457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571

Resubmissions

02-02-2025 16:44

250202-t8tlcsslfm 8

02-02-2025 08:43

01-02-2025 19:11

01-02-2025 19:11

01-02-2025 19:09

01-02-2025 19:02

01-02-2025 18:52

01-02-2025 18:49

Analysis

max time kernel
736s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

the_watching_nightmare_updated-Reborn-1.19.4 edition.jar
Size

12.7MB
MD5

a718c31344afb79ab44968939d06e8b7
SHA1

dc7ea8bc0398e224c8a7cc13989289071483ab10
SHA256

457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571
SHA512

91e794b814f496ec3b27e30ab38ae2517f024548bc554e3ba607489cefc0823e30fa9ccde0f180dd772668117737fa5a957a0b0503d04edf8c76755a8e7c29ae
SSDEEP

196608:UCpW79MRAwoS6RnRbyMHLXlz6pJ21/bM51ux44+J9ZJi44+pVtSxjXaOzP2O:dpWZMmr2T21DM5184zRJdAxjaA2O

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file 9 IoCs

flow	pid	Process
105	2408	msedge.exe
105	2408	msedge.exe
105	2408	msedge.exe
105	2408	msedge.exe
105	2408	msedge.exe
105	2408	msedge.exe
105	2408	msedge.exe
250	4912	Downloadly.exe
250	4912	Downloadly.exe

Drops file in Drivers directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInfected_newest.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstaller.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstaller.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstallerRC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstaller.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstaller.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInfected_newest.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA	Gnil.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstallerRC.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	x2s443bc.cs1.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	MassiveInstaller.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	Downloadly.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	downloadly_installer.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	MassiveInstaller.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	AdwereCleaner.exe

Executes dropped EXE 40 IoCs

pid	Process
452	AdwereCleaner.exe
436	6AdwCleaner.exe
364	SpySheriff.exe
2036	Gnil.exe
4992	spoclsv.exe
1796	Gnil.exe
2288	spoclsv.exe
4392	Gnil.exe
3308	spoclsv.exe
5096	Gnil.exe
2444	spoclsv.exe
4868	Gnil.exe
3852	spoclsv.exe
212	Gnil.exe
4764	spoclsv.exe
5600	Floxif.exe
5836	Floxif.exe
6116	MistInfected_newest.exe
668	MistInfected_newest.exe
3528	MistInfected_newest.exe
4864	MistInfected_newest.exe
6048	MistInstaller.exe
3192	MistInstaller.exe
3180	MistInstaller.exe
3212	MistInstaller.exe
3064	MistInstallerRC.exe
2448	MistInstallerRC.exe
2604	x2s443bc.cs1.tmp
4912	Downloadly.exe
2264	MassiveInstaller.exe
3556	MassiveInstaller.tmp
5340	Massive.exe
6084	crashpad_handler.exe
3900	downloadly_installer.exe
5532	downloadly_installer.tmp
1512	downloadly_installer.exe
4232	downloadly_installer.tmp
4444	Downloadly.exe
5660	MassiveInstaller.exe
2716	MassiveInstaller.tmp

Loads dropped DLL 11 IoCs

pid	Process
5600	Floxif.exe
5836	Floxif.exe
4912	Downloadly.exe
4912	Downloadly.exe
5340	Massive.exe
5340	Massive.exe
5340	Massive.exe
5340	Massive.exe
5340	Massive.exe
4444	Downloadly.exe
4444	Downloadly.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Downloadly = "\"C:\\Users\\Admin\\Programs\\Downloadly\\Downloadly.exe\""	x2s443bc.cs1.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Downloadly = "\"C:\\Users\\Admin\\Programs\\Downloadly\\Downloadly.exe\""	downloadly_installer.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
105	raw.githubusercontent.com
232	camo.githubusercontent.com
104	raw.githubusercontent.com

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5600-1558-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5600-1562-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5836-1563-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5836-1566-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5788	5600	WerFault.exe	185
5924	5836	WerFault.exe	189

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInfected_newest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInfected_newest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInfected_newest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInstallerRC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2s443bc.cs1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2s443bc.cs1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdwereCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000023ce1-764.dat	nsis_installer_1
behavioral1/files/0x0009000000023ce1-764.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
5760	taskkill.exe
4424	taskkill.exe
3132	taskkill.exe
5380	taskkill.exe
5468	taskkill.exe
5692	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	msedge.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 912635.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 922350.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 918841.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 118081.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 892927.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 319745.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 88871.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 280666.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
4116	msedge.exe
4116	msedge.exe
2492	identity_helper.exe
2492	identity_helper.exe
3936	msedge.exe
3936	msedge.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
396	taskmgr.exe
4272	msedge.exe
4272	msedge.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
396	taskmgr.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	6AdwCleaner.exe
Token: SeDebugPrivilege	396	taskmgr.exe
Token: SeSystemProfilePrivilege	396	taskmgr.exe
Token: SeCreateGlobalPrivilege	396	taskmgr.exe
Token: SeDebugPrivilege	372	firefox.exe
Token: SeDebugPrivilege	372	firefox.exe
Token: SeDebugPrivilege	5600	Floxif.exe
Token: SeDebugPrivilege	5836	Floxif.exe
Token: SeDebugPrivilege	372	firefox.exe
Token: SeDebugPrivilege	372	firefox.exe
Token: SeDebugPrivilege	372	firefox.exe
Token: SeDebugPrivilege	5760	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	3132	taskkill.exe
Token: SeDebugPrivilege	5380	taskkill.exe
Token: SeDebugPrivilege	4444	Downloadly.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe
396	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
436	6AdwCleaner.exe
436	6AdwCleaner.exe
372	firefox.exe
4912	Downloadly.exe
4912	Downloadly.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4008	4116	msedge.exe	98
PID 4116 wrote to memory of 4008	4116	msedge.exe	98
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 3116	4116	msedge.exe	99
PID 4116 wrote to memory of 2408	4116	msedge.exe	100
PID 4116 wrote to memory of 2408	4116	msedge.exe	100
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101
PID 4116 wrote to memory of 548	4116	msedge.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\the_watching_nightmare_updated-Reborn-1.19.4 edition.jar"
1⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7fffa4ef46f8,0x7fffa4ef4708,0x7fffa4ef4718
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Users\Admin\Downloads\AdwereCleaner.exe
  "C:\Users\Admin\Downloads\AdwereCleaner.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:452
- - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Users\Admin\Downloads\SpySheriff.exe
  "C:\Users\Admin\Downloads\SpySheriff.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 /prefetch:8
  2⤵
  PID:3336
- C:\Users\Admin\Downloads\Gnil.exe
  "C:\Users\Admin\Downloads\Gnil.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2036
- - C:\Windows\SysWOW64\drivers\spoclsv.exe
    C:\Windows\system32\drivers\spoclsv.exe
    3⤵
    - Executes dropped EXE
    PID:4992
- C:\Users\Admin\Downloads\Gnil.exe
  "C:\Users\Admin\Downloads\Gnil.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1796
- - C:\Windows\SysWOW64\drivers\spoclsv.exe
    C:\Windows\system32\drivers\spoclsv.exe
    3⤵
    - Executes dropped EXE
    PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1896 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11580485662849673960,12645095988635631058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:6020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4484

C:\Users\Admin\Downloads\Gnil.exe
"C:\Users\Admin\Downloads\Gnil.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4392
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  PID:3308

C:\Users\Admin\Downloads\Gnil.exe
"C:\Users\Admin\Downloads\Gnil.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5096
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  PID:2444

C:\Users\Admin\Downloads\Gnil.exe
"C:\Users\Admin\Downloads\Gnil.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4868
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  PID:3852

C:\Users\Admin\Downloads\Gnil.exe
"C:\Users\Admin\Downloads\Gnil.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:212
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  PID:4764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 27196 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0db7cde-0069-47c7-9813-1e98c25af30d} 372 "\\.\pipe\gecko-crash-server-pipe.372" gpu
    3⤵
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 27074 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cbac7b8-a66f-490e-8b2b-b738a2100937} 372 "\\.\pipe\gecko-crash-server-pipe.372" socket
    3⤵
    PID:692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3256 -childID 1 -isForBrowser -prefsHandle 3424 -prefMapHandle 2768 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58c731a3-c76f-42f2-b23a-8e758896a231} 372 "\\.\pipe\gecko-crash-server-pipe.372" tab
    3⤵
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4048 -childID 2 -isForBrowser -prefsHandle 4040 -prefMapHandle 4036 -prefsLen 32448 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09d6fa5e-752b-41ed-851e-a9a787f429af} 372 "\\.\pipe\gecko-crash-server-pipe.372" tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4856 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4876 -prefMapHandle 4864 -prefsLen 32448 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d611097-6649-45e2-bb23-4eac27f09d46} 372 "\\.\pipe\gecko-crash-server-pipe.372" utility
    3⤵
    - Checks processor information in registry
    PID:5640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5168 -childID 3 -isForBrowser -prefsHandle 5176 -prefMapHandle 5184 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26345706-0d5b-44f4-a18a-be93238b02c8} 372 "\\.\pipe\gecko-crash-server-pipe.372" tab
    3⤵
    PID:1036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5400 -childID 4 -isForBrowser -prefsHandle 5316 -prefMapHandle 4784 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0267c972-9685-46ef-b4d1-ba917bc89a20} 372 "\\.\pipe\gecko-crash-server-pipe.372" tab
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01459df2-b8c5-44ec-a50b-f1dfd30bb85f} 372 "\\.\pipe\gecko-crash-server-pipe.372" tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5876 -childID 6 -isForBrowser -prefsHandle 6016 -prefMapHandle 6012 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee69442f-8d06-4649-8dad-4ec38e56406b} 372 "\\.\pipe\gecko-crash-server-pipe.372" tab
    3⤵
    PID:5344

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 432
  2⤵
  - Program crash
  PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5600 -ip 5600
1⤵
PID:5756

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 196
  2⤵
  - Program crash
  PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5836 -ip 5836
1⤵
PID:5904

C:\Users\Admin\Downloads\MistInfected_newest.exe
"C:\Users\Admin\Downloads\MistInfected_newest.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6116
- C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe
  "C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:668

C:\Users\Admin\Downloads\MistInfected_newest.exe
"C:\Users\Admin\Downloads\MistInfected_newest.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3528
- C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe
  "C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe"
  2⤵
  - Executes dropped EXE
  PID:4864

C:\Users\Admin\Downloads\MistInstaller.exe
"C:\Users\Admin\Downloads\MistInstaller.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6048

C:\Users\Admin\Downloads\MistInstaller.exe
"C:\Users\Admin\Downloads\MistInstaller.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3192

C:\Users\Admin\Downloads\MistInstaller.exe
"C:\Users\Admin\Downloads\MistInstaller.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3180

C:\Users\Admin\Downloads\MistInstaller.exe
"C:\Users\Admin\Downloads\MistInstaller.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3212

C:\Users\Admin\Downloads\MistInstallerRC.exe
"C:\Users\Admin\Downloads\MistInstallerRC.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064

C:\Users\Admin\Downloads\MistInstallerRC.exe
"C:\Users\Admin\Downloads\MistInstallerRC.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault260f5b34hec4dh4be5ha2e7h6720ccdaad45
1⤵
PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffa4ef46f8,0x7fffa4ef4708,0x7fffa4ef4718
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,247674169603998851,11947605780804454910,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,247674169603998851,11947605780804454910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  PID:1424

C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly (1).zip\x2s443bc.cs1.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly (1).zip\x2s443bc.cs1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1972
- C:\Users\Admin\AppData\Local\Temp\is-18V14.tmp\x2s443bc.cs1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-18V14.tmp\x2s443bc.cs1.tmp" /SL5="$A03F8,15784509,779776,C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly (1).zip\x2s443bc.cs1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5760
- - C:\Users\Admin\Programs\Downloadly\Downloadly.exe
    "C:\Users\Admin\Programs\Downloadly\Downloadly.exe" EnablePro
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4912
  - - C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe
      C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\is-9B4T2.tmp\MassiveInstaller.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9B4T2.tmp\MassiveInstaller.tmp" /SL5="$10548,10474064,1082880,C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3556
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Massive.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im MassiveUI.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
      - C:\Users\Admin\Programs\Massive\Massive.exe
        
        "C:\Users\Admin\Programs\Massive\Massive.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5340
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Massive\crashdumps --metrics-dir=C:\Users\Admin\AppData\Local\Massive\crashdumps --url=https://o428832.ingest.sentry.io:443/api/5375291/minidump/?sentry_client=sentry.native/0.4.9&sentry_key=5647f16acff64576af0bbfb18033c983 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\c0696e0b-f1af-407e-8323-ed5533ad6aa4.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\c0696e0b-f1af-407e-8323-ed5533ad6aa4.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\c0696e0b-f1af-407e-8323-ed5533ad6aa4.run\__sentry-breadcrumb2 --initial-client-data=0x3f8,0x3fc,0x3cc,0x3d4,0x404,0x7ff6c86e2fe0,0x7ff6c86e2fa0,0x7ff6c86e2fb0
        7⤵
        Executes dropped EXE
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Update-1c1f7251-0535-4724-b3f4-1574de9579eb\downloadly_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Update-1c1f7251-0535-4724-b3f4-1574de9579eb\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\is-6HOLM.tmp\downloadly_installer.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6HOLM.tmp\downloadly_installer.tmp" /SL5="$40548,15992205,779776,C:\Users\Admin\AppData\Local\Temp\Update-1c1f7251-0535-4724-b3f4-1574de9579eb\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5380
      - C:\Users\Admin\Programs\Downloadly\Downloadly.exe
        
        "C:\Users\Admin\Programs\Downloadly\Downloadly.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
        
        C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe
        
        C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\is-2R8U7.tmp\MassiveInstaller.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2R8U7.tmp\MassiveInstaller.tmp" /SL5="$B04D8,10516965,1082880,C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Massive.exe
        9⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5468
        
        C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im MassiveUI.exe
        9⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Update-025efd4d-a80c-42a0-84c7-08fa4f01a6ac\downloadly_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Update-025efd4d-a80c-42a0-84c7-08fa4f01a6ac\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\is-TQPQU.tmp\downloadly_installer.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TQPQU.tmp\downloadly_installer.tmp" /SL5="$40470,15992205,779776,C:\Users\Admin\AppData\Local\Temp\Update-025efd4d-a80c-42a0-84c7-08fa4f01a6ac\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404

Filesize
64KB

MD5
fdc65e4c6ec9e3f4df3ea6c8be6dbe7b

SHA1
85d992c3eb3564d30bcb00ccb4630df06cf31ec1

SHA256
39fd9b603ea05eed21b24fc63632c0bd8726c7a5a857c4192ea50fb131368c10

SHA512
dbc7e6242e0fbee09f41589f461acc49c815a550ea568c261a7a11ffddf8627bf4111e618e689c41748bd70a80c3419b26d899e6e1f58292273d17fb94c999bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
1KB

MD5
f47a6b9312dacd6da0f4eedd1e671085

SHA1
6176be89aa80fc95475d30e81992394c83524cde

SHA256
7904127d34f0311066b22437b67318ac9fea6a3ea9de9dd6a19f08e726531e3d

SHA512
c7ab1057117ed7cd0cdde944dde978870c77288b3c195a56f986c1e265fd1092ab1c762a8bdc31126b8bdec29270c8d68b8491c1de9fcac6e46e84133418b87f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
509B

MD5
af2bca17e13324f6fe6c042500cad4f4

SHA1
1155a48115f9adb97497ddefa1c0e21eab565cb9

SHA256
2ddd395185d5decb2d722b9a8563381b03205a2f23f399734577645f2d0c78c0

SHA512
28c982bae01940de778b9ea3c2e1cb16175fcb5cec401aea1597793a8199a6a91e791e308e6e065ab1a830cf5601f1d36f248aba39dc6af7587c8e89b3757a50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404

Filesize
300B

MD5
670a72d819024930c7411251714d7014

SHA1
12b4c8a53458d81bf0a2bf1c79398f3919e4084c

SHA256
27f6f027548b1251b7268feb677ce0ba105ad32a7a3093f2714aaccc1c9d083b

SHA512
9eda11ce58ab0b0c4493b3e95baff78b625e9a83fa6dac410be6f13e47ae80af786e5b2e890d609bf0fe795c1557a3f93da0699139aed1691f8c780846e5651a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
398B

MD5
13b4aae0cec3eea0d20130caabd402b6

SHA1
10bab5c90c761fb66466c17439037a7b58f50794

SHA256
f6c44462cd324bd3b94caac0a5e5f6c4d4537315a731ea1ec48b65b5ea098ec1

SHA512
97ec676440cace9bf7da67796c04ad8ee60bc6371f28255ce5a9dafd217c69e9499f8dfe048f0069f087a30428da04d576cce4806c9d0a7af76a85412eda4f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
500B

MD5
312cde4c1ee156992e738b94b20b2bb3

SHA1
1897da5830f9b61fecea8d28069e6d25b8170bd9

SHA256
5caeb83d7fb3f1ef3b7b2b0425dca2e7244748f4561ac7e7a6bbb80198e2864b

SHA512
3fe37fed13957cdf5ae14b0137a02267c9ae2e2bfe1208e65f8f16c54121c48de294dcc549b7a612ee4393489ec8ee197c29c94cf34ed13bbf669180bf0fc369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
486B

MD5
3baf8ec9325c91881e5f8c7a055a936a

SHA1
81c7d873e2b82df89182d82991593341856cd1cc

SHA256
d2cfb395c76b4c518a51223cdfa3cb78a80c9605e9cea6f230298ee85002f58b

SHA512
b4f4a79f173cca8ba00d13747b9a06854420c64532e50c35425566c63dad177cc87dff051e2f0fadca7fff500feb7098e7b291dd67f9fbcad2ae4603ea2d435c

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Massive\usage\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Massive\usage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8cb3a8ae72d4143c46a67827ca0b7df

SHA1
171c2c090300f33f67510e38358077155a664f99

SHA256
7bf198a75746d630643056ad1571f0d46f6d069f7813a39888f7519b4b843e9e

SHA512
917d6ac30c1975f5266aa380baf9842575ad565c4399ef7da499e8f78d7300f6b1c4d3c5846d46b5c39fbbcd76097fe356274ce44eb35e8ca5c09522def6758e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf0b2725c0cd068b0f67eb62cbc3244f

SHA1
54ee5cd3bd0ae55707020bf40c4342736e310caf

SHA256
5dff0f70a7691805910a88ef91c9ecc338c6a27b818ff6b0c8bc6e0e8e381d36

SHA512
f622f17ddcf1a364bbe926fe427b1544c3bea200b65f24aee14a5eaa7b260e33f396ef07f2a0a53540dc4c0f5beebf431b6d7d0a9032890de13b99a2089b852e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
29KB

MD5
40db7dd1efaca62b88beadba3c94627e

SHA1
6eb9f8ad860b0898b27d9781924b2d5221bff392

SHA256
965f3df8399b382594e1bce91f4d95a0540547ffe52ba0063930cdd04e242bf0

SHA512
72e2e4179c614d858765cd51e24141239dd7a941e603bb9fba83425e12340e670654b9ea0a9b8d04ff4d9715de88aa80ac135071128ad919a81b5f1c4d454f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
48KB

MD5
df1d27ed34798e62c1b48fb4d5aa4904

SHA1
2e1052b9d649a404cbf8152c47b85c6bc5edc0c9

SHA256
c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86

SHA512
411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
25KB

MD5
e580283a2015072bac6b880355fe117e

SHA1
0c0f3ca89e1a9da80cd5f536130ce5da3ad64bfe

SHA256
be8b1b612f207b673b1b031a7c67f8e2421d57a305bebf11d94f1c6e47d569ee

SHA512
65903ba8657d145cc3bbe37f5688b803ee03dd8ff8da23b587f64acaa793eaea52fcb6e8c0ec5032e0e3a2faacc917406ada179706182ce757d1c02979986dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
37KB

MD5
5873d4dc68262e39277991d929fa0226

SHA1
182eb3a0a6ee99ed84d7228e353705fd2605659a

SHA256
722960c9394405f7d8d0f48b91b49370e4880321c9d5445883aec7a2ca842ab4

SHA512
1ec06c216bfe254afbae0b16905d36adc31e666564f337eb260335ef2985b8c36f02999f93ab379293048226624a59832bfb1f2fa69d94a36c3ca2fdeebcdc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
20KB

MD5
99c59b603e12ae38a2bbc5d4d70c673e

SHA1
50ed7bb3e9644989681562a48b68797c247c3c14

SHA256
0b68cf3fd9c7c7f0f42405091daa1dda71da4a1e92ba17dad29feb00b63ef45f

SHA512
70973ea531ed385b64a3d4cb5b42a9b1145ec884400da1d27f31f79b4597f611dc5d1e32281003132dd22bf74882a937fc504441e5280d055520bfca737cf157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
21KB

MD5
6ff1a4dbde24234c02a746915c7d8b8d

SHA1
3a97be8e446af5cac8b5eaccd2f238d5173b3cb3

SHA256
2faaca6a253d69be3efb96620ba30e53ecb3de12d5285b83ecdba8cbc36e7311

SHA512
f117b822aeb0a434a0750c44cbf4cdf627bfebc0d59e266993a4fcb17a7a0519659e13b3bcf8706eed7d80d0ce33b0ce5915afe5872c37c010a401dd6bb1187b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
26KB

MD5
525579bebb76f28a5731e8606e80014c

SHA1
73b822370d96e8420a4cdeef1c40ed78a847d8b4

SHA256
f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

SHA512
18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
59KB

MD5
25b3d7b6beb44eb20ffd065656c15e1d

SHA1
59301a1a36a144715b51bdccde1eb2a328f7efd3

SHA256
00a88a411e1a1ba98f55fae99469271160c23d87b1f71f90f31a7810f063db9d

SHA512
8c71c4b268832f016dc20f68611abe976294421217f7834b5d409b53b0f0b137231c9364eaa84eb1afb05fbb121a0ebd263e52ba60cda157ae892219b462e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
41KB

MD5
082c469b33a31285b4c182bbe6a1b499

SHA1
d2525c741034e1ea6002707ef528a270fbd2fed6

SHA256
09ea9ec8594cabda1edc0ca1ee990be1f5c564d0dac06e6a07ac03623e5f4f1a

SHA512
a731c121e9438f8d5cc0fd28939b0493f5bb37013b60e78054fa6c4e3f72d4cd52c5bcd9e3dee36903fdc7e06aa3af879d706f360eaf6ebf750ba74d595263b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
55KB

MD5
c649e6cc75cd77864686cfd918842a19

SHA1
86ee00041481009c794cd3ae0e8784df6432e5ec

SHA256
f451a4a37826390ab4ea966706292ee7dd41039d1bedc882cbc8392734535393

SHA512
e9e779870071fe309bbde9b6a278d9627c7f2402b55ac4c0a48c65b1de5172cf9dad2992f8619d7e7aaf978e6ccd607620de88554aa963f3d45501913ed49f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
18KB

MD5
ec02df94928186d3c6b59ce65f9000a3

SHA1
ff25873724d5bee7c3a1b0f70853f3f4db93056c

SHA256
31d2638dfacb6328063cfadac99239427e0eee86cd28e2deddfe4daa39c55674

SHA512
69ddeb0dd61ed03bc060b9399504988ee0c72c4de46e3a6efc967bb3686a593dca9362121d9b5106e9f2e355238614c5d108cf28354b53e5aff6f5e2e112b873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
22KB

MD5
9b5558381a28d410bf93be576c4e1ec6

SHA1
67c25103d7e61f1b482a665fa0d86921876765d4

SHA256
0adaedd1b52daea4ac19cbe9c095eeab8d4f288c1eef838aa416308580cbc665

SHA512
aaf3b065030b0fb7c5a689d4c44d5cc2cb0ca6a79ce7cdeca3c745c01bf4f64e44de2ddf8e06cbb35eafe0e7a005a34178c4185a5d4cd4fdab6fdc20df44e0f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
107KB

MD5
11341f03f951333b4309822a7ebb0907

SHA1
fc813cb6a262e6ef9991bfa2711ba75e7a0894dc

SHA256
99aa368241f22add83b34dd05541d726ab42a65f3e9c350e31c0129684b50c1a

SHA512
089cbd6d797f4e086e945dbb1345f4023fb0ef4daa9d47368ae7f253cbaea7b6236cfebf0d19741aba415ec4f1c3443050cabad756c55514ba2bc0bd7442bac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
16KB

MD5
686cd4e029335cb803ea8b47ea727bd5

SHA1
acb03acb24c943d81a8e4822466201cc4114692c

SHA256
785ffc242cb18f8e9ccb9ab96c37df3cdf1612a38a325a2a9bcf8164eac6488d

SHA512
a54e055ca8e021757102aa6c7f9045959fa32a7db215595cda8419ac96f75f44e1f5846037e14b6a20d0db51c4b1e974aff1718e16ff5d7650e0b667ca09721c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
15.4MB

MD5
fa4f62062e0cec23b5c1d8fe67f4be2f

SHA1
0735531f6e37a9807a1951d0d03b066b3949484b

SHA256
a88edca3b030046fe82e7add6da06311229c5c4f9396c30c04ab3f0b433eac6e

SHA512
0ffd333dc84ab8e4905fb76b3be69c7b9edba7f4eb72cc10efc82f6ae62d06c36227f4e8ada4f896e359e5ffc664d08caf76e15a40bd17e9384e73842e845995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3535bc408b461dad02f7497e55994f29

SHA1
90c30b99acba7d447e429433b975414bcb271cbe

SHA256
b0d2c19ff77293a55c351e577b8e077d2640720ec0324cb309606efecad1ec88

SHA512
1bc416ccf0ad6e4632206992927ebafa8cc1508f2e81a04e5084c1b1dee2d91291bcc2d5c6e6a7ab8a10c12252967d89735ab8bc662210279079ccb7db34cf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
29eedfe09ceed295f93753f07ad5b514

SHA1
fa568ffe49bd7a71596ee8d5bc83c227172c1550

SHA256
370a93e7a8b0611c7aa93c04b3864564fb1aead6c298beff6971d3837d21b0ce

SHA512
5d520c96fc59b81b0a83550d6d3003200878b2d2c51064b9af2d67adbc10981a0d2b318b493b00cdeaf674c8401a431ef7272c92943ff1cf865a23e5cdc97ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a563e7caf743cb63743e8f5c5938a563

SHA1
74d0869a7af7e77c0596fc90fc763dbc1d8b71e6

SHA256
79c7ec7f335231db4789d19a4f30b9f9985708d17c3b6650aa2f159f1c72c609

SHA512
c7790d05767b87db8126cb40346c224e2059106805d8aa203a5805bf26cdbd3a0e22ee6870185cf47de395a3504ce43794560ec117d82c28c0e48448491bfe25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aa7faba52740cd14cb9e13d766c1f89b

SHA1
c8c5f9f76e2bfa7b612be39f97149fd435cf37f5

SHA256
16ec376d121d5ddedba1b7972722a70e75512f0862d38a8e34b694f8f7cd5bb2

SHA512
37f7762a2e528af087984580fec9f2601b00e43aceb3ba9dc25144954b2ddfb2727599f1526c2036dfeed0b8fd74375b932223378d861ae0d73c48131c7ef277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
940B

MD5
0a6c8e71ba0ef69d68f3156053b78314

SHA1
e9084503849fc8d1fd563ac668090347fa124e24

SHA256
e27ae5c84f453cf099e749f343a54c87bf63bb0f8c10c976bd21cc1d41b935b9

SHA512
c7f64fe9102f403fac95b1cd0845cebb05ad825f293ea5589b23a9b1696d5cda96e9f0c9354a70d2069c74cd0d2fd519484d95ef58febef62126ceb76238937b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
44dcd813b98962cf8da9d3a139de9f99

SHA1
add409959c67d61148ace4de4fe38e1ac813932d

SHA256
d95d11f6009c9a772bedab3789262fac2175fb6a730ba827400dbc24d4c7839a

SHA512
a09468bb43ac42dad80e7f164d866b5d8136b5564f017a386b6d6efdd4810a1d1e3ae0557257608c0d59490cd795b54c3332c713e0713e2b0b3ff6464274ab1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43f40e1ce3ad1c4a38dad4ed3e21bb5b

SHA1
5b94bd6f7c07ffbba14ed156891b7e4350d21584

SHA256
01f012817a9b6da8f17d9a035050724017938d105e7bb31d4bd0c973a1cf82fc

SHA512
b1a12edbbb70be174492bbcfe45af081b1163e297f84494e6a6d12f22f5762c001a5427ef05a708ab13cff5a71b72b45b031dcd1131bf9bfd51e491212304e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8fea040ca5b97d4efc982118d9850685

SHA1
b9f80baa566b8c9d14d14fe7c657c7e48b260c2b

SHA256
ba36a27588951c497e18526c9e3d246a3113b75a46365b84162b21e3239aac7d

SHA512
00f3127cbc4d2a0c7b1dc4a93b602b32e07aa825fd048d69a7e6aef31d5457e68ceb53da279bf69b34a882e929680099542d1721ebd5484ccf195ecb0bacd79f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
804cecc881067d0da178ada184538d64

SHA1
0c92dc1caf00412a3308a749037dd41ff5c95255

SHA256
67d52e747c99c65ce3ff4395a460ba4b358722112d84c9783370cd0b38589b53

SHA512
5b8ee2e8574d397df6f5d4e2abe2041b3ea039be2e6121c4096b46ea2c5ddd0a735b5131bef39395b48a34bba09356a09245345d66e445a4e9187f078e559cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75f0f54579a871657650a42797ae9438

SHA1
64e830762cad534e9e16ffcefd4cd41b173913cb

SHA256
27207d6df96f7cbffda5b4103d7ca85e7c845cea6f6dbd013b56758af3abdb4e

SHA512
2a3231f0d91724b6429c691aca11a05a550707a89d1a7e67d0e4bb4699b52421509d0d705953f573122504f145681de47ebcbc8b0129201c78d5012f7c4d96fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d968619535c1c322f1130d3948a8a29

SHA1
d7e84e0ae3cebde6f8098bd9d91c803d842fed56

SHA256
24f3261eb7798c8094c40c033f616d387dc5e7e7b055ad2bd1b6d21d52b0c2c4

SHA512
b04c3f2c4b359a97375615a7960a065f0398d53e02d9b5eb2584fdff5233a442a6fe50d0aeff040b7acbefcdc9a564080ccbaa80eba7b798b5b6a74be2c4998b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a61c6118c08509b6c8af68dc41f090dc

SHA1
8d96c7d67c66dc6194b946003d33212f9d27fe68

SHA256
af98b33e47fdda5df92619f35c9d299c70f8d038c13789a9178235baf169eb8e

SHA512
ae84b83ecca462a93b64c6571d990f17bc163928ac29767878d6a197b33721a1e40d7f76b108ef0dc11fb955b88a5ed247b103d26d245553de8264e7ffeebd8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1c87b5a8193bda4bad7eb4ca4126f326

SHA1
256a7639b64694decbad62d11c18ba2cee9ae6fc

SHA256
5e7fc425f239057b2d6d801e0ca8b968f745eb4d014efbaadda2b6a23708b8b5

SHA512
ab18535306371ee0b91cff3299b9d5e4533a4af24c4329f8226a141162258450cb9a07a63e16afc2f9a5a5e675dd095a2234e75a729c0381218c7ee60b22719e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5947b15568f5b61b81fee957025f63e5

SHA1
7efc6935aa8aa7a3b2395458bdae649a701d5698

SHA256
baf92576a1ceb8ff881038f1f2586586691ca46b6eeec799846699c86840a19c

SHA512
40b0064e0f088804e2f4b450c4d6e8066f3d152ac6dc716927505dd4369ebc1db7e44850fa29f479b2be96120bd6baf048b1991eb926e000ea0a57698f6ed15c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
375d759a001ac3d3933bf2aff737ba11

SHA1
0da7e4f232f59622ad9b92e27efcbb93d24f7836

SHA256
595ac62a282ecac4aa2931c0bfaa175196415dfcb5d0e446affc8d101535ffe1

SHA512
d053bc8d510975a934977ce616a06518c49db1e95a50983c15727eb1d57d2c39b0a1615b1078efc7963b109d5caa7358bb30087ec2e9832ccf1f7b28cd50864f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ad08b41fe2d5f0384130fb130e21617

SHA1
e75b57bc531b0ebcd25d9622d43207817d19e6c3

SHA256
76d941659d59527768351ba7298d911de8a5e694c8f406b953463cdeadb65335

SHA512
78e2c2c3540157efbdaa2278081c7ba32d621fe32b47b33383f6e00365457b3d9cf5e1b939e23373014ab45278623df34bdeed829f2c768c188068af05bf9fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e36f9c4621b73fba14c7a3673ea62ad

SHA1
c09acf0eb21133dfc8800c4a61409a07e9b59e9d

SHA256
94b3fe1da3f9c01135cbf9e1eb8cb589e1e931cc1f9812c7c14f7599a06235b0

SHA512
457d84e0d0e1948a0bf229768ef7a446d61779decdb8f4b1ee0e70832a526a8843c3eac3eea4fc74ee4a7b31f52bc0ff54578b1723b255481b91432a78659f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
828e66558f61a6880808b1caf87e8fec

SHA1
0f733ac136a09ce6585228ebe032b1bee4a2fcb0

SHA256
13a4ad755d6218ff53beabc4e37d3022d21590ea4cc0ea3cd59411d1ded0444f

SHA512
c03d70de3fe9a5c8134f6440e5ebb8540d326a1682754ea9fa4aaa2595fa2c9dda308ee130fa4de85b2bf5ca7e0483ebc2c07c97b6596de298580743e680aba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
34a45456f7b82d2a15ef69e1939b0bce

SHA1
1cae09ad15947d9ffb79fb39965da34d0eae2c66

SHA256
354b1080642db7da3691cbb4949ae7598c910c89f3e69469b6410598ec48cbce

SHA512
de0c046b2c495421f0ecb95b4468fd4685e439660cfe15c36e9e39a323c000c4217214c2a7f652e842ccabf5c3e095725eb38ea41bfb1a6a87f455e0fd2b7711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6da9000fc59f45a5cd92eb3f0bbd6976

SHA1
a7e67db9f0e847462c72747c1480fdf3f415c046

SHA256
b2c18759b5098e9381e7bec9a851b19e2ccce620332dda479357c13be748af84

SHA512
b2d52109e55b8b57cc3bf0095d40ca188e5c718392ac4b9416ebd91ab53c5950dc1ad2485143c2d9962ff5e042355599d6c8649721bceae62380bbad162e6799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9451fce2b4875641f0cbc9f978ffd5c9

SHA1
5bad0162130e732e183464d1103e9c44ae1e6394

SHA256
cb19151edf24912e50e464f1d73c75c27f2c17f0c3d12be9919f86a9bacec7ec

SHA512
43c392eec65f540e1d68d31f90daabdfbe513d42965448cde1bc566a5351d9f7c98c2c7a0cd0dc955d4db7f28df114c15b3f99a8ea082ea1a55b5df654a04ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0ed01d85bfeccf81cf35b6fcb42c21a4

SHA1
f77bb079c6253aef18a590fdae5ff264f4b8d3e2

SHA256
14e6d8f0ca7445163cd6dd9cfe8fa3500083b78a2010a723127896cbd9b7a4ad

SHA512
d04a872c9b13e7aaa39e1793bb53b1face255bc786c7f61f8ecaea977d4263bd4ca4e308dab48bc1633e07a04e10151c2cc081272fe3e495114788c33907bffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
406c6ceca49de2c9fc5ed2c0787bef00

SHA1
fa6a3b7a0de294dfb2a57a7285be2d3f1e681459

SHA256
5660239fe41f2cea9badcf8e30fffc3776bfab3190905b110848fd2edea0847b

SHA512
74027738abf3a501758f2a7f9f333daef2b8bad67ac3ce6c9dc49c3207022781c581f7059fa8517facc6bb584814c2ac0ae51aafd852185e33e2fd0201a5eef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb55e34bcfd7e60d2977f7e8119b2ca0

SHA1
6612dd4b0c10e5bec300455529d41fee3be3f19a

SHA256
912a0db2f1f5d9a351cc9da754b0a9dd9b1742c7613850059859f7d706c806c5

SHA512
cfba1961875e140cbbd74497599908caff054a37b965ac0b03d9d82675b95786fb8c0c109b4c100fde6294b3607ec77f8d58277d48ace9bacb41f87e407b3605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
68ebaf3cfdc4e288ef42c54535a11531

SHA1
e22e15cc182da1d0c8f5e61af79ac326f0f5b13f

SHA256
5e7cac77247588c4359562df14d7dc8f2df9a5cbcd980fc16030cd6b92f697c2

SHA512
0f6bcb20e5036540ed2828a8fa2dc10334352e24d1fa7c63662d79f0fbf1ccf6ed0d58111b60f4dec32563d4346d1c21a1a45bd1bd275b6843f7ffe020bca0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f000d8baac55c80ec535686e67c8a35f

SHA1
f6309794d67b8d6d01f9890a53b30575a8476f5c

SHA256
032b63ded76dfd1eceb41830112d05c969e0abaec929bfa0340d7069db48a7c3

SHA512
002328344e9c546a01f1bb7d1045d1fe8c3115a0b3b9cae814eeb37ea51771d74ef4f9e4ba8ab33c30289991eaa414020a4732a639de3ea343cde96980f6936d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ec3febc77848f78b10fac8ec8dced062

SHA1
76492992236df0762ae6b21120cc5aed8ed51bbb

SHA256
0d2195a79c3117ed2a1432e011e1275204d7781aa852306939233b15771f3fd4

SHA512
3dd281ef8161484b3eb0103a7b0fadddbd5cc89f33fc5adba0a7b295336533690139078dce7ae87996a4a6d476c0fc719b95f21f6d183c8fa4e100415ffbc37f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1a85085958375765c72990e2359ea93

SHA1
a89bba3369906a24680f7770c195c700f1af2b3c

SHA256
242daa8b8045b758c6999406cf42bc13533ef636497bc266980903e10b672ea7

SHA512
8eb7c61f521a944324363bff44438975369e1686ff3ce7eb8b2a0ec7e0325281ee1cf3dec2d0e95e7ef0bcfb3a095369db5bb04736d1b0c48dad0165a81d865f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2da5050ed6171a86011d4b5683f2bef6

SHA1
ebff07e3e7409c763e336828f3078245036ed6c0

SHA256
10ef5653acf9de401f7cb993207196094e5479f6d58ede9ba28dd0dcd29c6dda

SHA512
07500f88294cc8f83f9f1c4d93207359d2e5dcf2b74c877672a17e1282a2cbfc48f8f3245de38f09ce1f29795627557e1472455c4a7097f578d7c07b17dcf7a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af2443fd705fdf06e5997b9764054099

SHA1
897153bd2880122997d303213b9a169a7a3e304a

SHA256
149f6944f4199a18e2972b50a1619bec9033f4335876d7a5f45394ced2823244

SHA512
0a4acecf5cc944173f4b0d251e128c413a445149a64c2292ed2b2e5fd19a9696bac6e2c5bf0134f2f31b8084c8168ec24f24c8db995cb30bd4103c7ffbe8d18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c797d.TMP

Filesize
1KB

MD5
d032101af797e19b2dadd1c76cf716cd

SHA1
33ca1210154123596029e31458f72d55cebd6dbf

SHA256
6467bd1ee7e95e27c1b97b62549da90cb0e6a8134ef6b8798672999ab275434b

SHA512
ea7e67c2f6f08a8cdbd7fa44554cea19b7c811abd0a799025c01543457582425ce7747726b10c5b47bcf3f631f6a150961522e77ca7651ccba7f04b9b1ffdba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\36beb0ca-2409-47f0-9647-6ad14d9c8150\1

Filesize
10.4MB

MD5
a738400113275586174d8921f37fd510

SHA1
401522bb246062d7312639a3f74edbfed724e548

SHA256
cfe0fa13a6e81532a93f3a452efc99e54ff7cead0cf33a5a942831be06723b57

SHA512
9e775f8407a43382bfec1d4c101b789417c21b550751f78535b96f405da68c56b136538df90032d6adf7d39ea91573519b6c9c2f984237867ee726ce58a40550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8204f318846070321b51b4f2a0d5c9dd

SHA1
49eedde406aa7562ad733a5886d73ad891de8a07

SHA256
62ac84d554346fb7eeae8e358ed9aeb9a5d0833011eca2eaddca1c89765b63a8

SHA512
39a4d4341d06f54d219d238500d2f128bc08e720702d3aef537b0572e165b0b9d2bf80cdbbd3fa55d188ee740063fee47c8f38515311256ab39ffa416a61f65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9be2d564d121e028fcba49203c19e35

SHA1
681674c89088c5e065e2068ae253dffc17ef2d41

SHA256
628a2637ad88fc545afb83d3e4e90d0877e86e905b6c1d919d212732467a247c

SHA512
3493dc61e0f7540a02edc455706ec4993dcc46ce4d31eaa8ffa6940be029adf1f0285966cd84d21635b9870d508f28c982ca430b8a8667bd29ce64e1cdb144b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33c95e1a27a4151f08ee23de1fd6c964

SHA1
ef1f2c27e6b907db19f859704c00715caf0ed524

SHA256
a852a2e9b710ddb628a9ec15728b8ab8d1b28197d28976e91bfba830faf680b3

SHA512
920015aa86994673b72a03e938a5745cf9b028e683bc90428d727a1030363a9e05ec8e220b5ffe749f1b163e7c4f27100e6dff0ffb497f280a5dfffe6ac5972b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78f5403ec146f34b2b7715f59bea63c7

SHA1
97da261d2cd87f62511007eb099459693057776e

SHA256
7a8f8a0da429f37c70ae941cc0796c1a5ff0ee23a1a094786e20b1901a5c5d4f

SHA512
48a8d97e656f5bab7aaccd33a7b6e676f7e8cfdd799b1c5943c498812c6b1f4338298e32ec7f1a519aaec0777806a4ed16066edcf895c4e6328e8a548ff422f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b5ed1f0aa5cd3b8c284aa6d10598cd7

SHA1
e417643a4171e7558a7caedf2b02447cf0a02b4d

SHA256
eb156ee5631ef73f7071c546f3759741a0b7d20936872614bac63b6809ffb46a

SHA512
c8cf938bc158f57ba9379de425711e3e21051a7174f5b5dd525aed7cab9e07d55540e32ed93053f67fa10d3fc0226defce255ccbbaf0f861d84da897029a4d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb94eaa408784bbec7349ae2a08d928a

SHA1
1d753d36431ba8bd4a074c377fb8e6c6d71d1efb

SHA256
69bca6c36c32d1be47b3daf32a52e279b859319740528cada8c399dd1f37c07c

SHA512
32ca1514ebf5cc80396620f44ff879d6125181226272dd9825ab14a011be2ba3ef6f5fb6a9fbd4a0b21cfccda5589bad7209cc59657b532592dd2311c885467d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10f5f8986a31bbb5fb7cec66a99a8b4e

SHA1
32cbc4225376f2b3a308373fdf8107999c617ffc

SHA256
466562e61c85c5257a1b5ada48a4b0c6289f8ad58c584f98c8adf43228ba227c

SHA512
ef0e0ed2ac573599f3a03a6de7a07e5645a8ae1ca92142677086ccd0f75f7fd1ddece8c367838e719342b172a557228c94707d91a8d5a88b987985d62807c1e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5fd4ab106ffaf9471b288c6156134f0a

SHA1
78c3d234f918535d7d8f7fb20224af7f25b85d75

SHA256
22bae4d9c42c000c30cbe351130506bd23c1adf416b8aa3cd0b86e62532d2e4f

SHA512
a97975088183ddb0c8359f2c9f7ac67aceb9e9791d4baca9bd4d5b345a4e7d1fe05c69fb0d4a4541d7d4860a6fb1363af963c3ba0e8d16e91a4c67ee08842a5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6effef6e6fb1b071ef8a60fb8246bf51

SHA1
17ecadbac0e94787ddffa1a6b28f0a3104afe39d

SHA256
2c46b267b902c26eac18fca67f14e0c2cb34fa935174c5e71a6a2bcadc9f9b58

SHA512
023ec3f47959d7edd5301dcbffc7411ac35631c36151e81560b9e0381389f84fb96486689746b2ceb3053222947e76aa2915f7b2a8cf4079ccc74b9cbc7b2c01

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\66m7b1c7.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
fb19c56e9c4b84ec57876291da4a3a96

SHA1
0742fab82ac85351b32475f5a42dffcebbff3c05

SHA256
f15988b4a5809a4bc0d15df0f14265c6e441dfb02ca764ef2e74a5ae6120a77d

SHA512
0410c3ad18e75edc832d1a9afcebc21e97b6c821d6a20246d8d247cf21efa5004583ede7d91143eb7c1d158d6e5cab6f9a8d138e2c67c42e3fa77ed3ceca22da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update-1c1f7251-0535-4724-b3f4-1574de9579eb\downloadly_installer.exe

Filesize
16.1MB

MD5
61016d79751db97b3908e31a438d89aa

SHA1
668c2f50db94be4d8f4f1b9a3719a1741f5bb802

SHA256
1b8a0d83673e2e5df870918d436ae62a7d65dae9351fbf59e3ca20902a5c33e0

SHA512
7e8b8bd34cda535052c57e6b5535e88546399d68be3ac1426c398d4a4fa63efdc9b5c32074478401dbe06e49f144bde2927fb9225b00f805427725c11519ad73

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7TE8G.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\AlternateServices.bin

Filesize
8KB

MD5
41ffecfe116775085b5f4be3feecd305

SHA1
b81e39769e22547c459debc7808559b41427f6e1

SHA256
79f768cf03f64d5a8fdc83313ca72fa9c9b97b61b785bfc7ec68c073e662b007

SHA512
26b8e90b109810300160cf6f990a495a7f36170ba82ace37312aab40d3db829e90395c43f183348da1036c4fed1626e7e82d56014968332147c51c60fe5f8882

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
a5abb0c15bc9c30f64d1700c82a10a10

SHA1
f12215744e1b1ada654f012d5bb4f22be694ca56

SHA256
0bcc6b59c88570e08a9e10544f59776508d87bd1240b97b3107e6cbef17142bb

SHA512
c59b485606ff31df4e9653a6c65974223cb719e90309a5fc91f94c5c97e114d1f6794d43f28bfbe2a85126f9bff546c22835b87d6f3c4641acd32d45e90dd8ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
92cfa171209d477b07d4e545f096c442

SHA1
fdeab6bbf97a1e39ea8593a1a7db174bdee86625

SHA256
fb53747533a37688951f6a423d3a7cccd7c40c0e9208fd27055b8146949c9488

SHA512
edde48e754ce3ef75fbe2d10f70cb9a10b2e9b9bcfa351712edb5382a2b38d431722f6c8d58979ef2ad4be064f242748654b42a56fff6438f24884f5e0cc6e60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\datareporting\glean\pending_pings\4b2ea7bd-d155-4a85-987d-9f754b64a4f5

Filesize
671B

MD5
22a42dda8e009fca9f1c97cba02ac62d

SHA1
25a77eeb05c7d142e76a8f690a97b2ae87ba2cea

SHA256
37544dbc85deb8a3563db6e0a944e24fc0797ce192a3e1429dffd06539fb99fd

SHA512
c80938ed8d284aee2451ab79b2d79e5f49392bae6c77a489d7ef6aff06a82bfd4163e8e7ce7e754901b0ceb50ce05fd4b9625e5904fd7ad9ddffed052efcd5e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\datareporting\glean\pending_pings\4e7efcc3-af1b-4eca-95e3-dd82968fd4b7

Filesize
27KB

MD5
1c555a1ce582a10136bfb48e039208c4

SHA1
4804bbceca2e54fed5e3a5728097809ec5af0ae8

SHA256
074c076d1244aca85b91beaa67874b43db60695973393c8d748a8aa06bd29ae9

SHA512
5d8471172a4a6a24cddbd6af0f55c101468554fa2c910057551af9a5af763f43b9f7033c46aa7857094076ae62d3abd18f90f7f4fa6ca03b2941a1db006f69de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\datareporting\glean\pending_pings\a6d411e3-5c9e-4ea2-aa08-d853251c0131

Filesize
982B

MD5
3722a90de272d33d22560b213f392abf

SHA1
b3ca1400cc4c37605d1172d65274e4733ddb2f66

SHA256
e589da6a1a68c4ca510da6a50925967a80778eb30a5edb826431bacce180b627

SHA512
ee10bf199fd77d1f3122debbeafb698680c0ce7e72c120ab7442129443f847ce85ec0557c87db2574792a8fea4e2dc94e6c53b1a395d563593f9b0d5f75c17ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\prefs-1.js

Filesize
10KB

MD5
18cc1292c3dc80e1aeacea0d355815a8

SHA1
f670247d9c24f7343afe8db7c6cdd8c8fd330cfe

SHA256
f62eff6c4a515b8be582c0145d0c848ba167fb1baf68b9da72d347fdde1db191

SHA512
59c90617d2547d934ea0ba1560cde6851d3e030e6dca19f4cc6d64b1421852e75191fed9050b3ed75501fc0d6b207035cd5be660d6979d51d097ec643a37cf8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\prefs.js

Filesize
9KB

MD5
9b05c9235ac60ececb58fd352f76efbd

SHA1
6bd641c29326ad055631ad7cf21eaef5fab5044d

SHA256
ac83d915c375310e39bd9a6fd902e0e4985e080d0b8c787153a635cd72d29cae

SHA512
e49453068e6ff72586359a4ca89b854279701c8c5ac32b6e7e01d411c3252212bcc17f45f0b22f14ad0d0ea5b3edcbcb724182fe28d4f5bd362073af2dd30633

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
4acb9d2bd0110557bc3102960802cad5

SHA1
09720b6e7cd05cfed37c7269cb5ebcd6cdeed9bf

SHA256
683c6a9ca72f80e18754c4794a787825ce7094daff31cd6885bad26085777ecf

SHA512
c655567ce57518ad8d4b9da4be5bc9b78b4540f8965f1f70b9fbbdd24ed7668f9d8c9e4660923e3a765f3948c77f14e1a3c38e4c18430ea3db26a57cc2a4045a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
4766abf9ed1337b6c32af3f8498a2fdb

SHA1
e538888a6db0c78e670c7c05fc08bf4e104d5ba3

SHA256
483cd6c857aca986340a330362163346fc4e85acedbba7c6300ec69937a9347d

SHA512
f5c9632451e0cf55571513a906d2f9ad2b983214a39e4978eb8e570cc0274325b925fa712db677b680bd858eb5f8d893e03b4231208147839c97aac1caf6916c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\66m7b1c7.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
69d1a090cf8a6ac7caac2a55f4b445ab

SHA1
f368a201c42780c4c0af181d74dc2f0bae92353c

SHA256
fa1f795f6eb159dfb5f39a0e94fc16e1b7e32330e0c4c828fdb9acc82e5a49f2

SHA512
115750a8bc3c44deee3a669ae77846e940e6b76b00e242a535496f3cf627587bad3ac29e82a86c53cbfee16eaca898ad97c19d01867e8fea42c74675a2990c4f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 118081.crdownload

Filesize
83KB

MD5
d81acaef0db08aac297d4bd3c58ddf50

SHA1
02e6ac2c001c639078c3e842132f91509a6f7466

SHA256
95d5594cac9cfa5826e1c0b12fec980ff8a01136364aed2831164b46cbb13ca1

SHA512
45b1f047816f4ba8e730cf6914331f9ced81c1e6614f594a748eb6469efb2f311f0ef86e3241cafb2794b580df14302f9cb279175bc1064e79c6c501fa2dc738

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 280666.crdownload

Filesize
73KB

MD5
37e887b7a048ddb9013c8d2a26d5b740

SHA1
713b4678c05a76dbd22e6f8d738c9ef655e70226

SHA256
24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b

SHA512
99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 88871.crdownload

Filesize
48KB

MD5
ab3e43a60f47a98962d50f2da0507df7

SHA1
4177228a54c15ac42855e87854d4cd9a1722fe39

SHA256
4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

SHA512
9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 892927.crdownload

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 912635.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 918841.crdownload

Filesize
83KB

MD5
8813125a606768fdf8df506029daa16f

SHA1
48e825f14522bd4d149ef8b426af81eec0287947

SHA256
323060680fed9a3205e3e36d2b62b7b5b6c6e6245e4555dcc733cf6ef390f41c

SHA512
9486a027029a27cbf0424760625c08d73aa62e28e45081751c5bada7c07ca05b4e44239da7774cf4f76298fb6b71769ae62595ae439b470c8308d39e1b2289d8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 922350.crdownload

Filesize
22KB

MD5
1e527b9018e98351782da198e9b030dc

SHA1
647122775c704548a460d6d4a2e2ff0f2390a506

SHA256
5f7471c215b433f1b28dd4b328b99362099b6df7cb9e5c1d86a756388e0c7aeb

SHA512
4a11c811f30016218075d43a9f983fa7a484a06f22d625b1bd2d92b4cfabbfb142945ca0a9ca1cf91391a3e73c154f6121140d2f1d42aa35ad7f10817534a21b

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe

Filesize
536KB

MD5
9e1e1786225710dc73f330cc7f711603

SHA1
b9214d56f15254ca24706d71c1e003440067fd8c

SHA256
bd19ac814c4ff0e67a9e40e35df8abd7f12ffaa6ebefaa83344d553d7f007166

SHA512
6398a6a14c57210dc61ed1b79ead4898df2eb9cea00e431c39fc4fb9a5442c2dc83272a22ca1d0c7819c9b3a12316f08e09e93c2594d51d7e7e257f587a04bef

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe

Filesize
526KB

MD5
c64463e64b12c0362c622176c404b6af

SHA1
7002acb1bc1f23af70a473f1394d51e77b2835e4

SHA256
140dcfc3bde8405d26cfe50e08de2a084fb3be7cf33894463a182e12001f5ce7

SHA512
facd1c639196d36981c89048c4e9ccf5f4e2a57b37efc4404af6cafb3ec98954fe5695b0d3a3ee200b849d45d3718b52cce0af48efba7c23b1f4613bcaa35c0a

Download Submit
C:\Users\Admin\Programs\Downloadly\is-KNHEU.tmp

Filesize
3.0MB

MD5
8097152e93a43ead7dc59cc88ea73017

SHA1
b21d9f73ecf57174ce8ec5091e60c3a653f97ecd

SHA256
5a522e16c4b9be7d757585c811e2b7b4eab6592aed1fbc807d4154974b7bb98f

SHA512
d885a2ecba46c324c05d63b5482d604429556fe864202b1127866f2798ead67228390fb730d44ccef205c8103129d89d88a9541a4657d55c01373f8db50f7b23

Download Submit
C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
memory/212-1122-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/364-957-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/364-991-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/396-911-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-908-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-899-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-901-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-900-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-910-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-907-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-906-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-905-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/396-909-0x0000018116740000-0x0000018116741000-memory.dmp

Filesize
4KB

Download
memory/436-858-0x0000000000B70000-0x0000000000B9E000-memory.dmp

Filesize
184KB

Download
memory/1512-2520-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1512-2532-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1796-1059-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1972-2418-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1972-2235-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2036-1043-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2036-1051-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2264-2408-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2264-2492-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2288-1058-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2444-1092-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2604-2417-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/2716-2684-0x0000000000400000-0x000000000074F000-memory.dmp

Filesize
3.3MB

Download
memory/3284-11-0x000001E30E270000-0x000001E30E271000-memory.dmp

Filesize
4KB

Download
memory/3284-12-0x000001E30FB20000-0x000001E30FD90000-memory.dmp

Filesize
2.4MB

Download
memory/3284-2-0x000001E30FB20000-0x000001E30FD90000-memory.dmp

Filesize
2.4MB

Download
memory/3308-1084-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3556-2491-0x0000000000400000-0x000000000074F000-memory.dmp

Filesize
3.3MB

Download
memory/3852-1098-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3900-2503-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3900-2673-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4232-2528-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/4392-1085-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4444-2674-0x00000181FCA30000-0x00000181FCAE0000-memory.dmp

Filesize
704KB

Download
memory/4444-2669-0x00000181E2E50000-0x00000181E2E60000-memory.dmp

Filesize
64KB

Download
memory/4444-2668-0x00000181E2E00000-0x00000181E2E46000-memory.dmp

Filesize
280KB

Download
memory/4444-2667-0x00000181E1180000-0x00000181E1208000-memory.dmp

Filesize
544KB

Download
memory/4764-1121-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4868-1099-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4912-2401-0x00000192D0BD0000-0x00000192D0BD8000-memory.dmp

Filesize
32KB

Download
memory/4912-2402-0x00000192D0C80000-0x00000192D0CB8000-memory.dmp

Filesize
224KB

Download
memory/4912-2398-0x00000192D1500000-0x00000192D15B0000-memory.dmp

Filesize
704KB

Download
memory/4912-2399-0x00000192D0C10000-0x00000192D0C32000-memory.dmp

Filesize
136KB

Download
memory/4912-2403-0x00000192D0BE0000-0x00000192D0BEE000-memory.dmp

Filesize
56KB

Download
memory/4912-2396-0x00000192B5F50000-0x00000192B5F96000-memory.dmp

Filesize
280KB

Download
memory/4912-2395-0x00000192B5A50000-0x00000192B5AD4000-memory.dmp

Filesize
528KB

Download
memory/4912-2397-0x00000192B5F20000-0x00000192B5F30000-memory.dmp

Filesize
64KB

Download
memory/4992-1050-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5096-1093-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5532-2672-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/5600-1560-0x0000000000A20000-0x0000000000A95000-memory.dmp

Filesize
468KB

Download
memory/5600-1562-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5600-1558-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5660-2677-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/5660-2683-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/5836-1566-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5836-1563-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5836-1564-0x0000000000A20000-0x0000000000A95000-memory.dmp

Filesize
468KB

Download