hxxp://roblox[.]com

Resubmissions

30/01/2025, 15:44

250130-s6gncavphz 8

30/01/2025, 15:31

250130-syaj3avnax 10

30/01/2025, 15:26

250130-sva2esxkbq 8

Analysis

max time kernel
592s
max time network
607s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
30/01/2025, 15:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://roblox.com

Score

8^/10

defense_evasion discovery execution macro macro_on_action persistence privilege_escalation trojan upx

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
219	5164	powershell.exe
226	5164	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5164	powershell.exe
5164	powershell.exe

Downloads MZ/PE file 12 IoCs

flow	pid	Process
242	5852	Process not Found
288	5032	msedge.exe
288	5032	msedge.exe
288	5032	msedge.exe
288	5032	msedge.exe
288	5032	msedge.exe
288	5032	msedge.exe
288	5032	msedge.exe
288	5032	msedge.exe
308	5852	Process not Found
128	5032	msedge.exe
226	5164	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Office macro that triggers on suspicious action 2 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x0009000000027f16-1586.dat	office_macro_on_action
behavioral1/files/0x0007000000027f37-1869.dat	office_macro_on_action

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DB.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-950679536-2019665560-1662069516-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-950679536-2019665560-1662069516-1000\Control Panel\International\Geo\Nation	Ana.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 30 IoCs

pid	Process
1852	WaveInstaller.exe
2272	WaveInstaller.exe
5584	MicrosoftEdgeWebview2Setup.exe
6020	MicrosoftEdgeUpdate.exe
6100	MicrosoftEdgeUpdate.exe
6128	MicrosoftEdgeUpdate.exe
3520	MicrosoftEdgeUpdateComRegisterShell64.exe
2288	MicrosoftEdgeUpdateComRegisterShell64.exe
5272	MicrosoftEdgeUpdateComRegisterShell64.exe
5376	MicrosoftEdgeUpdate.exe
1644	MicrosoftEdgeUpdate.exe
4140	MicrosoftEdgeUpdate.exe
4092	MicrosoftEdgeUpdate.exe
2036	AgentTesla (1).exe
5256	AgentTesla.exe
3660	MicrosoftEdgeUpdate.exe
3412	butterflyondesktop (2).exe
3796	butterflyondesktop (2).tmp
1944	butterflyondesktop (1).exe
5824	butterflyondesktop (1).tmp
752	ButterflyOnDesktop.exe
5836	Alerta.exe
932	Alerta.exe
5124	Alerta.exe
1252	Ana.exe
1356	AV.EXE
3248	AV2.EXE
2856	DB.EXE
1312	EN.EXE
2956	SB.EXE

Loads dropped DLL 18 IoCs

pid	Process
5100	MsiExec.exe
6020	MicrosoftEdgeUpdate.exe
6100	MicrosoftEdgeUpdate.exe
6128	MicrosoftEdgeUpdate.exe
3520	MicrosoftEdgeUpdateComRegisterShell64.exe
6128	MicrosoftEdgeUpdate.exe
2288	MicrosoftEdgeUpdateComRegisterShell64.exe
6128	MicrosoftEdgeUpdate.exe
5272	MicrosoftEdgeUpdateComRegisterShell64.exe
6128	MicrosoftEdgeUpdate.exe
5376	MicrosoftEdgeUpdate.exe
1644	MicrosoftEdgeUpdate.exe
4140	MicrosoftEdgeUpdate.exe
4140	MicrosoftEdgeUpdate.exe
1644	MicrosoftEdgeUpdate.exe
4092	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-950679536-2019665560-1662069516-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop (1).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-950679536-2019665560-1662069516-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop (2).tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DB.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
288	raw.githubusercontent.com
127	raw.githubusercontent.com
128	raw.githubusercontent.com

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00030000000164bb-2809.dat	upx
behavioral1/files/0x0003000000022ace-2821.dat	upx
behavioral1/memory/2856-2863-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1312-2864-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ms.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\psuser_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml	AgentTesla (1).exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_kn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_et.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll	AgentTesla (1).exe
File created	C:\Program Files\JJSploit\JJSploit.exe	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_km.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_mt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\psuser_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\psmachine_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ur.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll	AgentTesla (1).exe
File created	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla (1).exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll	AgentTesla.exe
File opened for modification	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla.exe
File created	C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml	AgentTesla (1).exe
File created	C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe	AgentTesla (1).exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_as.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\JJSploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\JJSploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Butterfly on Desktop\is-UBHPT.tmp	butterflyondesktop (1).tmp
File created	C:\Program Files\JJSploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_sk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\JJSploit\Uninstall JJSploit.lnk	msiexec.exe
File created	C:\Program Files (x86)\Butterfly on Desktop\is-NH072.tmp	butterflyondesktop (2).tmp

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{D5EAF8D5-1AA2-46DB-BCF9-7729A2E48C4C}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58d79e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{D5EAF8D5-1AA2-46DB-BCF9-7729A2E48C4C}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58d7a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d79e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5EAF8D5-1AA2-46DB-BCF9-7729A2E48C4C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDADA.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop (2).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop (1).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alerta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ana.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EN.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ButterflyOnDesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV2.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5376	MicrosoftEdgeUpdate.exe
4092	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b000365c5217b4d30000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801b000365c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050e1000000ffffffff000000000700010000e84101b000365c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71b000365c00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b000365c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine.dll"	MicrosoftEdgeUpdate.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 112000.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 611160.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 404200.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 54973.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 247036.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 405494.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 317024.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 558635.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
1280	msedge.exe
1280	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
3128	msedge.exe
3128	msedge.exe
4996	msedge.exe
4996	msedge.exe
4636	msiexec.exe
4636	msiexec.exe
5164	powershell.exe
5164	powershell.exe
5164	powershell.exe
6020	MicrosoftEdgeUpdate.exe
6020	MicrosoftEdgeUpdate.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
5824	msedge.exe
5824	msedge.exe
3504	msedge.exe
3504	msedge.exe
4844	msedge.exe
4844	msedge.exe
5468	msedge.exe
5468	msedge.exe
4716	msedge.exe
4716	msedge.exe
6092	msedge.exe
6092	msedge.exe
3972	msedge.exe
3972	msedge.exe
644	msedge.exe
644	msedge.exe
240	msedge.exe
240	msedge.exe
3180	msedge.exe
3180	msedge.exe
3660	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe
3660	MicrosoftEdgeUpdate.exe
5204	msedge.exe
5204	msedge.exe
6016	msedge.exe
6016	msedge.exe
460	msedge.exe
460	msedge.exe
3820	msedge.exe
3820	msedge.exe
2100	msedge.exe
2100	msedge.exe
5596	msedge.exe
5596	msedge.exe
2856	DB.EXE
2856	DB.EXE
2856	DB.EXE
2856	DB.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5076	msiexec.exe
Token: SeSecurityPrivilege	4636	msiexec.exe
Token: SeCreateTokenPrivilege	5076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5076	msiexec.exe
Token: SeLockMemoryPrivilege	5076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5076	msiexec.exe
Token: SeMachineAccountPrivilege	5076	msiexec.exe
Token: SeTcbPrivilege	5076	msiexec.exe
Token: SeSecurityPrivilege	5076	msiexec.exe
Token: SeTakeOwnershipPrivilege	5076	msiexec.exe
Token: SeLoadDriverPrivilege	5076	msiexec.exe
Token: SeSystemProfilePrivilege	5076	msiexec.exe
Token: SeSystemtimePrivilege	5076	msiexec.exe
Token: SeProfSingleProcessPrivilege	5076	msiexec.exe
Token: SeIncBasePriorityPrivilege	5076	msiexec.exe
Token: SeCreatePagefilePrivilege	5076	msiexec.exe
Token: SeCreatePermanentPrivilege	5076	msiexec.exe
Token: SeBackupPrivilege	5076	msiexec.exe
Token: SeRestorePrivilege	5076	msiexec.exe
Token: SeShutdownPrivilege	5076	msiexec.exe
Token: SeDebugPrivilege	5076	msiexec.exe
Token: SeAuditPrivilege	5076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5076	msiexec.exe
Token: SeChangeNotifyPrivilege	5076	msiexec.exe
Token: SeRemoteShutdownPrivilege	5076	msiexec.exe
Token: SeUndockPrivilege	5076	msiexec.exe
Token: SeSyncAgentPrivilege	5076	msiexec.exe
Token: SeEnableDelegationPrivilege	5076	msiexec.exe
Token: SeManageVolumePrivilege	5076	msiexec.exe
Token: SeImpersonatePrivilege	5076	msiexec.exe
Token: SeCreateGlobalPrivilege	5076	msiexec.exe
Token: SeCreateTokenPrivilege	5076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5076	msiexec.exe
Token: SeLockMemoryPrivilege	5076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5076	msiexec.exe
Token: SeMachineAccountPrivilege	5076	msiexec.exe
Token: SeTcbPrivilege	5076	msiexec.exe
Token: SeSecurityPrivilege	5076	msiexec.exe
Token: SeTakeOwnershipPrivilege	5076	msiexec.exe
Token: SeLoadDriverPrivilege	5076	msiexec.exe
Token: SeSystemProfilePrivilege	5076	msiexec.exe
Token: SeSystemtimePrivilege	5076	msiexec.exe
Token: SeProfSingleProcessPrivilege	5076	msiexec.exe
Token: SeIncBasePriorityPrivilege	5076	msiexec.exe
Token: SeCreatePagefilePrivilege	5076	msiexec.exe
Token: SeCreatePermanentPrivilege	5076	msiexec.exe
Token: SeBackupPrivilege	5076	msiexec.exe
Token: SeRestorePrivilege	5076	msiexec.exe
Token: SeShutdownPrivilege	5076	msiexec.exe
Token: SeDebugPrivilege	5076	msiexec.exe
Token: SeAuditPrivilege	5076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5076	msiexec.exe
Token: SeChangeNotifyPrivilege	5076	msiexec.exe
Token: SeRemoteShutdownPrivilege	5076	msiexec.exe
Token: SeUndockPrivilege	5076	msiexec.exe
Token: SeSyncAgentPrivilege	5076	msiexec.exe
Token: SeEnableDelegationPrivilege	5076	msiexec.exe
Token: SeManageVolumePrivilege	5076	msiexec.exe
Token: SeImpersonatePrivilege	5076	msiexec.exe
Token: SeCreateGlobalPrivilege	5076	msiexec.exe
Token: SeCreateTokenPrivilege	5076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5076	msiexec.exe
Token: SeLockMemoryPrivilege	5076	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
752	ButterflyOnDesktop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	AgentTesla (1).exe
5256	AgentTesla.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3836	1280	msedge.exe	79
PID 1280 wrote to memory of 3836	1280	msedge.exe	79
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 1928	1280	msedge.exe	80
PID 1280 wrote to memory of 5032	1280	msedge.exe	81
PID 1280 wrote to memory of 5032	1280	msedge.exe	81
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82
PID 1280 wrote to memory of 1792	1280	msedge.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://roblox.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe212c46f8,0x7ffe212c4708,0x7ffe212c4718
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7764 /prefetch:8
  2⤵
  PID:2572
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\JJSploit_8.11.2_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Users\Admin\Downloads\WaveInstaller.exe
  "C:\Users\Admin\Downloads\WaveInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1852
- C:\Users\Admin\Downloads\WaveInstaller.exe
  "C:\Users\Admin\Downloads\WaveInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2532 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8044 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7896 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7768 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Users\Admin\Downloads\AgentTesla (1).exe
  "C:\Users\Admin\Downloads\AgentTesla (1).exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:1
  2⤵
  PID:2312
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7940 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1692 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460
- C:\Users\Admin\Downloads\butterflyondesktop (2).exe
  "C:\Users\Admin\Downloads\butterflyondesktop (2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3412
- - C:\Users\Admin\AppData\Local\Temp\is-VATD0.tmp\butterflyondesktop (2).tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VATD0.tmp\butterflyondesktop (2).tmp" /SL5="$120246,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop (2).exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:2176
- C:\Users\Admin\Downloads\butterflyondesktop (1).exe
  "C:\Users\Admin\Downloads\butterflyondesktop (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\is-UMEFD.tmp\butterflyondesktop (1).tmp
    "C:\Users\Admin\AppData\Local\Temp\is-UMEFD.tmp\butterflyondesktop (1).tmp" /SL5="$20362,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop (1).exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
      "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html
      4⤵
      PID:1988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x148,0x14c,0x128,0x150,0x7ffe212c46f8,0x7ffe212c4708,0x7ffe212c4718
        5⤵
        
        PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9176 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9120 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8836 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8788 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Users\Admin\Downloads\Alerta.exe
  "C:\Users\Admin\Downloads\Alerta.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5836
- C:\Users\Admin\Downloads\Alerta.exe
  "C:\Users\Admin\Downloads\Alerta.exe"
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Users\Admin\Downloads\Alerta.exe
  "C:\Users\Admin\Downloads\Alerta.exe"
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8968 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,5050696011337581708,1033164773530370947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596
- C:\Users\Admin\Downloads\Ana.exe
  "C:\Users\Admin\Downloads\Ana.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\AV.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\AV2.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\DB.EXE
    "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
  - - C:\Windows\SysWOW64\cmd.exe
      /c C:\Users\Admin\AppData\Local\Temp\~unins8437.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
      4⤵
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\EN.EXE
    "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1312
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul
      4⤵
      PID:2524
- - C:\Users\Admin\AppData\Local\Temp\SB.EXE
    "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
    3⤵
    - Executes dropped EXE
    PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0E145F7643B167A70554BC6640174960 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:5164
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5584
  - - C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6020
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6100
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6128
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3520
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2288
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5272
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTJBREE5MjItMzcyQS00RDg3LUFDQkQtQUQwODkzNTM1MkVDfSIgdXNlcmlkPSJ7RTQ2RUM1NjctMTdDMi00MURGLUE5NDYtRUU3QjVGQjRGQUYwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBNDE4OTFGRS1BMjhDLTQ0OEItQUVFNi05M0IzQTYzMDMxODN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ0LjQ1MjkiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxMjUiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQ3LjM3IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS40MyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTc1NjA2NTg1MSIgaW5zdGFsbF90aW1lX21zPSI2MTYiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5376
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{12ADA922-372A-4D87-ACBD-AD08935352EC}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4040

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:4140
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTJBREE5MjItMzcyQS00RDg3LUFDQkQtQUQwODkzNTM1MkVDfSIgdXNlcmlkPSJ7RTQ2RUM1NjctMTdDMi00MURGLUE5NDYtRUU3QjVGQjRGQUYwfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjkyMUQ2M0YtNDY5Qi00QzBDLThBMEMtRURGRkJFMDJGREQzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIiIGluc3RhbGxkYXRldGltZT0iMTczODA1ODY2MCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgyNTMxMTc2MTc5MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NjI0NTYwNTEiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4092

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

Filesize
3.0MB

MD5
81aab57e0ef37ddff02d0106ced6b91e

SHA1
6e3895b350ef1545902bd23e7162dfce4c64e029

SHA256
a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

SHA512
a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

Download Submit
C:\Program Files (x86)\Butterfly on Desktop\is-K7QOD.tmp

Filesize
698KB

MD5
1fee4db19d9f5af7834ec556311e69dd

SHA1
ff779b9a3515b5a85ab27198939c58c0ad08da70

SHA256
3d550c908d5a8de143c5cd5f4fe431528cd5fa20b77f4605a9b8ca063e83fc36

SHA512
306652c0c4739fce284e9740397e4c8924cd31b6e294c18dd42536d6e00ad8d4c93d9642fe2408f54273d046f04f154f25948936930dd9c81255f3726f31ee65

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
8f7c44e937ecc243d05eab5bb218440b

SHA1
57cd89be48efe4cad975044315916cf5060bc096

SHA256
bc3cdd57a892ce1841787061e23e526ad46575460cd66c1dc6dcf0f811563d59

SHA512
9f0020b81d1945fea12efe1a0a5e59caae4a01432429e065e35c73b15db873253094b2ff1f8903a348446dfc9c9fb658f8bfed8c25bc56e8b546c16304a385a3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
70cc35c7fb88d650902e7a5611219931

SHA1
85a28c8f49e36583a2fa9969e616ec85da1345b8

SHA256
7eca199201273f0bcff1e26778cb535e69c74a69064e7759ff8dad86954d42b1

SHA512
3906ddb96b4b1b68b8c2acc940a62c856e8c3415a1b459f17cf2afc09e05751e0086f8e4e5e0ddd8e45cfb61f811bbe4dd96198db68072b45b6379c88d9ea055

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
714c34fe6098b45a3303c611c4323eae

SHA1
9dc52906814314cad35d3408427c28801b816203

SHA256
fbf495968c4a385ff0790e6b65d26610ef917a2b36a5387eff7ae79d7a980ac5

SHA512
68a65496275a1511b2d3bd98ac5592cb1c1eb9df0448471a8985cb2f458c66163e6d55545940de72dea80118ff8ec7ba0ad3276f51095f55c1243fb9f3311345

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
c8b26176e536e1bce918ae8b1af951a2

SHA1
7d31be0c3398d3bad91d2b7c9bc410f4e45f37be

SHA256
be6ab7dd506e44a0a9eb0dd531929bd8aa0796d85a0353e6944bc6bf1630b717

SHA512
5a362cbabebbffbb0797646576b65e2934a3b0a30306d74078ef2448fea3940df14f0b8f149691a100cc170bd548c9b420dcc8aa41eb1ea0700c9f155626c565

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
40cd707dd3011a9845ff9c42256ea7e3

SHA1
4045ae709979f75b1cf32142c1137b4be2ab9908

SHA256
9f4c7072716e0be1be08207a7024a5e41162e288e677d805be8e5469a8bd4909

SHA512
bf1ada8a0d9c3d9f39fb739d05fc4a61f0a7e0e1bb5eb44e6f0f5f58381ee6d80aad89dbc3211b70a6294fc69d5820c70fa8488ef2f793a3710ecff5ee90422e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
e91e279752e741b25cf473338d5aac88

SHA1
2b8ea61868a26408cd1dd351cca5139a046bbb7b

SHA256
5635ecedd84330f070a9d6f4cea8b8b81e9dad8592d336ebfd236b7d67e58acc

SHA512
7404cdb82309351a21415b045fc7165137492aa262d00fd0f74bad4262ce10e86c3bde1718c38757b7133e41d044035e731c52cccea285d659c4a570776ae535

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
bd175cb3dfc1d43944223bd5d7177539

SHA1
193623dc372937f31a545344d340360665b8d69a

SHA256
bf0d65cebe0c29f15a616a0dda2f1a414e3f96fe7a28ff7876e811855be6621b

SHA512
f5742352852837ce16f3cf1655e4d41e301f0351b68c7346457978aa310b95b69b1070741fc2ab8be5ff449f6fd44660df3b15811630efc1420ced1455fcaf5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
42015aafd53012b9c8afa009ee501fa0

SHA1
c1fc049feab4fb4b87faf96c31b3d1160f1c1d39

SHA256
86858a1807e6cf0b91565ed7a5a15db24720b0a7f60ae41e67dbf9faeb6ef2fa

SHA512
9ce323da000b51480ee35973872fc7d181e1f69e820ac737c62c36eaa81eb99965bae39fdd394459adfaf8f746f5dc3b768015e01d8724e2d0718f5286c29389

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
8a54873d54a41442b62f9fea9492d3a6

SHA1
fb19af151b15f4bdb7a555924f1835b0337ff1d7

SHA256
af9bdd050b27b8883f72e3596179fe244a6a2e3545950c82889aac7198cf3c32

SHA512
7cc0a578586853afd027264c3898cb1460b23a47eab9c79e064b9f327fbdee6e3f9bc7043a5a76a710ada05edae4ac0b47529be3ae67ca9b5afaaa16151797c7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU1524.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
cfb71031c56d9e8b9490d01fbe86302c

SHA1
9e11ecf5efc88e0beee1db46620bebc73f86dd21

SHA256
b18e14d0e24546193822b83996c5b311500ca213beb4d497cbd1dda9dac9db2f

SHA512
9cf993ea53673e416eead78d45a6d700b74001b69b1b987d479e77348ea8dc151f4ba6d6b1220db21ce792f9da51b9c83f33663621f9350b848a766ceae92370

Download Submit
C:\Program Files\JJSploit\JJSploit.exe

Filesize
10.2MB

MD5
ac90656aa0e7a6c9740d42de9eb9067b

SHA1
7fc1cb3c443a74b1a225745983161371e69418a4

SHA256
0cb87057fe24e9139ce49dc5919c03dc67016c0ca740e4fe73751dd8f4881234

SHA512
6dfc03ceba3e27cb137d028a8ee7621b4a5c68a8de892e7527eae79941144b0799704a1b5595535e353e625b3795a1c8dca81a10ef5bd6e738f0b696a3a209fc

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
61KB

MD5
8ae8b558e488ba94a66a295b96466b7e

SHA1
ac48f878f64bdfa84d57794a927cc65a20c6630e

SHA256
db8dc3b2cf3956b88118d0d02ee08d825aa72ec733fd931681c8178574d42555

SHA512
658b56caf39f934b6c650c7fc338eef06502da07e327b075fd794d86c7403bbe53218fd17172d41cc07d3ccc8568c9efe6b952b79c2ac15ba682b7b572954639

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

Filesize
1KB

MD5
4e949953c29a5518ce2f5ef5fa69a03b

SHA1
2d51aadc55eb31bba1e4e315c7c62e5e8d7f6229

SHA256
f2c5079e2e6649ce89d118c9b49f9a6e3060f8afc79d1170161b5b43b283a17e

SHA512
7fc590fe9faa28c40e89d2efff6bda8b9792189758ffc8a82dc96ac341b8f5d4fbaad005083d81e5c140579b99596efa461f73d83d068efd91b2cbf4a06c2572

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe58e3d3.TMP

Filesize
1KB

MD5
00126a7f5e589adb2b131e16ac192faf

SHA1
89f48e8ffa7643fff0e072ad986f5ea8b99ac327

SHA256
582b3d2512e65d024837858ad9f85cb19cd47083682c3966d2b6d5b9fb3abab8

SHA512
86bdef41ce31351000a875a56c0d5d604ede9e2726043e8dca1e2a1653856fa12332115c5371700fc799c9e5daf2a145e421d3e47a65f2606f8dbb413de81962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ec94745cd72f974e0497aa41415bad9b

SHA1
d21ff8668515f2a51aa6a746b3fa15336fc62b5a

SHA256
af45c7c9220e3798ec9208de192ca021515dfba1be3caa38836c6d6d5d3d75b5

SHA512
7ecc68f20c8cb104aacdcb02ed78225d55ac97fe617acac03a4da1650e0066993660cfc9d9d164a71f4e4713f11754c1006c7a43d3462bd41b9f3775a7dc65ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
134KB

MD5
ed8f4fd34aa1ed499fe442dc7c57cbaa

SHA1
36ec045adc9398e4bf75268fbfabe904f240a7c0

SHA256
140145d05579361f90f1f79965c85170c49bd73955aec461518740f369d65720

SHA512
1f29679f5e457e875a47182cb1fa62537c0b94b92ca1ebfac4d09e42efdcd512a8defbd2122275cd739fa22132040dcbcc4172e5774d88f38e68512ef5be8dff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
77KB

MD5
7f36659c73efdbdeeeb3233583194462

SHA1
4ced7c2e3fe2edfd3d0783d70c3a4bca304eb7cb

SHA256
051b7d9b30156efc1df9481d0e8cd4c801398fcb4979f7e4d50ebf2c4d106820

SHA512
89e0f6e794962faf5112bea984c71517503ab67a61785dc7f55e1c5f7a2f890a931ff4426964ae9dfb4b1d56d795ccc6b661d10fd7ed644f1013e02373a96c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
52KB

MD5
f07410b8aeda72802ac0b8f26ac0ed18

SHA1
c24f7469fb56f5ab6cc229c9ed61bde9283c6766

SHA256
2d289effb1db2a9739c025a205c3685f946dee341050330097f8501cf3498064

SHA512
e5164103df741b0b7ba88c5c15a7b0701e79f8c6ad6400deed826287d42a13ec5a6116db22c028502a4cbae690b235290bc74a35b2f1651f8c396f9476ffdd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
31KB

MD5
b987f4658766c9009a5a56c4bf08a37a

SHA1
1cda3b3beb4152ee43d0626be7bbd051fea18c0f

SHA256
443c4dcc4ae43f97261b63ca955bd9148c618960f4d7a3b112063b8dea0a7d5a

SHA512
6dc257f2b4ab7ef548f42c59c17536512802f8b8784980f6c9b5472734a46025bcbf17a402ba0be018665cbddde21ae9bad37fc56f8a6d7f49f7678b0edb21d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
142KB

MD5
9d13a06eb9b1f578bf6ac5ab201e1a3e

SHA1
ecc39bc51553187f0c148afdf3a40c9c82b1d8cd

SHA256
7705ee681a7ee3e6f97b524723d9fc8c88ffc416c6d5f1f4727b1828e7a32039

SHA512
0b3370515f555508cb6b050ad72259a8ab24e13dee9370da483f6cdb2b2b82216776ee34e02a3bbaa99b98cb7e8cfa4eaaf4b28f71b5b3b6f17b82b56aea830c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
48KB

MD5
06e32a5d1e2d387ce562ee7aede8192d

SHA1
67f9d64c29663f6865d0d134db189938a92503cb

SHA256
46ec4156584d2cfcd0ea2dd2eed85a0545ddf4e30a8c20c26b2ff3fc7c065317

SHA512
0d1de74efa671be757ac49d1b864ed89cca90bd56114d79432ab91407ef5987d4f4573ef3f2e307b32601ab335a43f8cd1860954f986dd5d887a02ae37ea0717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
26KB

MD5
c9a44eb6dc1c77a9a2d988768c9fd5c9

SHA1
f352d7ed33ff0d8361be168a6b5300288d91ef78

SHA256
675b4a74249edb71579147676a8115b662a915db9fd24fdfcaebbb0d7618c62c

SHA512
81534ba808f32ade00a81349612c9b905914004c3a8d7e53e9993170ab5957600dd49d9881284541240181987ffc76208acedfac24bc1e8d33c99f003c65fbff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
4fa02ac6347763639aeb01d8adf287b2

SHA1
8cbf6b37f0cd329ba5b4f4f59437c55dd3057b37

SHA256
ec23a39504c8b289a6401723dd1a5153e9072e5f5beca20f88fac54ed3a477d9

SHA512
371e4b42152c578090254323dd4846df1ab38ac6bcff8ed6b67143dbfa5111c72e64366ac24b6ac04f3c405ce22e5f50f2a04e1805cce8b22ee8b95139a53afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
50KB

MD5
47abd68080eee0ea1b95ae31968a3069

SHA1
ffbdf4b2224b92bd78779a7c5ac366ccb007c14d

SHA256
b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec

SHA512
c9dfabffe582b29e810db8866f8997af1bd3339fa30e79575377bde970fcad3e3b6e9036b3a88d0c5f4fa3545eea8904d9faabf00142d5775ea5508adcd4dc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
20KB

MD5
2c452b92c75c9673203c416fa3d19286

SHA1
6244774c72954d187a1f061f04b4f208c0bcb445

SHA256
51d9310ae3b6b9a2c4e73884584473d0caa997c9b81de92ab2708794b165651a

SHA512
c1af34737ce2ca96dce9f67f89db36e0e55eb2949b552cea2aa01b6ff769c17719742fea2b26690183d9a8a2fa64368b1fa531b4ec20c6dd42f08c8c6728f972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ac43296cbba9b5f05b001b66908e62f2

SHA1
1aad5e6e132d9c4cc999c3121ae57b36cb22fb04

SHA256
6e464f7fc6bd477a4b9dd06940e4a254a356092d752d21b76047514766416e88

SHA512
634f3a31821c981c1ff9840027a976b6ba0644dc56bb8d7711713cb9d05f50134677e0f9dad8220742597e78f8249e76f46d4207b01eaa36ccacb79cf64a8a5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
98ffa974cf74c4b40cf7f34881a46c80

SHA1
2029f6039a1b2123e378cb6e5c14a9cab3dde82a

SHA256
3ce36510151cae46b31695c9c6a3b25cb0bbfd725d9b5ba77a7165340d3fc8c8

SHA512
271a91d5f10212ffe5ba1a452e97aaccce9046bae85e809909d6240dc6ed7456b6acd9d280ef1f023dfc948afdf8d37e0b46fb2200ef02de8aebc1cccb6ed088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2f7e7aa8ab4a0e9988907b11cef8171e

SHA1
de79a11a0260ebc113a9fd36dc72f75e48fe324f

SHA256
48cafc75d99141bda4eeecf77662268d76923eb2995408e2202fda1d2bc3fc85

SHA512
7201e3c95cd627eaab7ab511d338ba49692040df7796986f83aaa76ee3531878410ab153cba8bfe5a776ab5f3f03072bc7bdbb1ab7174d524cd7b9fda02f3d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d1afa6bbf31f62634d3ea37384afd4c5

SHA1
3d5f24595c6d937084391dd6a9bdad4d63d2ba76

SHA256
c76e1e0fe4ac8892ff79e52f17f0b5cdab743431ef584e173b6cc6ded39910db

SHA512
ecf5540da47d372c59a419053892164bfccecc5cf01a24f50469e2228700dd6f8debdf8849bc961512b5640d39f6c72173951282f1d66b751d89ed4bca6b1be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
5b9262ae734a41e6a068b4db173cff78

SHA1
5a7501387bab4b08f656d90b463842c49a579f39

SHA256
d34a41873db9108768fad6c9dbfad22e9ec5e2b2d5aa18fcd6c8857b85680ccb

SHA512
cced8844c030ee117ff35ba515849005e0785023f6f63e64f2a5947f8fc29b4acbb957496b9e1855a175ceecdd282fa2f04d0066d1c15dd5c64506170d082d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
f5794e3dab33a17f5a6bd99e87a34483

SHA1
307aee77e67f2c779da5c8f353ddcbb5f7b24831

SHA256
a90cdd26202081d1b1127e2e396248b8112c649cb2285ba1379e167e746586f3

SHA512
4c1a7a42cbe714175af446f957c12b7b4d6f3566b2ae5e582309e5eca53c9407bdebafbe5fc2595b3886da4e1b85bf7c0a39be8db0b1ace5a987adf906aa00ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a3865edc0905cd07dded1852680393b

SHA1
436badcdba8e1f23078fbf5e35618d7977a58cf2

SHA256
383aac70d6d2d1fbb809020ab6bd06235adb9c51737543de4c3d3e9ee48f1d1c

SHA512
31849c4da05c0196c6a587cdd9bea3a6e2aa5fef1c98464f90cd791b2abefe9fc389cec487395596a96b8a929c980524e9c3b42d1f5dd4ec5337dbfb7458c95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a42e143ea658e619e2ed9321f6cdd83a

SHA1
245c5f56a8755c3fd6b882c34a995c9a030d604c

SHA256
01dbe89a0a4adc29246a351de708b5f1eab818f914f4b0a8ab3ed9372cd8a662

SHA512
8a498feebbfb9b9881d452d87c447ce29cb3276239387806d26b015a1d4264047006bf068885f6798d2599aa5ae7b662e6e02856bb41e67ed7a557ff34c5b2ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f068203b2799c449eb3e8951bde758ec

SHA1
0f4e968dd81a7b0b39b48ef0b051210d354cb952

SHA256
202c94112a4d4f0dde4800ad4eda090b6137756ad3cc049dd38b19ec1cbce12a

SHA512
2efcee428dd9e0763bc17273d4e1e8414f8c1a24caef18c6c3dcc2b835012ef286e4a6caf145d4710601442262f2a0031aba49ba9ab334247d7075b68539f163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
942ee81bd02abb91072caef487a891eb

SHA1
cf799cf6995ecbad519f2f35fcff71bf37ba62ec

SHA256
7c7b6ab823e840458d431a4847d16f73654ec91f9ad7f39faa5d4884b7306497

SHA512
261494ec9fae1869a9815703918165228ba1c2c3d35816152d3382c7a9738528df60fb3f06168c7897ae679755dc0ec5cc0e1a8307fffe4a99e394004b81fb17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
edb7a6abc4fac2794b4a00b46f366fa8

SHA1
2affadd091647d2841633ba8efcd88f52fbf2479

SHA256
464dc71034bd85b4d8c659e7da1728bdf8be45c28f9a29ab0395c71affc578a4

SHA512
1fd704c15308a763611370bb435434c0b4d0f805b8887098fda12578a02a37808855225e5c437a7b1d7e16c7b021f127158f71d8da5f877aae117ea341e6b905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8107092d934f3ec18cf91f938e14e374

SHA1
c8e85e5dacbfd1bf93c50ecac165baeddd5cf145

SHA256
e30e125a3854e0ba390e4af7f95a386f2d44b1040e5ec39a6e15aac466431da9

SHA512
7474bac131c77b444e9aadc24f5150deddec3b6f8ba537419fd4c6da51ba2b7c71ed3915728f91ba73161cb913335aaf663be7e39222aee3782a441de173976d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6585b1293f39fcecb36b00a95f36a13c

SHA1
e24385130d301d34f4e684d7eba9325984ce725b

SHA256
0c080447053d082837b1167a1e3e48e82e7c8c2eee279b3e17dc49fc69520596

SHA512
f25cc35350baad129b159d0095211b172b933ee790482f34bd6a3f469403fd96f986104355f83ade1b483848352e08cdc7e2cc525d26a9bb5b4d03ffaa9268b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1946b0f9c592b39ba666ac76bc8bad52

SHA1
77964c782fc184d28e6a6fa3e0f17b91b0f5c73e

SHA256
fde406e4ef248bde0a5e7a4986a1b370b291c31966d4b4321e7b58f525371b5b

SHA512
6b244518460d82ec93233ec67dc45a1c8515bc82aca43039a423b1c1afb6d434a8b14f59e16062540484d5f24fece104809dd00993350061d8dfcd6903739080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4ace834e90594310cd483b4bff729214

SHA1
b332d3d6c476fc51d9c2dd06a629affd15b3ad53

SHA256
06d1842f4919bdde59d8e37b1ecbf82e385a3fac58bfdfd2e19184ba3022199f

SHA512
78ac9e63ed5b8d6015357605b54445ab08668a8963887fda7585cc0ddb7aa32f0b3a6f4c1b38c7b01a1eaec28e73fdf15cb41392409fa1948c475d568d6a5e5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de17c0f759df55267bfad46091ae261f

SHA1
972853020e643b2e15e6973654d942190b2dde87

SHA256
61a920f39966a3eeea5b176af9913cc563dd601121776cad5f468770d0f97834

SHA512
bfdd9071925fd7b335aa3fbf6ac7c5942797f910bda3c777a60f552fa595c928f54277431d32836347a44278e6d794dc4bde81d235b6f9198269140f918fd197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ca907d64c4c53eb7f3eae60e053f387

SHA1
6e7bee8bdd466741ff03ca8aa60b1873ee83fe0d

SHA256
1a484f268419f456198694c91dcff34c10ef9e67269a32943263eee74e4595cc

SHA512
81e9eeb2d18f64c9a0709e53294a4ff735d7a074ac8d15842018855af4e765358827047b818e6f31aaa9481e1f868b38c948a8d4eafa1b5190e088a05aaca56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
489401c772db86c5d08708cc672c3628

SHA1
f3a1b20be6fccb40b86ee5821a49f742daaae771

SHA256
a9d1afa1165b063452f0f6a3b6bac20da3fca64af29a76db557456dd4fd34576

SHA512
c7c3e91fc4c057b616f7464657240f805943c8ab0ee1d6b696c6d7b0ff372ad4f5d30a7fba6689d5802cde8d3dfdae9b39750fb2b24c79a2fcd787bcc34c477e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
353a91aa3701a0216813ec50a27d4be4

SHA1
88386416779198717ffc1e75da1d29f0b0fd6478

SHA256
3c7dc3f07279952d856f12b81e742e479d19c71977d66c48a292c1f8023fb349

SHA512
20efc7eb2b8b6f6e74896fee82097206876ddbb7ba6d8edb1a6c7f3c40d4de8e0cdb59acf2e52916a7d82d0d9a6a2297d7669511756462c1d54eadb40e988e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f30f41bae50b3dabbb78f69c9518c0f2

SHA1
14b8aa1ee51cc63eea45dc505e153207cde85d4d

SHA256
4b51b9f499ede272899680cfac161ec2ccdcc34495b9fa4571bb9a84c32c9657

SHA512
80ed88566c3dde7b9c5578f60d8e71f93c39646d226c63deaa439f279ac3f6535ab2fe2ba8dc689e3ba00d6900069ed10f9a9ebde8e4dcda44470fc67b05db00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
177c2a4143a4350f1e3a97239c2fef95

SHA1
d4f2843a7e869c71d4a2c703f8996d95e1bf0f98

SHA256
05b9b767c80cb461e93deb06eb3ba2ad5129eafc71462a168265ebb20c6eb18f

SHA512
25909bb93b6c9f59a75f0fa805b02d7322efd457a1a0f714603d6861374b14e0c0c22f6ac9953ecc9fceea16e95d028a72cf2b1e243bd0653693cc34ef8f95b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581316.TMP

Filesize
48B

MD5
e4e2a682c5ec6c3238af8271cb8be578

SHA1
e411efd19c1d6f9d9df782e6b014b6d1cf3f9a0a

SHA256
ff1886573e7ffcc4c550d7d3c8d86ae293b5d4090f80e4f680fbf4febb60a837

SHA512
5c79c3193bd2eb4d02fabd1fd974d6c3b7255f0c69e23a329dd46a407ce88e47f18dfe16686cc799f9d7a0e3a48faf8f35c9bb46bb22cba428d11a7f13b93c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3ca3ee86bdfedcdd2d9887e5e8a87699

SHA1
0b0b7941e325ba8fe8d60e63480490eb4310a42e

SHA256
1ef4f2ce39cded2569b2a328db67e12c9ba535e550ba340cdcbb0002f7cc0114

SHA512
2131a3bf9d8ea4ca519dcc0ff554591f81e8f3bc0c336a2ce321dbae19b15099dd90d4563d74e4024251cb44f3f7228352bc65b80d8cec66c055bb401077f811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6ff6c4db978226cbad700070ae5aa2d2

SHA1
bc5b03b5e5c782fab4a6fc15a020dd107d27c0b5

SHA256
64d8a580768eb39072b5ba422223dad75050859c44c64cb916e4cb91a845d667

SHA512
c70cb137ef542b485ee7eb991c1f1c49d6d929bb64091f8641874a9ab3d1a5383123a4264b04f85944712cc1f6dcc724aa132f0da0b68aa54ee3a58e0ac2434f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6baece7d6e5986f9ea5d0dfcd5327168

SHA1
236c932d5d12ffdda5b1bab246bc1edc8c350156

SHA256
89e14ba488b40f995f6e4dbb97b07321394afb00f3715719f1ec66e7d9842e02

SHA512
c9a1f74a655aefc255792021bf98716577deb5d06ee90fb06c836247cf85b2eff01d73347c1a2fbb6009d56d65dae0b87a7a4b69577bad2eaee1516f14ad336d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b8a434ac4703635883947b15110c00bf

SHA1
3b2420d1fadd716da0d62fa1414a9d882abe28d5

SHA256
9affdd871c25f9cf5701e2a67dc7a958ceda7a63e210f89a7179fe0da2d53ee5

SHA512
4dad791efb71512d84f2bdcf18a7ba52183a66aab62a1f5a88906008191b6611c92fc805c2ba98e3d68d46229526a42ce6da7db0be12568ac7342e24d90e1354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0c6e14183f9ad5c3d1da3e3274d6b92b

SHA1
77387832ffec33bb660e352ab9f45b2fcdf7f7f9

SHA256
112301ad21de7cc945a2ea34d7da638ee344c713d3c84b15af1b6b0b633eb470

SHA512
8ecd2bbdb302bc3598a1b17d0af806e903024f5a3be95b7c7e0a1798cdecacfde30cde2df870db211a3446f8803546cfa0bcfca981db2d7f471a0d84a36b893d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7220bebaf571a31cd6e196829984eb35

SHA1
9f4c487e0f43ff9d3bfbed5514b99f2b5cbb09a8

SHA256
5d0e6e1cb6a314400b560c34005a61ebd7e55f61cf1028e30bc75fb284385bc9

SHA512
77026b608692e4f05ae68b63444454365ba5b76a0faa448afca3d5d4ed80c9ec5531ecb27e0c42db6bd7757ba9935d530fcc7528321c068367e15fffe201c1f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bd527fce2af32cacabb034e52db82134

SHA1
ec024fd27a435d96331758a873c4275d3d6e875b

SHA256
69bd31090071f5af850cb8f835927baf7f63f39a9660709c01203e7c203bd5c6

SHA512
e7aeaf25a64ba163deb51fde29059ab1f33fbde1eb28e389fadcfc516b5c66e72a1cc83a420d7557cc60679827fbe761c2446654845346a69216761edca245df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c87a53cc235436050edc8832ae4c7ea4

SHA1
68fa3032465c2490d2445d304f28ec4555c93baf

SHA256
491945c0a692be4b4eb151ec4147d414e849dfa6f43fecd0a33c2c3bc4d6c2bb

SHA512
75a10abd53e14e5b124bc0be65ea0aebbbdff92039be234c4c42eda50d2e4b33d3588cb65f924eb557893ac50e92b5f92752c27bdbcd0ad9c2871233364b8c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
01021e98a2c29ebb0759e63adca756a3

SHA1
8d7492f11e85ab8fd51bd29677617cbee4f77325

SHA256
ff5a345d618058447ed536230d7bc4c6b6cb63cf42e08cca9a3fef930e590364

SHA512
8dc254f8bfaebdaff3858692cd6e9ba4ff7c71122917114bd5f920a3624a9a75d4bf1a437e189333fd54e2044ec7e824c71ceef8d23887680460c525fe9f245d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0749178bedf5e23dabd9ea24b918c7ff

SHA1
86c605a3968c2850e14ed9de91d5a7e7e4f65fc5

SHA256
49ffa23b41c21d3b83cb8fac8a2a5367d6dffa7c2a17bcbc06c876eddfd3968a

SHA512
a4972d2e1188cd3ff1bdc98935eea9a27b1a1ccafbc7a1fc679229e4684eef8493de69225d5bda469c538b251786fb033ec244cc17d6b2b46b62feac7d72d4ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3482bb879eb1294d0efb6a5cf6af210c

SHA1
75eca785c33b2e6f9b8caeb7eaa6cb5962a124cb

SHA256
be91ac158e5f22d7d73ed66ea6ec5edd8e45a22f40472a7d152517e093700f1c

SHA512
d8a492e246e3e23f2e2d32c6909cb4f84cfeb833f3c2a5fa737cdf02944da362553c9ed7c72e2d7835da1a1ffbbbb467927336bc717eac395005028f3483992b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6fb4367134538bd888a5d7c3fb5d7898

SHA1
4007c15f9456e56d60fc0cad337166ffd18a4c6e

SHA256
fb564a21ca113326f32baeb64b824bc38c5e3bae965bd8ddea2a7e979fccbcc4

SHA512
f06e49859ba0d562dd2a478f8fcc27fd347d8dddb7e2dbd5150867ec4007809bff6148a5295c7324b4dd36404b6e13cd1c09ef7213277481a06c277aaf4aee93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
707d09fea12005f844b15138c27a6b6f

SHA1
d4941f616832fc188088bbe8c93fa2367cd33d75

SHA256
abcad7e8e45445e7588408926fa9427b43c7a589062471049b226766015ddbaa

SHA512
d8931379c32f76f193dee4d653faee5ac5f6e98fb5aa1061c2d92dd48e1a6b3ce97c2d9d283a3bce8481f21eea7f367588f0af3eeb3bfffea17a09f357bdb8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b5bec2b3e3ed6d21a384e8c8236dedc6

SHA1
5da45798edc559ea733fad14acf21fa695e221e2

SHA256
edf9d9b9efeba5737046c4dd0eef9a38d6303d347e929b0ffa950c32eb4a34bb

SHA512
c2d02035f376c91f971d6dfc6fa52374aa805bc928493a38e689cf4667556ce36955bd02ebe1d4b08d3dc8353d40013904a372ec85f10856db4ea22930327103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e716a8d882252b2eb0cd60b801540ae2

SHA1
4c57c20db45c499de6d65d9c3d4a7eae25de9ab0

SHA256
816d2c8ce64a02867d6dbede66b03d8f3f7930636e016af9590704d1fff6051a

SHA512
975e12183f851f7b2049971580eb9ae971b7d8d82013141ca5ac71f2f96028444461ffec3cafd1e0a4205f50b2f14ca2c61f6ed1c791ae3ea5fee9f710c5652a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3e6fba602ecafb7aed5c40d9a45c82fb

SHA1
c27c605826575ec712ac9de3a8cc17af3f22d16c

SHA256
08758ad48d9b8a61e61f4e1ac8a9f73409849e7674c119b0143490fd2218e8bf

SHA512
80993f9b900a55a7936f88d668eaed96c785d998853d3a0ac23ea1f3aebaa4127fad6b638cbe9becfb009e0de06b478db642117b08b44621fff0232ebe077abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
741a25582d8669a206291f66f29fe5b6

SHA1
b6a87d4bab1e39298f925cea45e30663ee6291c4

SHA256
22749bfb747a967b261134f51e761583ee32c260cbf8159f58aa7b6904062c71

SHA512
a58eac73ca920710d9d5484da488fa58311004249ef01b596b9b72d0ec08ffe86ddfd7bf8e1e3bd7ce4c410e94ad76ad86ae0ce13af65b89130b86180c841622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
738cd6e4ed0303c6702b009b4c584b2e

SHA1
431321f4088b7ac0a1d4fac829252859cf3fbf4d

SHA256
0f9ed4031ec152a4f9df015f6f84f075fbf7119adeab204443df168d8af73403

SHA512
ebb996fe19509f39ec80afb112ca30e985753004f73a90304b8812245e8782c1dee8cc3b6bf2a82130a5d0f6d5e78b9cd8546d5ebebd84a564b93a6dab9eba6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2794b7d64c9b8ba0860b75950c35cac1

SHA1
2046342eb365af7bfa423965635e2f2a857de7d5

SHA256
506896dd8e963e02b1bba49cd418b46c081da8c2057fc4882cb8b6c6d7a2cf09

SHA512
56943a2f3bc47cc097b93ed02bf270e86f7e0a7cf64960f7b8401fe49846a247bcfdb51c4f6f0a985d03d12899fd70415d876f71f45e908c78f22aaa9bce6d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f7bcc77b7dfbdef243855b246e1d3d27

SHA1
5c100b6ea17afb4d24887e9b93c55ef3447a2d14

SHA256
89f88642b481d81e220b3a6d582b8490f525440d352a11ff9c1a0ca3b14e273c

SHA512
1f8ce82a59308eaf3358edc6cc01d789718baec5c39eb3a3c26e785865035591f7ff412d5e010fe355d05befdd5526b6be59691efff7e80a68f9319a07240d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dc6be826cbb25ae0f26dcc9cf34f4815

SHA1
3d8e7fb6d078905ba019a889cac9fa143c46e562

SHA256
85fb4b2f2a866423244ff1493b21e41a9ab58d06b58a10ee66246ec3ddecbee5

SHA512
c4f915ffd622c4d2ecb31e6d47bb62203533f94e60cc6611b61e25245cbef78d00df9a97f4fa4caf3e70adc744ebaa3cfce56f3c254edc0be3ff9d2ed410d9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
988e7b49b504d21234f9ec9cd852762f

SHA1
f63357355f7a5494684c31b3e60f4eb6ed4af9e4

SHA256
dba01680fbface80602074e2747c08eeef45a7b82c36f079764bd2249805e141

SHA512
0773a92651084b379c06a8dd1edeea6e68beb4a1cafb15bf33eb4c665017810f5f8cf84db1703cde92228fd5b053b8788138e09994bfcb848976f432cf50554a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6db1143be0652b7aba84be75fefa35bb

SHA1
0134d5003dc73794f0891089b2999ceccb9c627f

SHA256
a2f3336373aa8b2848c41779a11feb233cbdda443ea1a152f90d628144079478

SHA512
2deeeec85bc6d7e2803c49b23fe2b82b548c27d3b54bee7e9d57eae3ba67a87cbdc716909d00034893a13025f192e51b9bd0fcb0ee774de9e818d10a336316bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fead040abf8782d04fd80e3e6f077899

SHA1
380c9d6e98bf475a6a16c8478bb84f844f261a20

SHA256
b4b71f934216ab114664f1ac7d5edb5e17b68ea331fb837e201a601a1a663509

SHA512
57f8cba1bd4d9064a910b23b029927f1ee8261f47f46fe8cb5c6eb1b1c3180f2ce9237dee157a8e76f22b9dd3898735883f64ebe03f3354835557755071bbfe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0ac2f099e5ada6a43511d4cbc6110e4c

SHA1
4795fe77cd7a32d6070944a379c19afea55f5307

SHA256
5d45dabe2cc7221309a0ce450f836ea2922746e5a349a510987c8af3db8dcc36

SHA512
c7141f87d45e52122cdb7a23b60e74b0eeadac6281a3a001cc4f54f98558264a985112c2c8753f3d16ad85eeb9d6cb912669da207c241abcf8c6ed97028ff8dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f8cdc5c01beb4106c0a59c7a988347cf

SHA1
05e058e82ee87c81e5d055f55b10a364d210f2fc

SHA256
33cc470c5bb2178428f3a1092a14ff7765cc2c750c49199bf408cc93fe530bd2

SHA512
afa82b58458f29cf57e1946af82c3c1d6804ee91447618c28e86a19e28ad1ece783feec3a3f9270406f9de6aa7f8bf622afb5153a17f22668d1b5ba15e276fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d53f35a7255d0a24963b1de13e177c1c

SHA1
63634910d4b0f770aa76ca2a2422a12b2edc1e61

SHA256
fc95343e06f0dca453f479072f32cfd9d5aebaf68d18044ed84796a25fa8f635

SHA512
b920ea9c1d256c9293904fadeb17e2d3efa0d97ce80222ad4514aadf3037ed3ddcb548e8d17f698dca0abc804d689968a98ae76faae281e0db065361926e34af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
92ce19c9c46d1251b20206d0e7e9fd2a

SHA1
8260e04f15ff9bf0f27d5c22de8ebbc0aac17803

SHA256
2c48935d66d88de2d9e8c9a82f89bb28a30b4c7d554e1ca6be9898d7f03aeabc

SHA512
bf737044ad8528f819182ee9fcd76cc3aac9fd1d78fa20dd93e587e3b8fe88ada207a28a1441da6562a68f6778d8711093da33a3f1ef3e181ead67e21bde2783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cc2705bb4f3389576699b332cc64770a

SHA1
5242db71c175c63c97631f4206a3377e915cef95

SHA256
a87bbabd58a6112935c097006a69b1790389a11718516c021ead978494c350fa

SHA512
4b8cd316bfc6554a2256c1f17dd873066d1795f4758252969383cbd0ef59d2e4e6ecfafdc32733aea2d60679b534312e6f8dab37ca840b3c9f4e28ab4ca966eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7e2601dd83177d45bf3a8172d912d273

SHA1
9b6040c3178fe9aa2674ce9218f3d47aed925392

SHA256
a70af39e478fb16089278b8597d61ddf0c3c97cb59717e03af343c4834c7a06c

SHA512
e792d41cd5a246c2f0e8b9c9deca4846fb9da02798b77fc6a1586391a2dc5e66410930cf7b66c6882ba0411471d28504516bd9b9e4d918a73cd47713c350aac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d542.TMP

Filesize
1KB

MD5
6229632ae740a190e4bbabbe87ccb89e

SHA1
45470f9468a93d123683b315705deb783357edf3

SHA256
eccd7a1acee49e16fd14f78c60d7ff4ea518fe749a4a6d086eb5534025c238bb

SHA512
39f8aaebd11097bb4d0a1cb28297127b5fa51b7de9360028923facc20d4b36efb3fde6c7a5df454cca34dfd375fb81353c1a6fca979ebc56ccf499115c8860e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4d3ffdf-fbce-497a-88e3-9dfdeed89b97.tmp

Filesize
1KB

MD5
0258181b465ccc7d98ddde3250033fd6

SHA1
724c9a9ab37e3aaed5e5ea3c51d906078385c467

SHA256
30d2e56e4af78d97f260c60f2257376cbf65260e3b37651f76286f4771a2aa6a

SHA512
ed028a2cd122660fa6a16a4f4b20d6a4d05b024aa9befb8810653b0da72cc21ff704049463f7ca4d2ec09dcbcfa79598e343ecbf56353e1d1d34d62bbfb98ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f3372c8ea037567d2a02a7fd48bcedff

SHA1
6cb4b9f62a20a764a3f146616afdc752556cb8d0

SHA256
8bda1b55f6bb733a54dfd935a3ac103d825c045893350f4d7243482cbcec6e5a

SHA512
017822f9c75b100c8e61e89fe7bbe095f8db6c88546560dbb7fa5ea6f5966833ed29d22bbccf3320998edeefa1e277bf234e679fc21857e52781f4b403999756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33f046fcc9a32c94ffc596dc892e872b

SHA1
19270362d897e91bbb8a586261a3c821b59aa64a

SHA256
bf7a5304cfc9c197470b0670f2b959f68eda5e644735e761cddfb25592e80a21

SHA512
50d8e3130c914d32cad3ec55fa61a8b7961e5eec0a25b38ffda57d5031e8d1d52abdb9691886482103ec48dd2bcecf504dced22addc472dc6999f40f36b983a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c41f4439bc5570194b36c610ed80a25

SHA1
b4602a5aa809c3eada6a3ffc4d5cb6431b54fd0a

SHA256
bf32471e114a6f2f4be41737bca8a816fae5770a2a38f683dee9dfe213e77bb5

SHA512
728d61d96d779ede997ad0fbae30dead752687475f0b5976040e00e07ae72a8831b69df81e1711f07869ee7b39807f4a7f685cd5588c41249da1ab0a6efa0eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f30cc91884c18a8beb9870c51d4b8d4

SHA1
775a7c39da9c2b3df76e7336f88e2cfc57087461

SHA256
6a81d0936fc197de6e7ab6182916de0cbe78b24fbe41a1e3b9fc256d196a0ff4

SHA512
0bc2c61d29b811998ae03c93224594053a7f04fa106f091264d515d920d3c9ac6b8ee3854e7b7dfa11a057d7f1d1270a749c95371f4cfe47b72949e6b8626fa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8dd7b2a36c9abb81a6aa37fa41169ccc

SHA1
40d72592c24ad07b31b761ea7bc94839add420e9

SHA256
65adb6dc16b369827999ac44140901b5c03422e884fc2b66f8c3de57dd6fb540

SHA512
f7476331830b3235e34c7e2f1ff9a80d7fcdd66b16593f7d769100135c0a4c71ada54247e212c0f00a7191f748bfa30df3cc3bb286c7bd07e455d13ccc7774cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a45ede0921a0242b7fc318547a184a4

SHA1
84f65df7fcfb38d69e8c78a0615ee471eb821c08

SHA256
de8c4df46a2c44603237ff366a71fcd9da28c7922cd1ebd720684cf8dc2dc981

SHA512
a342f135ff76de324d4d58118c8770ea660c9412d47f6c7f359f48099e8298e7a8d1b67d46925951199525f879fc50b9d2e55465c37893b20d45b3131b2753fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ceb5679f66430bccf31e66aff0b8a5f

SHA1
deb1f1d4ba861a2e76cf05dbcdef0d15a4d32a91

SHA256
3c16626c04ef4466a7397cf8e2e4eeca529d236f871b324af392519f0f23f186

SHA512
7626012f701923998b5c4ff078b0580261b9b7106a77698c7300204e329dbf483a083baa9026da1d08146ed33131d8175eaeb9e3c33441b613c9df1780c6bf0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27c9534f93654ed20e0e4fdcfc8c95ea

SHA1
df8939cb78f82a6e72f321b4e3a3667fd5778033

SHA256
e0321582500fb19aefec8d0a6bd71e40b5f3388cd41ea234257ab19a8c096467

SHA512
c07613eb80f8a55a2ef2c42f6dd256360ea887d6974e4a00f82d67f29c7521daf95e9c5aee1df2374fd82df6d5ee23462d25b6aac98bacc47a95af34d6123583

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV.EXE

Filesize
1.1MB

MD5
f284568010505119f479617a2e7dc189

SHA1
e23707625cce0035e3c1d2255af1ed326583a1ea

SHA256
26c8f13ea8dc17443a9fa005610537cb6700aebaf748e747e9278d504e416eb1

SHA512
ebe96e667dfde547c5a450b97cd7534b977f4073c7f4cbc123a0e00baaefeb3be725c1cafbfb5bb040b3359267954cd1b4e2094ef71fc273732016ee822064bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV2.EXE

Filesize
368KB

MD5
014578edb7da99e5ba8dd84f5d26dfd5

SHA1
df56d701165a480e925a153856cbc3ab799c5a04

SHA256
4ce5e8b510895abb204f97e883d8cbaacc29ccef0844d9ae81f8666f234b0529

SHA512
bd5159af96d83fc7528956c5b1bd6f93847db18faa0680c6041f87bbebef5e3ba2de1f185d77ff28b8d7d78ec4f7bd54f48b37a16da39f43314ef022b4a36068

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB.EXE

Filesize
243KB

MD5
c6746a62feafcb4fca301f606f7101fa

SHA1
e09cd1382f9ceec027083b40e35f5f3d184e485f

SHA256
b5a255d0454853c8afc0b321e1d86dca22c3dbefb88e5d385d2d72f9bc0109e6

SHA512
ee5dfa08c86bf1524666f0851c729970dbf0b397db9595a2bae01516299344edb68123e976592a83e492f2982fafe8d350ba2d41368eb4ecf4e6fe12af8f5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\EN.EXE

Filesize
6KB

MD5
621f2279f69686e8547e476b642b6c46

SHA1
66f486cd566f86ab16015fe74f50d4515decce88

SHA256
c17a18cf2c243303b8a6688aad83b3e6e9b727fcd89f69065785ef7f1a2a3e38

SHA512
068402b02f1056b722f21b0a354b038f094d02e4a066b332553cd6b36e3640e8f35aa0499a2b057c566718c3593d3cea6bbabd961e04f0a001fd45d8be8e1c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB.EXE

Filesize
149KB

MD5
fe731b4c6684d643eb5b55613ef9ed31

SHA1
cfafe2a14f5413278304920154eb467f7c103c80

SHA256
e7953daad7a68f8634ded31a21a31f0c2aa394ca9232e2f980321f7b69176496

SHA512
f7756d69138df6d3b0ffa47bdf274e5fd8aab4fff9d68abe403728c8497ac58e0f3d28d41710de715f57b7a2b5daa2dd7e04450f19c6d013a08f543bd6fc9c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI94E8.tmp

Filesize
132KB

MD5
cfbb8568bd3711a97e6124c56fcfa8d9

SHA1
d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57

SHA256
7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc

SHA512
860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
b49d269a231bcf719d6de10f6dcf0692

SHA1
5de6eb9c7091df08529692650224d89cae8695c3

SHA256
bde514014b95c447301d9060a221efb439c3c1f5db53415f080d4419db75b27e

SHA512
8f7c76f9c8f422e80ade13ed60f9d1fabd66fef447018a19f0398f4501c0ecc9cc2c9af3cc4f55d56df8c460a755d70699634c96093885780fc2114449784b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SB.EXE

Filesize
224KB

MD5
9252e1be9776af202d6ad5c093637022

SHA1
6cc686d837cd633d9c2e8bc1eaba5fc364bf71d8

SHA256
ce822ff86e584f15b6abd14c61453bd3b481d4ec3fdeb961787fceb52acd8bd6

SHA512
98b1b3ce4d16d36f738478c6cf41e8f4a57d3a5ecfa8999d45592f79a469d8af8554bf4d5db34cb79cec71ce103f4fde1b41bd3cce30714f803e432e53da71ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rrnbiuyy.k2x.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A8UAB.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\Downloads\8188f12d-89b6-4cc6-8a2a-5b4c5dbd43b5.tmp

Filesize
72KB

MD5
9a039302b3f3109607dfa7c12cfbd886

SHA1
9056556d0d63734e0c851ab549b05ccd28cf4abf

SHA256
31ca294ddd253e4258a948cf4d4b7aaaa3e0aa1457556e0e62ee53c22b4eb6f0

SHA512
8a174536b266b017962406076fe54ec3f4b625517b522875f233cd0415d5d7642a1f8ff980fb42d14dab1f623e3f91a735adefa2b9276d1622fa48e76952d83c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 112000.crdownload

Filesize
2.8MB

MD5
1535aa21451192109b86be9bcc7c4345

SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c

SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 167871.crdownload

Filesize
6.7MB

MD5
f2b7074e1543720a9a98fda660e02688

SHA1
1029492c1a12789d8af78d54adcb921e24b9e5ca

SHA256
4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

SHA512
73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 179621.crdownload

Filesize
232KB

MD5
60fabd1a2509b59831876d5e2aa71a6b

SHA1
8b91f3c4f721cb04cc4974fc91056f397ae78faa

SHA256
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

SHA512
3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 247036.crdownload

Filesize
2.3MB

MD5
c0e6411ca102ef84ab6854ecd6fedb94

SHA1
8251590e93f7f7a56a460c77b6009758b67b493d

SHA256
f82d9def7de36f927eba6f597c91a65d1ad2281b4d9999f0b3cd0975e1ce1301

SHA512
dd7f13dcdf3b56f6e509ec7e53207682cc482ce538ec810278bafb39a6f384f369334d21e0524496ee85e688e98d4b18c91794d4ef8d1c153a03020f52fa4d83

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 317024.crdownload

Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 54973.crdownload

Filesize
5.1MB

MD5
a66fca48c491e7240058d45750a99adc

SHA1
6dd376bfcd40d6d66398159adde6cd28adfaee5e

SHA256
c12d33628c068b9e224355d64f118c1a0cd669ef0516ee9dde456f89d35ecd9c

SHA512
f32a0bf3e4cddc5104c960c91fc98a8f0afeb2336dc628d426cd30352cb8d5f305cbd88164e039146e97f56ec91bc350dbc160bd20c93946c4e4985c071fd151

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 558635.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 645181.crdownload

Filesize
2.1MB

MD5
f571faca510bffe809c76c1828d44523

SHA1
7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2

SHA256
117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb

SHA512
a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 718247.crdownload

Filesize
111KB

MD5
e8ed8aaf35e6059ba28504c19ff50bab

SHA1
01412235baf64c5b928252639369eea4e2ba5192

SHA256
2d2a22db20a44474afbd7b0e6488690bad584dcae9789a5db776cc1a00b98728

SHA512
d007c96b2fad26763d27be8447ca65e0ab890deb6388b90cf83c0b3431e09b225f7424098927b54f15fe34eae953b61b45371b0df4b2d89c60be9c006ffe9034

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 829001.crdownload

Filesize
4KB

MD5
93ceffafe7bb69ec3f9b4a90908ece46

SHA1
14c85fa8930f8bfbe1f9102a10f4b03d24a16d02

SHA256
b87b48dcbf779b06c6ca6491cd31328cf840578d29a6327b7a44f9043ce1eb07

SHA512
c1cb5f15e2487f42d57ae0fa340e29c677fe24b44c945615ef617d77c2737ce4227d5a571547714973d263ed0a69c8893b6c51e89409261cdbedff612339d144

Download Submit
C:\Users\Admin\Downloads\metrofax.doc

Filesize
221KB

MD5
28e855032f83adbd2d8499af6d2d0e22

SHA1
6b590325e2e465d9762fa5d1877846667268558a

SHA256
b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e

SHA512
e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34

Download Submit
C:\Users\Admin\Downloads\tsa.crt

Filesize
1010B

MD5
6e630504be525e953debd0ce831b9aa0

SHA1
edfa47b3edf98af94954b5b0850286a324608503

SHA256
2563fe2f793f119a1bae5cca6eab9d8c20409aa1f1e0db341c623e1251244ef5

SHA512
bbcf285309a4d5605e19513c77ef077a4c451cbef04e3cbdfec6d15cc157a9800a7ff6f70964b0452ddb939ff50766e887904eda06a9999fdedf5b2e8776ebd2

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.0MB

MD5
fc95b996076c8fc46ecb9fd9bef324a0

SHA1
4fc02186bd1125c1f9a12661edfd1177fd2bbb71

SHA256
372057ba3a67ebecc26b6bad7c1fdd40a2eb6697236cfaa8afa7561eb0920813

SHA512
abca7ca7b42b3ea845489d33bd088861973a0cd471a1347bee64a26d61be13db9afc11e0123b0517f95fb8d074e5f2257c02aa2e6593c524ddb83244de851226

Download Submit
\??\Volume{5c3600b0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3583b221-a86c-4e08-8f26-665f59f35659}_OnDiskSnapshotProp

Filesize
6KB

MD5
b9c44117afea4b347d8bd9bc2ea1df4c

SHA1
f70b03fc8de48ebd4c469c0ad6793a725a11211f

SHA256
56f347e90f25c32c7759cbe4d2fadfcd1d4ed71d77647be306b55e09265308e0

SHA512
e68ca6c9ee3e0e6990dc4e7576363047c97aacd454333e77a57d6548843cf22f8f3351b5c177da719ff289cf345d9454ab592de9544792d97e4203d2b6a775aa

Download Submit
memory/1312-2864-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1852-705-0x0000000000930000-0x0000000000B7A000-memory.dmp

Filesize
2.3MB

Download
memory/1852-707-0x0000000005F50000-0x0000000005FD2000-memory.dmp

Filesize
520KB

Download
memory/1852-709-0x0000000002F30000-0x0000000002F38000-memory.dmp

Filesize
32KB

Download
memory/1852-716-0x000000000A7D0000-0x000000000A7DE000-memory.dmp

Filesize
56KB

Download
memory/1852-706-0x0000000005EA0000-0x0000000005F52000-memory.dmp

Filesize
712KB

Download
memory/1852-708-0x0000000002F20000-0x0000000002F28000-memory.dmp

Filesize
32KB

Download
memory/1852-715-0x000000000A800000-0x000000000A838000-memory.dmp

Filesize
224KB

Download
memory/2856-2863-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3412-2111-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5164-778-0x00000217E7360000-0x00000217E7382000-memory.dmp

Filesize
136KB

Download
memory/6020-942-0x000000006BDC0000-0x000000006BFE6000-memory.dmp

Filesize
2.1MB

Download
memory/6020-1012-0x000000006BDC0000-0x000000006BFE6000-memory.dmp

Filesize
2.1MB

Download
memory/6020-941-0x0000000000580000-0x00000000005B5000-memory.dmp

Filesize
212KB

Download
memory/6020-1620-0x000000006BDC0000-0x000000006BFE6000-memory.dmp

Filesize
2.1MB

Download
memory/6020-1833-0x000000006BDC0000-0x000000006BFE6000-memory.dmp

Filesize
2.1MB

Download
memory/6020-1855-0x000000006BDC0000-0x000000006BFE6000-memory.dmp

Filesize
2.1MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads