140e0f43f96dd338877f10717c869deddef6b02d00d3929db5ba7637a3cc37cac9904032c685ac325ae7db413c8d9177e6e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hull

Filesize
67KB

MD5
52bf5b80ff9b4153ddc294a6d7ea7ea9

SHA1
0d49562bbf835317350d2c5e1e3992d4c7963c1e

SHA256
c7c0fcf2a92b4da6aa9b1a9cf47792982858b1e59d317a6a4e1fec821ad346ca

SHA512
020cab9b98389ffe0da1b129d82b075d0198bab6554cc61756a8da6f3ff11fd5fdbf2cb5bf55ba12eeae4a977858beebc16bf8c2d90f102ba84663a250e2666a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Marriott

Filesize
477KB

MD5
52c85a3d9b4754d17283c58a62ee8e3e

SHA1
aac7f37b3ecced2acacfdf40b1a1e47e0b45183b

SHA256
38ff935f856d0f54ccaf8c01d5419dbc01239f5bc237b6e67c5eace70b766feb

SHA512
3e2fe806494844f9e53a0f1d5d4b777ca159a35e7c79612aea33661ef5049a35c13e904ea8710f904e3381e13022dc9b07ba47d223279dde671ee97570361dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mcdonald

Filesize
77KB

MD5
ca700ead25ff1da0f3d15b3d4f03d625

SHA1
81ea4585cfafb905c4651019e3dbff36cfb775d2

SHA256
8cb81f9d5f389af49c624740ecf5bd523b9ec52fd95f4d1969f27355ffe616d2

SHA512
27086627d9ecf16e3c5e42c510fe0906d54d7c306abba6a89f1f97bc7f2f12f8d1e6b3cff2e869d672495ba4cd76e00bebac44179e74a406157e9d4ff36bf533

Download Submit
C:\Users\Admin\AppData\Local\Temp\Months

Filesize
136KB

MD5
4cdf3e57d3d57e973cca232bacb9a4b7

SHA1
20daf5a36abe40beafbf17a974754413331095d1

SHA256
59fd8c96ea34e60c3ba49b9912748f8106625858bbfdbcf68d0943153a54cc7d

SHA512
08fd4833009f0f76e6c7173861743c81c57e86c54369e428d89d776c7eb843c52e854270acdfe3bb61afe2d6b5bbb8a32af5487c72a346cddb727267e6cfc4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Particles

Filesize
80KB

MD5
9332a8e5d5a1f8fe99ac9de9b71546b0

SHA1
5799e7b5424f4768c18ba72319886f64f4836ad6

SHA256
11de444a146e62366fd2864722a3af8e8a62359c2428925dfefd12f363112803

SHA512
7a801916d043547c333111181cdd6e7da46bd64716bd19bc97e550106aa11eb10f7ed1e46701ae0b1e60fa4747875b3d615e8201705100ec941af12988f54380

Download Submit
C:\Users\Admin\AppData\Local\Temp\Provisions

Filesize
1KB

MD5
a0fc1422e0cf1a4cd14ed9f114d885e6

SHA1
dfd7573bf9dd59a0e257d2723c81346f4016a150

SHA256
d1fb7899c63cc1360d05b21982b9623b9657193a0e8324f1704112836e438f26

SHA512
a6e28ace7c60c1f632aa1734fc3558ac86a56d061f0e84985c3e4b5881a595151601330a47dcffe691874530448af9f82368ea6a2a3d4d62c233b22924411ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rape

Filesize
80KB

MD5
da60afd0e7846475eb467a411c9d93e3

SHA1
30b04a96b1af7da59e37ae1a0be7438c8593259d

SHA256
7676d619230abd2a2ec536953ef7e14a659fa053fe84edc2e15cc65620f0c8c4

SHA512
0081a63e70ed1f268468ea0ff48e051c9777b8666d9c401d028d248940ab1e1bba6142a844afbbb4325d76757ba10f7ddf802c06e84eece1773a35553280b432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Relative

Filesize
25KB

MD5
0fdde19700b205ff67a80f76e415599c

SHA1
de247cb1f2e6ad764154d147aa4bb12697135e0d

SHA256
5bdb5ed74359d61db52dc3e7d3cc20860537c4a26d0128342f56ef604e314140

SHA512
e182dd2582d6ddb983fa0c2ba3e2b224f21d4de8097501d120214eeb811575d622f4783bf77a8282fe34e081bae3037fd1803416ba24976143e91bcfeeb24cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Soldier

Filesize
30KB

MD5
9b93917559bc9b0c222e0786dafbf76f

SHA1
2b3f3278e3444988c2332a4af4d2ddb9991aee5e

SHA256
d0e7e1b0847f8ecbedfa44d1536b1499e5c80df10c3c83e216c0475445e34572

SHA512
e7b3fbf3103ce0e0440f85b6fc90e3f8c14a71cc4b20357c91c1fde5d9197005a9235ed1bf51a1f2d72f594d6d4594e3e859b25a650012de9c66ee6f15ceae7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tions

Filesize
109KB

MD5
30ef3a43367b3fe394ebb6a225a362d9

SHA1
bc4b81ea0bfa71bd59980dfddc199fe35a2a8325

SHA256
16f534c2c196a0d78a61d099d034257dd41fcf9d07d422738c3079b85165918c

SHA512
12748e178776bb1fdee515f0c0ca6f81494c08b2e9bd9ffa1e4acb751b956dc91af3d6861b04c13d6ccf1448483a7d5c67913975f2165a19bbe16a6532bc38bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yourself

Filesize
125KB

MD5
0aae4fc7f27d4e7aa26a26c6845e4c73

SHA1
fe66162004af2f417114d864694159168b14e403

SHA256
446845e5b7b23d1d2364e1ce022a9b55737305cf5ac03f15d040271ef2033ff5

SHA512
9fc10812f441721aee3ea1b661a3621db7b71ac55edab0bae9ca81c38c0305fd26be1d54629fadc219d165ef2b63b782653e5baa0226d06be79fcdb901d984c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
69d6b70b93b3cff34b1449733002f6a6

SHA1
bfa86e0df9ebd0d2a58abc02a48cba34721e5045

SHA256
3aa3e7742f816496bbc128b5511afc4088c3d2ffa1a536234cbb0ef7df885fc3

SHA512
7c7baf39410fd484553e93c25a72896a296a5fff16f9d7e77359d5c8ca7ee917ea82689e288538855f9580f60281f63af64c10e6edbfc1b5f58a86ffc981df67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
019587ab449c3d003cd2725fb4886eb3

SHA1
346b3ffa734f0fb4f7bf41fb369f62ff5d0f81c9

SHA256
995fee6976ff31a3f812ab502c9942084a1d14880c191925abae7c6b0eeb1b4b

SHA512
f3a5670e85bb9d2ee114640e5cde7cff252edac5f90ae032d78d6d1551ab550e181384ccd647cdf08474b2161290941e41f539a3137b8d1911fcae386a93e192

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
9043d63e444567ef102ee7c1f5558fef

SHA1
df23db2c975e3bb7b4d42af95727535c312a3cb6

SHA256
8499714f37465ad0061540dd71cfea8d4ea0a7d0e7b88657c85675123910cf1d

SHA512
ad448a7db3a595c19fb4ca977e14bf52d72175b18195b7e378433ef5795e1c6fdc56c8ac780dd176bfff46b8901882e91918cd23fbb0aaf646f9adbffb5cbd30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
8bfdfce2f4733e524f46afcc9b3a04f2

SHA1
460c4f303042fc8b6131f2e54b5080d87d46639b

SHA256
213e12cfa4316cf412453749f78453c308fb0164a6ad800077379d984345a166

SHA512
f3734d33c43c2a314c70e36aad13f8d8351f5d61f288c65cfa670567869ce06681c1843ff583e4358b549f1b8c582f9e65151cf36aa283aa636983220d86e27a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 509606.crdownload

Filesize
12.4MB

MD5
3017b0079b8a28f5226a8e38da63e772

SHA1
fb57e487c699c2407f0daeb674afc29702f00d45

SHA256
b52b49fb565fb2185a5b89c6b957eefdfaf18c98a3dea016eb96bf673b97c59e

SHA512
a94542e01d9c4213e830f3e103ac30d18a2893058bda8db5f33bfe0ebcecd0918996ad09058e80f0067d53862664016951f8e599ba438fe1878eb88f835ca738

Download Submit
memory/5420-1222-0x0000000005420000-0x000000000547D000-memory.dmp

Filesize
372KB

Download
memory/5420-1223-0x0000000005420000-0x000000000547D000-memory.dmp

Filesize
372KB

Download
memory/5420-1227-0x0000000005420000-0x000000000547D000-memory.dmp

Filesize
372KB

Download
memory/5420-1224-0x0000000005420000-0x000000000547D000-memory.dmp

Filesize
372KB

Download
memory/5420-1226-0x0000000005420000-0x000000000547D000-memory.dmp

Filesize
372KB

Download
memory/5660-1306-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1313-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1312-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1311-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1316-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1317-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1314-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1307-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1315-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download
memory/5660-1305-0x0000017ED3C20000-0x0000017ED3C21000-memory.dmp

Filesize
4KB

Download