hxxp://noescape[.]exe

max time kernel
1023s
max time network
1047s
platform
windows11-21h2_x64
resource
win11-20250211-en
resource tags

arch:x64arch:x86image:win11-20250211-enlocale:en-usos:windows11-21h2-x64system
submitted
14-02-2025 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://noescape.exe

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
74	3108	Process not Found
320	3108	Process not Found
114	2636	msedge.exe
245	3156	Process not Found

Executes dropped EXE 1 IoCs

pid	Process
5628	jjsploit.exe

Loads dropped DLL 1 IoCs

pid	Process
1984	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
206	raw.githubusercontent.com
211	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\magnetizeto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI72D9.tmp	msiexec.exe
File created	C:\Windows\Installer\{6A8ACD21-60F4-4550-8D6D-DBB3FFA8C7C4}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{6A8ACD21-60F4-4550-8D6D-DBB3FFA8C7C4}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2A29BDF66BD10706.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e62721d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0553CC43BE8FB73F.TMP	msiexec.exe
File created	C:\Windows\Installer\e62721f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA1F347EC8C5D843C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F52F6A41F3CA412.TMP	msiexec.exe
File created	C:\Windows\Installer\e62721d.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{6A8ACD21-60F4-4550-8D6D-DBB3FFA8C7C4}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
688	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b74d468fc327a7de0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b74d468f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b74d468f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db74d468f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b74d468f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133839704143275617"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = b5021f006502d5dfa3235702040000000000530200003153505305d5cdd59c2e1b10939708002b2cf9ae9301000012000000004100750074006f004c006900730074000000420000001e000000700072006f0070003400320039003400390036003700320039003500000000004c010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000500014001f50e04fd020ea3a6910a2d808002b30309d3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000b228c4a4877cdb010257d9e0917cdb010257d9e0917cdb0114000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000001e1ade7f318ba54993b86be14cfa4943ffffffffffffffffffffffff00000000010000001900530065006100720063006800200052006500730075006c0074007300200069006e0020004400650073006b0074006f007000000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000014000000a9d508541c0000006b00000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f0000001b000000530065006100720063006800200052006500730075006c0074007300200069006e0020004400650073006b0074006f00700030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe00000020000000000000000000000000000000000000000000000000010000008b020000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\TV_TopViewID = "{BDBE736F-34F5-4829-ABE8-B550E65146C4}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\IconSize = "32"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000095c6c1a4877cdb01a4c1a3a3927cdb01f5b38b51807edb0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2294C8C9A96F9A557BCA814D87DFAFEC\12DCA8A64F060554D8D6BD3BFF8A7C4C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12DCA8A64F060554D8D6BD3BFF8A7C4C\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0400000003000000000000000200000001000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12DCA8A64F060554D8D6BD3BFF8A7C4C\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4 = df021f006502d5dfa3235702040000000000530200003153505305d5cdd59c2e1b10939708002b2cf9ae9301000012000000004100750074006f004c006900730074000000420000001e000000700072006f0070003400320039003400390036003700320039003500000000004c010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000500014001f50e04fd020ea3a6910a2d808002b30309d3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000b228c4a4877cdb010257d9e0917cdb010257d9e0917cdb0114000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000001e1ade7f318ba54993b86be14cfa4943ffffffffffffffffffffffff00000000010000001900530065006100720063006800200052006500730075006c0074007300200069006e0020004400650073006b0074006f007000000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000014000000a9d508541c0000006b00000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f0000001b000000530065006100720063006800200052006500730075006c0074007300200069006e0020004400650073006b0074006f00700030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe00000020000000000000000000000000000000000000000000000000010000008b022a0000001900efbe1e1ade7f318ba54993b86be14cfa49436f73bebdf5342948abe8b550e65146c48b020000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12DCA8A64F060554D8D6BD3BFF8A7C4C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\PackageCode = "0C7F8E08B1B421D4A886CBB7E79DC45D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000004000000030000000200000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\FFlags = "18874433"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C\ProductIcon = "C:\\Windows\\Installer\\{6A8ACD21-60F4-4550-8D6D-DBB3FFA8C7C4}\\ProductIcon"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Key created	\Registry\User\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\NotificationData	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12DCA8A64F060554D8D6BD3BFF8A7C4C	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\TV_FolderType = "{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\JJSploit.htm:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 62435.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\jjsploit_8.12.2_x64_en-US.msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 941375.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
416	msedge.exe
416	msedge.exe
1368	identity_helper.exe
1368	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
956	msedge.exe
956	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe
3104	msedge.exe
3104	msedge.exe
3720	msedge.exe
3720	msedge.exe
828	msiexec.exe
828	msiexec.exe
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs

pid	Process
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
5692	msedgewebview2.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeShutdownPrivilege	1768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1768	msiexec.exe
Token: SeSecurityPrivilege	828	msiexec.exe
Token: SeCreateTokenPrivilege	1768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1768	msiexec.exe
Token: SeLockMemoryPrivilege	1768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1768	msiexec.exe
Token: SeMachineAccountPrivilege	1768	msiexec.exe
Token: SeTcbPrivilege	1768	msiexec.exe
Token: SeSecurityPrivilege	1768	msiexec.exe
Token: SeTakeOwnershipPrivilege	1768	msiexec.exe
Token: SeLoadDriverPrivilege	1768	msiexec.exe
Token: SeSystemProfilePrivilege	1768	msiexec.exe
Token: SeSystemtimePrivilege	1768	msiexec.exe
Token: SeProfSingleProcessPrivilege	1768	msiexec.exe
Token: SeIncBasePriorityPrivilege	1768	msiexec.exe
Token: SeCreatePagefilePrivilege	1768	msiexec.exe
Token: SeCreatePermanentPrivilege	1768	msiexec.exe
Token: SeBackupPrivilege	1768	msiexec.exe
Token: SeRestorePrivilege	1768	msiexec.exe
Token: SeShutdownPrivilege	1768	msiexec.exe
Token: SeDebugPrivilege	1768	msiexec.exe
Token: SeAuditPrivilege	1768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1768	msiexec.exe
Token: SeChangeNotifyPrivilege	1768	msiexec.exe
Token: SeRemoteShutdownPrivilege	1768	msiexec.exe
Token: SeUndockPrivilege	1768	msiexec.exe
Token: SeSyncAgentPrivilege	1768	msiexec.exe
Token: SeEnableDelegationPrivilege	1768	msiexec.exe
Token: SeManageVolumePrivilege	1768	msiexec.exe
Token: SeImpersonatePrivilege	1768	msiexec.exe
Token: SeCreateGlobalPrivilege	1768	msiexec.exe
Token: SeCreateTokenPrivilege	1768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1768	msiexec.exe
Token: SeLockMemoryPrivilege	1768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1768	msiexec.exe
Token: SeMachineAccountPrivilege	1768	msiexec.exe
Token: SeTcbPrivilege	1768	msiexec.exe
Token: SeSecurityPrivilege	1768	msiexec.exe
Token: SeTakeOwnershipPrivilege	1768	msiexec.exe
Token: SeLoadDriverPrivilege	1768	msiexec.exe
Token: SeSystemProfilePrivilege	1768	msiexec.exe
Token: SeSystemtimePrivilege	1768	msiexec.exe
Token: SeProfSingleProcessPrivilege	1768	msiexec.exe
Token: SeIncBasePriorityPrivilege	1768	msiexec.exe
Token: SeCreatePagefilePrivilege	1768	msiexec.exe
Token: SeCreatePermanentPrivilege	1768	msiexec.exe
Token: SeBackupPrivilege	1768	msiexec.exe
Token: SeRestorePrivilege	1768	msiexec.exe
Token: SeShutdownPrivilege	1768	msiexec.exe
Token: SeDebugPrivilege	1768	msiexec.exe
Token: SeAuditPrivilege	1768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1768	msiexec.exe
Token: SeChangeNotifyPrivilege	1768	msiexec.exe
Token: SeRemoteShutdownPrivilege	1768	msiexec.exe
Token: SeUndockPrivilege	1768	msiexec.exe
Token: SeSyncAgentPrivilege	1768	msiexec.exe
Token: SeEnableDelegationPrivilege	1768	msiexec.exe
Token: SeManageVolumePrivilege	1768	msiexec.exe
Token: SeImpersonatePrivilege	1768	msiexec.exe
Token: SeCreateGlobalPrivilege	1768	msiexec.exe
Token: SeCreateTokenPrivilege	1768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1768	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
4948	msedge.exe
4948	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2420	MiniSearchHost.exe
3512	WindowsTerminal.exe
3720	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 4664	416	msedge.exe	84
PID 416 wrote to memory of 4664	416	msedge.exe	84
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 236	416	msedge.exe	85
PID 416 wrote to memory of 2636	416	msedge.exe	86
PID 416 wrote to memory of 2636	416	msedge.exe	86
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87
PID 416 wrote to memory of 2092	416	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://noescape.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc4ad03cb8,0x7ffc4ad03cc8,0x7ffc4ad03cd8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8172 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=876 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1
  2⤵
  PID:5816
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\jjsploit_8.12.2_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,6047242168599449442,9092567245283320262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
  2⤵
  PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:688

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTVGMEUyQUMtMTgxRi00Nzg4LTgyQUMtNkQxN0NBNjc5N0ExfSIgdXNlcmlkPSJ7QkM0OTYzNjgtQjJEQy00MEM1LUJCMTktQjlDNUEwQjdFMzI2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Mzk5ODNBMjYtRUVENS00RTNGLUIyQjQtMDNBQjVEN0QwOEVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIiIGluc3RhbGxkYXRldGltZT0iMTczOTI4MjMwMiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNzUzNTk3Mjc0MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNTQxMTg2NTgiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:688

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -d "C:\Users\Admin\Desktop\."
1⤵
PID:4124
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
  wt.exe -d "C:\Users\Admin\Desktop\."
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3512
- - C:\Windows\system32\wsl.exe
    C:\Windows\system32\wsl.exe --list
    3⤵
    PID:2432
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
    "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa2c --server 0xa20
    3⤵
    PID:3052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:780

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\jjsploit_8.12.2_x64_en-US.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1768
- C:\Program Files\jjsploit\jjsploit.exe
  "C:\Program Files\jjsploit\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  PID:5628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5628.5684.12883612721335819940
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:5692
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffc3465b078,0x7ffc3465b084,0x7ffc3465b090
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1664,i,11947459964368241725,12067792380357609507,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1632 /prefetch:2
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1960,i,11947459964368241725,12067792380357609507,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2232,i,11947459964368241725,12067792380357609507,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:13
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3532,i,11947459964368241725,12067792380357609507,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7900BD83A15CDF611DA423692C5FE37F C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e62721e.rbs

Filesize
21KB

MD5
37c368f35896894ac4bec82986e34043

SHA1
72ca38dbb5c7e667be003117619e9e8b552f2847

SHA256
f1f6074d325094c5d31ff95adcc8217a066424496ed11d9f523b345e1646eea9

SHA512
f2ef2ce9e8f2650aca8d65211386871ec3ebc50001b74ff450cb22b72fe1424d9cb494cc91755de488b4f4833cff7d83216802691c7853d85d2d9241839b6e31

Download Submit
C:\Program Files\jjsploit\jjsploit.exe

Filesize
17.1MB

MD5
b393f1b89a320d6a0b42190c6dcb6860

SHA1
209e800233976ec908a87db948b5aa175d99b1e8

SHA256
ca45895af0e91692514e6f4b8b494e68392821fa18503526243091d7d49e3064

SHA512
21be0b7a232e7182455206b13beada6e9614335a0b3ada9875a68620efc14f43723778910dfb6070a47ee8f177d02add1d5a2e60d616fec914a88b9ecb01f0eb

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk

Filesize
1KB

MD5
1ec50c164be722bdf26ce1a614c80425

SHA1
2dae2cc89218d7fd9e11d5be16d9a659cc5f5f8c

SHA256
803f5136fb599da11d98365625638a4a002eb2c1f96e5ae97aaf2883143e28ae

SHA512
f91457f231901716674e400e52ec68eddb62983f07cfa5f136c0cb7e70e116b974b4af4432218068cf3369e44742347b4319d169f32c9de3da3c156df9f04993

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe6274bd.TMP

Filesize
1KB

MD5
228ff8c66a7e4dee23d2a410ca5d4e0e

SHA1
6000ee926ca3970cb3a29c7056ffa4488edb194a

SHA256
225e4656ecb03706b04b05599a7ff560c340a5c214bb1495952a64ed2af1def3

SHA512
d2d36466a38426ce594a0bb91d1976dce835106debc1354ae481b91b66d556abb2ee867778a25a66ea4ecafd3f4a068adcc0deded36b7cf67dfb390ad83805f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a21c1c04277fafcd2881ab6eeefdebb4

SHA1
b0c35188796dc37417d0e507582090faa7b6680f

SHA256
9932da1712dc4d9db20fbd0ab85318d9ef057a94978326fca974276016018712

SHA512
3ba58353fb5c3782dd02affb3b7e4112174d9091389f68f2a5b9ccd37b94318d486c0e0fcdf1fb6c31ab57cdc3cd7c6397665b7e374a7328561304e1ca5c664f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
88f2ba21e9ad99acf7ffbdc78234ab20

SHA1
11bf14f12c66bf1beb4e026c0ba1da34e9567dab

SHA256
587a136c2e0ab380d35cdfa3ffa232dddf61f82c71824709ab94779f949c078f

SHA512
02357697c9d24b5b5a0c8ac5c7fc31629e196639be32ede994af29df8d617b4eea676e78fd47d5d33e0b269204682c5bfeb841cdbd125035b84a57d3e39609f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
136KB

MD5
15bf191d4d4f939177e67e8b1643c330

SHA1
ef0c048218cd7cbac5d58389c4edd1e1a9292227

SHA256
97a8db9ffbc3b8c10fbf7f3f38d670a4e73768c419b6a493fae83cd5e23726c5

SHA512
e12067a527d1792fa135b310ea4aced272abd5fc1dbeba405398a0930cfc5de9340a239aa491f3f2b7913f9e3909e352e4d0408a0dc22fc21bf977c7e8e1dbc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
52KB

MD5
5788a25cac8bffae6116150a65828862

SHA1
1aebc687f124238f7f48300e0592003162089ed6

SHA256
515394e66e8a16e36e9685ae8552fd3a0adc65b350a6991dd2c50a4f9c1a2814

SHA512
f2bc01acc2ea2fbd28e2465b3a4a6144ba84dafaa713543644aa254d9658b5e38c9b5c97998cfd400cf61256ac53815cf18b1531be7b3717915c6985aa6a79ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
78KB

MD5
8824b5c22b3b6a16646098dd5cc32f14

SHA1
a3680d2d3954652d90553423d6bb3179b8508a13

SHA256
5b42a81510b0def268d55c6adc6d6d555976a3e43bc79d1fe201441fe451eda1

SHA512
e6c208597b68c8c6d30458663ed51284065fd4cd7117fa98f810d91a4b0cee4c873045f4fa5040a0f29ec0596b91fa246adcf448b22e1bf0b909351b7c6a297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
31KB

MD5
368e10139801d68888e3bbbbcf838cac

SHA1
d09bd421b17e209fb7a12318ae22556dd6910996

SHA256
c019534acb9f64abfdc127fa17e1a4afd504c16afb979adcf310ffa08842fe58

SHA512
c307b3a45c0090e898ecbe9773e8173f74bfb90f1be408993f8b8c60a14de79a02d8b0f6a0c6492db871ab1eec5fa68e2f048605755543c54f238448d91cfd5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
142KB

MD5
aa06cb6befb9812b0693a8f0b8587990

SHA1
06e3a13d36a7de7d4566a40b6aabf7ea2b35b543

SHA256
81936c8a4bd5808712ce152b94036125c3839d976e02ad6c4dfc9eea5d64e125

SHA512
9120d25edcc05b128258cf301783e4791037264193553235951646d0eb246204ffb90875f0419e77fc731edffa020642ae2513bce8988465dfe19f108db615c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
66KB

MD5
8aca43d81fbcf0101c7e53ff877b02db

SHA1
1bb8d51755ef67dd2e5302f87585b0ef3abc261b

SHA256
c2bec5b217c0428bebcd6337b94dbbf943718f0608bf47edd29ff6bdaadf454d

SHA512
1a0d67dd5725f9864556ef6e26b3f21c3cd74d6b2e2b6577f416df617251d41351881da5e7e5b9d6fb042a5f506383c825cfca20f5526ba0f56bc7ba0719853d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
20KB

MD5
078d2919f9b97a9b110843a00845b5a2

SHA1
c59dcce45dbe16021cde8f4c9cbe5ff06c548424

SHA256
565bd0d5e0367793cbb2f4a121de6621656f59ee3a76f591d855f2354ae7e5c3

SHA512
62bf9bbf1ff71a2f254a6b45c79d96d5578b7ae62de9b48b3223a08ff25e13283ac3e809fc3a3242158f4d8d7c56dcabb6de5aa63900f465980e0c1d9bf37759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
22KB

MD5
baf8dc12d0df9d43ed3c300fc74c8066

SHA1
3b695acc657260f3d84256284e0b91b0315afad8

SHA256
534d6ba8455f4511cc0634d819ee19b35cc771f802dcbab9d2817be0c2a93ad1

SHA512
1acf55c4a8d1d17fd92c2983e3de02d8351acd4bed80217daf97741bc108933920cfe03008e9f105dea18cfc74c383cbd4171aa8ae106c47ce6048930dd55eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
21KB

MD5
9f69c29ae87e4f66a6d4af08393ad5ce

SHA1
6907f618b8ffb57910434b99d0c2cacd826442c9

SHA256
c3f8c3da4430d08cda67d76bb22d139eb22bc7f85fb703e2121163dd2ffac787

SHA512
e9ad138e598e95a4ca6cef01b14ea8459076a9fe6c84b1db4902c8893a499f55323ffd00673971158ed031f725439b07c2165862ee6f8d38a9a0c1cc51e957c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
20KB

MD5
c8a6a2769a95f6fc7a08a90443b080fa

SHA1
1b4838073e969b68ab12714d9fdcf359c88a7a7f

SHA256
4984b76b4fd1c679cb68fa603836d3f8f3b2da99206666ec16b498cbb62ada47

SHA512
f0c27edce2873c20ea269d50f5c989a46f05f0bd7e98a40ebe9a5f033e6d676c3edef2d3947d1519f4da1292bbb254b0f9b8ed72cce7e8f935a0f827e556fc2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
20KB

MD5
65b0e2da6b7a8801b1cc32270417328e

SHA1
d248a83f39dc8bd04ca68caed0e2a1a286e28ece

SHA256
6575105bc00c1ca683016d16be006da47cd0866a1386c5596f94bbef7095ea01

SHA512
a300e7eb4e3ae30c52adcf44959bdda2e1abf0ae6ea6a61761324f6b87a15bdf8ca03a979d8057bcaac1dc8dd133c84d673ee3833b9fa5b083209be21d714c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
215KB

MD5
0e9976cf5978c4cad671b37d68b935ef

SHA1
9f38e9786fbab41e6f34c2dcc041462eb11eccbc

SHA256
5e8e21f87c0a104d48abc589812e6f4e48655cabe4356cda9e3c1ceee0acaa4e

SHA512
2faa6fff6b47e20fd307a206827dc7ff4892fce8b55b59b53d3e45b7dcf5fd34cebc4776b63da5aa4d0e0408344bd4602d26d09e7a456dd286e93b768cbfaa51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
2.1MB

MD5
e0146b27c14ebed2f604ee5649507f6c

SHA1
30b1598f771a33f6c5c60e697b5614b01de879fd

SHA256
cc403cc511021acef6180d3795d4629d4d2841cd8791657c5161a4a9c810e5cd

SHA512
746fb3c6086993473b9c2b561f53b62462da3d03fce3e820b210c48b39e85ee77997607e831a5b299e2171790e8ccf58e8f5b34632914ebec3cbd805e8ace6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ffda355804de5bc8_0

Filesize
3KB

MD5
d007a1cc90552342207a9bc90067e1de

SHA1
56fb47b54d42d62e69dfed902ee65f2d0e50b759

SHA256
cf32567cc998362493b56989692d44788cc400f3a196573b600ef907564ca213

SHA512
7708030a39f8d9de413d1ff44cde48b2430764da9ae5a73f9d5f67ae25cba7a575455ce0dd7cf14ae2a3792cceb1788e3909f483cd07a8e6a75d69b8ba84252a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
555d18be4232c86957814da28357df11

SHA1
9638dce9f1713c00c56abfed6f2b7dc45f5ddda1

SHA256
b629a2bdea90f9ce464a78aa01b4509180fccb553e7d94cbbdf25abb620e7b23

SHA512
8e8bf150c2664e3e8accd902acde34c2c6537a1358399d86c18a90da8907c1d64ffda9546b9cfcb2bbcbd53973f234d1ea3190d9f8375b81283a27289f2f5ea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c5b9a056ec19531512f2688938b3c8e8

SHA1
c836c36be8a291c5bcbb5b50d814845bb1babbd7

SHA256
77c9fee51c799d41503996a3df40777651b51beab17cea1e3d28e46458cf5573

SHA512
18dd4cac222c3b274b0f2f8afbe43a4edb9173cbc1a055a160b767b4f9dcc973c2d478d67468ac27a5771ea6c79290bfe1eec3d064e8445c5a99b7f9fbbaf18e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d13f283686fbeac1729ab73c03370f78

SHA1
fe49f7be5023f5531f46729a296104c2358297a2

SHA256
247354e1033f0898e73ff65ee36d06bb7c8c5e6128a8a2530922d4cfe96e0ec9

SHA512
286de70044fe73b6ecddd8175a9e296357f8190209fde3b8d10a3ff6aaceeba2c564660b4d3ef4888fdfcd549687e46ff465d021f34cf9fac08e1e2af2075dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d8b7cffcd4d65bfd0f394eca7148ff5d

SHA1
db3013961504eb258a462101e7cc1bf641dad5a8

SHA256
d91566a1f7997fda2cfd0e9dfaa5f0d5ae51f4b25a805c7f63298b9d494a0f6c

SHA512
00e18a10f28453c108b5ecbd732f20003f3be97384c3bf828bfa1c8a0621ce29fc0de646d6cc48ee8bb8ab811a9000114bb1b42c6d28c99ced8c732cd01aa980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
878c3c145192bdb256d98227b6c4141e

SHA1
407ba0ae0aa6ad9d372b4be084270c9c3e2aa1fb

SHA256
a34565f7caaec05e6cb3574ed0e140ecd3aa1118f0e76b33b4a1e5b1d2cb3ec2

SHA512
ffa3266671536dbe8c1e45b6956a98948e0db346bf86a12416126819f02a07fa79cbaf6d034f2fd6a16bd7898028b0bd4124f1c6b6facb4a3f9ba2020b725e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bbcaf383eb5385e3e428f524e45926b2

SHA1
147f3d1b4e86d938ae5c59857049424c75309f69

SHA256
f1005d694bb99f3c2f37f0406fde74896d59bafe7326423fbf24de85fec40c16

SHA512
8e79b76bc947aba9a56cc9a2b37647c7e8d6b46c13b27191166f8ebddf0897a4c807c295a0d3d08253bfb6f676a1c571cdc859621920de311355a764b240245f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
80092beb0b71af5db2283244b2813a38

SHA1
d7dd20d695b87570e87a43d50d8a62b4f1e05d2a

SHA256
97904752230ec515fe131c56394feeb3e8cbd2798d56c74e950ef06d73369b1c

SHA512
73d639c2fa7904305308151b5ab468da960ab14206ce42c57734d51531bb368e4c004e9b11867d7fec3604da412e24215b5a6402a0b8f501769896cbbedd6411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
a4481445c3284f8dd7cafa7faf40aa70

SHA1
c2ab5f2378e437a90950ece7982719197fb5c868

SHA256
6ee8c05489110511f3c39a8cd7c05be81980dcf26627c86c24dfa8c68fea438f

SHA512
69647ca4e1389486afdadae23a50163c7ebd4f0367670aaf383df279608c73518aafaacf16deb2eb9ff742bdba466ab3effec29dc04642ec7d40e318a9389b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
0271a86788f28ae54ae30cdb536f5ffe

SHA1
3c43f778ef057c2b0e7fb01748b0f472dffdb436

SHA256
de5892d0a3a52e822e1a2dd7ab1907ed17c1cc86195a8dbc90d155ac816d29c7

SHA512
ce010c50628b2d2a41f8ee7fbbcebb9b2124259f4e5bfdb997dfa9e72fa9b2c1d5fbf4edefd5c93398e4f05f1247557a0fd090945598f244f9b2036397351698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
df6ec4d9cdf5299aa70b5b58cb9a74c5

SHA1
10c3f06b33f3663808baf92073d57b77c0b2e266

SHA256
caceb8e39fa68172cb8a537f8822be58bf4018893f5286493cb420513b2bfe8f

SHA512
0135e9db33c21d356a3085cb7b8c6dc65cc8448c449b96e6c4370aed03bbe5b1a730c24c6db4d5a94851e16e93a1b7a0021676e907692fce19d951b0bf20c62f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
bb4a675bf67ecec1655d216b45171272

SHA1
75652453201a348d755c21bdcf3443571035ef00

SHA256
db78e9d9b887a9664731c744a9d1b4f8edafe204b026c69d05c09ae785d068bc

SHA512
20490a4423bd49a32fb364f404949266f8eb7714245664c07a7186dcaa9ccfda7fbbfd92c20e01bfc8a82a4838a376d2a917c184f340105e87283839be1c960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6d8a98b9c9fd7f852f44665534f189a

SHA1
c2ab260254ac451a84ceda12553592f0af9bd92f

SHA256
01c8871a988b79bc414b18812ac936aae76710c41596f4bdc999d1ed84bb1257

SHA512
35f45b9997285b26addf32da224a14ad743d075146cd98c507f63601d2728467a22d2ea2d8a17841b5ebb970a41e19f87b6f2fb3f0d4a39489b7fe23f22bdfb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0ac99f04a5d11d603937df579cff1ff

SHA1
e5fb600da1b6e9b468cfbf6be0af3a3fefe217cd

SHA256
fb0b21e54a39361c846f295ecc8dc4bcbad04ee18e363a35e76168ed593dd1d6

SHA512
c415fd449df389d89bc4cc2ea768e85064e485ef01d51f05f82cfbdbe8b97095e9a97cc4daf55e7d009e6d7e5d6d934a86a4a8990171a016c878eed5adc5b8fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
636d62ec503b28682b86719d3e40862d

SHA1
c5d0afae3d4a95b6358d118bfc6a1b738f836c71

SHA256
68037f2ff51a3468d24fa6b2b5f145565646ba820d5402eca2165985c5c36861

SHA512
15ed75df92b9adeddf2ad8070bbabe850823c69a5480236cd42848fd8ddffd5502577b9ffb9584c51584edbf25d5a61e8ccb1e4b3aa4860e9f3b726a906233ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
927f0d5271a8f29a96b233ef3f020dd5

SHA1
e7ee2fc1abddc919aa53458e3f204fa67a1a5a41

SHA256
6f8c68974572c087d359dd83b5666daac2de94cd6fd9e89dd77912104517fa69

SHA512
d83b327741031cf4cfe198dbd1e765439f8fbd353ef1544075ef1af7e3de6a0a0435f85b1938cc3996d8372d81b2fcbba42c30e45203eb71273eb99cf3209eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
682737f280576f0f74d95735b57e17b1

SHA1
ad27e87752e4d04d92ae751dc810e03fc24baed0

SHA256
a22e52717db784e222fa94d1f665a1bf7e925777b230e032d24a78d9c8296ef8

SHA512
7c88d48e1997e1ac285319ed1681bcfaccecbed0281d2d5ef404e735b47709fe51235f323b448ffdc5568bb551214ccf1f6a43c107fbbe642178e17a1713e652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
41c611f3065344ecbbbd89fdf5e04713

SHA1
f9008075618d5521c4494e7241b87de93f8e8b3e

SHA256
aa1e2918fe930655ad683cfee1a561d889994866b9275b65eaf538eaa43319e8

SHA512
743729b42179e4f83a450178b610ca95d37363a07d5e363c1b624f44b9c48d9eea10fe2893bced4b44736924bebd04c8c564bdbbcc8630ca3340b0b4a25fb3cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f191fce863c964c41ba7782aa2ded7f2

SHA1
876bbd66ae92895ca983cbec4d527b10ac49b105

SHA256
4e2773b496c3d860e3e37f64baf0cbd69b5426d8d0bfad130cb99ebe791cb5b3

SHA512
a7f5e7277f0b2c376712c8a08f701a797a540923f77542c35af5a61dad1e3ac13dae7595192ad7553303cca0c618bacd09582e450b2732ed1fb62bac3f1c87d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4509692eb45606c6ec1b4c4f6c7a8788

SHA1
db5203bae9a6738ce7860cf880d641f6fab4e10f

SHA256
99cf81eb6de3383beb6c81eb524c8154a7b9923cd0c6d6ddc81d2d2c20b74c30

SHA512
7767fd2b769cc4b86336e3d040ad707bf15f4619d8d240cd4fc9e1556235fb87ac36fb177ebdfc153e6baa0fb4d6f7655e4ec6eb88413c4bce0a8481e3861bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4800ab4c298dce1a1bf189752f37f804

SHA1
b4ab3c12459015ed242f81163366a9fa125b972e

SHA256
5837052b6cc78fadbacd15280faaa2f93fe358be0d95b9f1481fac5944ba80f5

SHA512
ce3244e6e726a9c67c209b7fbc95f75f49c1e9b4673a9c614e3742fc69590caffd46d382a803dd985b3287af9393f13747dda3f9300f30351a18c74f45f704df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
16a41f20cfab7470f2c0d095629ff5f2

SHA1
29186317f91e0eb76ae7c4aa1b10d82ca370c7b8

SHA256
6bb5d363d7fa5ab19dd4ecc859b95517625280f20dca774d4aa94b3a87bf1657

SHA512
f52c3aec53a99734b97be0cc477751c4d04076cd3a34bb6d67d174515793c77203564fc4767ad3224fcc0ad2a0159809d36af1546eb4dfacd6fe7d39c3b3c5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b22b8388402b5a9136265bf997200b79

SHA1
00a5ae0f5e5462af8d2021258ef91bc63bc17b0a

SHA256
ca4ce297449323d54eb66e81c5813ea3f12acd71540333c0cdb5c0c7409d7a7d

SHA512
cd866dfdcf6a3e40dc48f0b04bec75dab3c52d6a7dceee4a503901e1abd55691813d4be97015c9652185dd4f8dcd5e6329a6f33376f445c89005e2771533bbe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e607074e1f331c1dd3e95abc3fbdf523

SHA1
5409bf0c6279de231e1377a070fd5bc76a7892ac

SHA256
4b36c4bf8b6d00c9e97ead3f3dcbb0be1e1bda39fd71a3e6cf02b69dade3fbb8

SHA512
936a9b314337de738c9b297ed380fa2662331e80960b20f15a26b02fb38104d17930ce3c09b7a5a1c987ebce8926f9090d383ba0806befb9666744309a10db19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e09eaf41e239a6cb37d657e9cbc1704d

SHA1
94fc0bcdf3d996fb91701eae5017a67f73f5df78

SHA256
6d9c86404f97e010010b8648e73ac72b5f0d9dedf21dfe6728d89611b3669261

SHA512
01bfaefb8e8f6f14b0763dab14a75dc5091fcfee19c82670eee0d21e6c20dfeb73e6ad1bc5a0cd78ffe28c245dbcd4eecbb07d76dc55279dd9fdfc9906fe370b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
bb732dfad9ec7c4871cd42f10988fd83

SHA1
f61118f971a313e1a99fbc4e7316d7ebb0142829

SHA256
69a7641dfdd80fb6ef8dd3909c276b5a70948d8c34b76bdc78c865aea592575e

SHA512
0b58e9434074f1424e1da8ef8d710c701c7d940bb8c2cbb2d2ccdde8269fcb0ae97139213115cdfc3938d6925d05e4720454f4485862b27977859e550d22eee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
8c69eb607b2b292cdc666a2025948f88

SHA1
8786d7b1c34a0daff0bd33313875b0d78e64dea7

SHA256
498a8300b4a3ec3d31dbc41a62ecf65758c476388b3999e2a3103e75dd72dbfc

SHA512
eef2cdb021330b5702621d365394bcc4ca019b549ff1e1bdcb6b28868530c1dfab0d8cf1392ed3ed7ea44f1de24db0f2510f034e6d358f1649e6480bb90ce5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
87fc9dfe6d3ed9feba1059cbd50e6401

SHA1
1a9d3dbe10f84df45d03f7d06a4ec2f3a0bb7cc1

SHA256
967b3553cecc58dde4a7dd057fb882c8964d377581567ea608db82d721ed0ea2

SHA512
ccfee71d1b0799c738906c73a4cf04c635bca7646cc29089e1fab5e058725fbea5af80ed3919488e39eb32ec8af92026da654842c8dc4487f4d2a747d4e5a4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
6b184506feea5564be4a17c71abb43ec

SHA1
0e94bc1670727b4e5b7479cb946979ca48bd54c1

SHA256
29105a2554f6408c7948c470cf7ab341ad40f0d0c99b0f0fa916a7117d7b8b6f

SHA512
657abe0402baf16661a575b7ef6f462e339bad8281c43dcfcfc20b78cf4d7b6c20d8d9500e56d8cf7f4ac81c1188d3a4856973507ead458536088d332d75774e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f623.TMP

Filesize
48B

MD5
f8820e54f241a36b6cb577cb3a428d15

SHA1
084fb5945edcca5a4e34b711525e96b1b96224b9

SHA256
027201a34c9e98a35402bc31a4691042a2a8cdf687c376c63181a31729f2d288

SHA512
a9a1480ed1fc2a115659c40ddb398b2b22d6d32cb3a9435ec2c5631120af29a2714e602e548e11a707228802cd34d5973ba9fe08103b470656ac057449573800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
abe59a4b44b4a216d23e138ce8530851

SHA1
488062e2d1fcfb74d5bfc307648020ebde74249c

SHA256
86cadc0e87ac1026f4915eef92ea911c0e6dafa85951dd509862a245d9250155

SHA512
37c920d3557727b61ab63bef18154b7b152c757732f4cf94ed9329fb3140b6fff5122ab8c9856a7ab6fcb73237060a4298ad3a789303a940d557c72e2fc42a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ca615eb8d9d980b727d219b725d8f28

SHA1
a1ffa6f9ed5e5c6607364d9be760806bfe684442

SHA256
ca5af16afb16654a20f57bb7ccd9560cb6b947a3cdccd62bd48e0eb12894a62f

SHA512
41a9c90b9e90e9af923ef9786787576116e3f290668bbe514d833a4b7f8bcf4af8774009be50c439937e9305ab9bd0f95007b59abc6a167ac1916ae523db6d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9567d36b47feefc7a9e90a71722d96d7

SHA1
18ae7014327f7a6e1a040826c0436519f20d2d3d

SHA256
c3e722863bb2445fcd2146d52cd5ba664f79b663d3f69880a1b87744f33d17fa

SHA512
300cc65c38af9bee18da13d15529331b2b9571773431446e93444879494dab099d1a67bfa97780b4b30c9e1584cecd190a8347a9c4655980c46c19f96a529049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
32615d4f3830caa5c4711d247938cbd4

SHA1
698c9c75ad694943fee26aec07d41bbb16a30eb6

SHA256
ecee09bfe22c9fe2ac5359d65cbc64eee2046bf25351f6773426b386e4a08345

SHA512
8f0a5251d2f96276ab7dd9c0da0f96a766566aced7f31ea40d520f50166060688525726343d45b447d473f58d4ff9f2b8b4b701763862434c0b8ac8d80a886fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d599a00615b36e92d4d24b39650a621c

SHA1
49fa07ea0bc75cd75a2022cc36b06e935e490e48

SHA256
7bc2dc0fe07149300f4365b94bf277443df121144983c88fb333733272ce15b4

SHA512
0165bf1b3487db30275bcc7f46423efdd537dfd14949c04edc902ed2eb5012bf82edf34184f301bd596af8610b2e1fbcf187b815e85686914da0ecfdfc1b96d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
605775ba581b9d0583d7d923e2fb08ae

SHA1
875cd401f22d6a1b336ce17c7ff81cf30bbc12ed

SHA256
55cdd2c9f1de5bd37674c142f9b81a29efa591473cb078be5b2ffab7b8704627

SHA512
470c88856c54efeb66fa2a96aef1742894bd5af70803525e4b367ad4336356e6e6a92b683c4a4653aa1d7d159d5ba4035fbdcca140d7f1ed96ae383c4d704242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b55ceed2f060813f0284e6735c3c6b2d

SHA1
dcd6310ddab21637c32bcc64f9bc4f8553c03279

SHA256
d71de58f157833a5466e17191340938d43bed8e35e5bcbf4cd86f89cbbf09caf

SHA512
d5e2864cabc488a2a36a7e6018010ff3f8442c457634e91b6a7f2c90ed77ce81258ee014551ce2718c0bc95eee1eb4834034f803ebc2b7af6ac6ae6a7b34d522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a2502783f004f64d1d8c710cc88922c5

SHA1
0cef4a1434565cd9025ea5a8b54ac94327bd6d55

SHA256
56f2af87dbe645ebdbf57bba370c89d76563eed4d2305985297bba4e13d413ab

SHA512
c49091c4d460b3b2b6c576334f0258e96d992572bcf7486ca7d0ad7fffa81793c78cb96805cfedbc6277ffa610046ef94636e4add7ca9c86ecac2168aebcd442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa0087c203fdc3f1e0e10f2e8cbce78c

SHA1
cbe4d849bf758f8157454e42d05846a9343fab90

SHA256
c28e1fa6c07fa5ef4b4646c275333dc00935942766a02c16a69a212210c5efc2

SHA512
47d7120c016e59968d5756f43c22ed3a2e42213cbfc3c884edfcc8d9a60eea1cbfbd4dd82387f2f947acfe638b698b93ced6bb23fd3d6b5d5fbe04fb53086264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c3260c2726a8723b0dd4a7b914c44a96

SHA1
3c64e2f40160ad5edda19b9822e4e3c7fdd769f4

SHA256
81ed97745a26b1e6a81290602372d56e41a4e1841f2bfce6c1343de5478e9fd2

SHA512
343ea94b2eb71c1a4b6ee81186848bce3fc06614daf9832eb3098d2f12bf0b877d1888fc3285bd1a9801dafa1145e91904c8418c8f799f40a2e0dda959a5288b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d0a655783fc302b24ff476219c072514

SHA1
cacc689ad45efc385b5fcb7e5cf33e401b87b56b

SHA256
9c23782aae13a513ec833ae3fe0ab8a3e5a271358ceb84aa49de205161383b8e

SHA512
9e4ff036256ee67b227c8150cd1b9e01c6c6dd3ea1098f4a06e7d27c765903580f4a12d3cb51488d97718a1ba16f14565dff7134d1861d21bee9ce7d08277fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58582d.TMP

Filesize
538B

MD5
750b0c4e96dbb545265cb8a533058946

SHA1
130348b9cb66650af1162506fe061948ff7a54b2

SHA256
b488d454ba4a47fa9d10135aa733a405fc4e5307ebf27e1bc416044be10efd50

SHA512
3bed9cd6dee177e3e715b8df9cdc95193e26a5007a4665315dbb5f352cb644238f6b2a188ae8371eb6ea17846708c9d9fcbf77cf1eecef3748ce63eab2e6f223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d088f9346172f4b5ce477c17bb42dde3

SHA1
f9c5bc1609070dfc018ea3b112ac564d965e33f6

SHA256
e09af1e10b924b6d9b7284b7d627abe57509f9b596c9714c8e6c830e5553fcc6

SHA512
ae12073d5ff6228bf71aebdd63e4c71767710603e9cb09eb8bb6907b2f110ac601b2e0df261e9312e86009de551d452368c8e0320d8e19d9f5c60af2df2638ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
556e2cc6a74e66e0a2a2d31aff84f801

SHA1
44681588d91df2e44f005e033883c4c4be514b37

SHA256
890dc918fe672d3d6426a718681785c9dee347378b73e6f289922bc05cd3bc58

SHA512
8c5b8692a26bdf9f97e2cd129bb87f6d0158303233c2ae65b8df808dd9a6ee40828dc79855ee282ce4a3e7e97d5fa0a1c72a2bcb661428761b39cdf3e690ab2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
923cba78a5d438363331df62acea5842

SHA1
2d2524e43d5dd242a30209cf7a642aa95af61e22

SHA256
faa57256cdc98f9e264cf8d44274942739b8a37c1011253d83f88da2488b4339

SHA512
93d6407187987c6d9ecb4c5bdcf88ae217832d7091635df18650b87602c6841e52dcb6222b182a73427eb5c5d3db3a265b1e39a5985ebcb6429285a6230fa9bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b00cb249bccedd2bb7c1df3c5c6647b

SHA1
34b23df2f1897c4ebff58f85415c052f7eff593b

SHA256
ae3ae8044bdc7f3062f7d0ff083e8964c4833689ed66583f0565abce037cd584

SHA512
684c364faabf7084df5bcbc1d86f9b95d416c838f64bec6053075e503b24a29be7b2af9952bc995305fab04b87baaeffd433f81669c552799d2fb20aa752f8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c54c63f44d358c9e3cd74a60fe390357

SHA1
e47456f135560da54bde8d078c5f924abb0a6b6b

SHA256
1385e800223eab07a7627ffb2f7f9845cbedc489e6b4d379a5f95b35e3af2ec1

SHA512
0d6799b23c765ef953b5e3ac719b5dac2d3b1f47880d17efeb16a6f4cf7e8a15f3f7c29704f0cf77c2d4d028276e836eb7e9a4c608ab869bd404be67c1a0dddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9c96873a9e661d18e2b1cb663f87aee

SHA1
8c352075ee51f1754c7f813afff46ebbec2e7451

SHA256
b294fa3351e43f00a10afa8c53a48b3ed0038449cca379030517729dcf3f3067

SHA512
125d0f8771586845f74598bdc64d02999493ba7ac9885c1853cc5d8732fc665dffc545cb1a00e8cdb477ca2ec9676e678b5ffaf6a67f8f64fc7cbb648cd25c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
baa9a0379f100329a9de6a4c28ff90bf

SHA1
26a5f09d6f65a89a70704d4ad9451870295e9e3f

SHA256
fa9413b4eacfccf044d3aa01afe74d499186a5124b465da09d99a62102bb7b8f

SHA512
2aa931128ef4a2470334577a9c2da239d55659adf42c209241e72f13231f6264bf4015079bc9ad555ab4a85fdd9bdd5b8344f8ac4aed4d90b27bace4bdc905ba

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
a52866cde19a888f704a6e88fd7b0232

SHA1
95012f733c1f8b320e253158e0e9ffaef4223ccd

SHA256
b8f331a1ca1c7717b5bd2f2f7105d7f5f99b481ec25fdb3f08459aa3b39cec83

SHA512
a39a9011a0a3c4a74ccb87b02df00daccb6a5968909e1cb6a5d1f41ab29262493e5299e603ba6dc5f06f48f0dd972817b1e914498de39c2f529ad2ed22c11f4a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp

Filesize
23KB

MD5
3c0b335b1d1506dfc3d1f4674b9b6ca9

SHA1
b9b553ccc9353535839f1c2a9bf5b311370578d1

SHA256
2d49a9d03f69c0048d27892bcd3857961d0b1c7f85fd9e53c41e74b3b18a5141

SHA512
a195ab104beaa2119fe42a871c2c246a9779a9728457b1cb0182aa35e93913625389f1c66de88df38817e0a459f06c9600d38d96f9adaf05812ba6d4ba7b29aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_njt4x5s3.w0q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
9943278ed39af3077446eeb7f11bbfa1

SHA1
7ed19fb743bd73ef3a995968236612d132b88c5a

SHA256
9033af7ec0f1df8de4ff765fa304f3127de7c02bb92b0c21b900b4b0a01d1531

SHA512
b5efb5b3ce00e5249a96fcee6ea898893728c9d028cb8e7e3d8cecf4e0f972ff5de9aae9cf734e2b4063c4af6255b96ddb9e956e895a24243266c991e0315294

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
0b9c46e8b93f5164e92c74b781ad40a9

SHA1
3769438e7b07dd690c86c2381a64065f750e8b8d

SHA256
031024bdce697361978bef47d0f564304e65a4bf9923f640dc8671ffd12ead83

SHA512
b60cb1d67ab613cc7fc43725114c253dbf4000a6681cad16cf6f162a44ca475cb03185831f9960c9750d200b385def692fc35b7d0db1443c94dfb072df170818

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe62a37e.TMP

Filesize
48B

MD5
3ec122afc22acf6d5e87850ce7ff76c9

SHA1
8e04dccd1027f7e42182f761c397da52a19c03e6

SHA256
b7c13ec80815def4f60d857ed26985788f435742a931c170308590c4173eba26

SHA512
340356555c26e8c9b1acc831562e6b06d26966f4e3ef45cc69d69e27f7fa78e89cea89618bce2ce487d20c0656966ad42f1f118346052e1170513e5c3ed3aed1

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
1KB

MD5
65fb4f03e2f37bf3b6d5d306a3a42715

SHA1
526d61d2763d0df66783498f46d13e566503f201

SHA256
1f64f6089e3245a11195f0221e9f31ede8bc75e982a30ffa7dc93035eb266547

SHA512
eab1804eb58fffd09f330e5795351261be238df29e890bda0d149c744b8e7db9be648aa8777135bcb102af390b8e6ba7ee7c3e6a48b09478a9268ea2ddcf5447

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
2KB

MD5
54e2d6ee20004ff04df7926b90c9aaa1

SHA1
0a51ba55f76c0bdf7b743078053e34fae763e24c

SHA256
69dec57ab1eb4e81ac545c66eb9d4ea02b19569c8ae58ca7692b98e65385c2d9

SHA512
82393f612fee6f2a39784a49583775d05600f13fa88e3909a63d754e50c830debe57696149e7087264c0d756fa9b7e27e5048119828f245643efc979f76d09b9

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
3KB

MD5
3e6d416d231400c7c3e76388911e19bc

SHA1
2ff2784526701e425fe100e98cb095f9ba521bfc

SHA256
8d8b65acf180fb288282e1379364538978c5a50a2cadb1a21b7d43d01d3e5dc5

SHA512
eb4cfaf5fb4964e250f5652835fc59584285bbafc68bbfb981fd00f18a8856967075ce85316345a40413c67a2933074b13d33fd3faaa2f8d32233d7b71598ed8

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

Filesize
16KB

MD5
18eae263658352fdc49aebf4284b028e

SHA1
9e704b6a8c986f86f9ebc931540b49ce3b9d29ce

SHA256
b1fd06895afb4741bcb978dede904d06967f118229ac7840ddc74ed749240a79

SHA512
56bbcfbf6a6e320a9c84a09bfe3ce2dba9acd9ea82624db5fea1e3c1e48adb144cbdcabcde4e2aa57247b0958e41ab0a47156046b2348beea49031fe88704760

Download Submit
C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe627f5c.TMP

Filesize
1KB

MD5
ce348282107b7b987fd4ab71ba531b27

SHA1
7f81133dbf225d34992339cbb1e6a117313ece07

SHA256
d5f1b21699799a854f76159dc86ba2db2a1ea01e597902fc4604e292e3fc3c77

SHA512
200632e3add9d7e3b1981c0f3e6547ae484ff65e4a0dd0052f542351ce83edbd1ca9903066bfb2718330ae5532c463ef622399ce72b21a1b3a5cf33674573ddd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
1dd450299465cfd359d73dc3105fbe23

SHA1
a7d7a0ca3faaf17f368f32892a29dbd81f004105

SHA256
67a48fe668c3b423e1687861e3267bd2c277519dd2406ef8f6e34eea47ab40c6

SHA512
60032add51210792f85c77699e0511b7a962f77bc6e2a3c8dac3cfd3ff6ef158bf21dd275119f267775490cbf24ff2dd821a558d67e02140541f22cd1102d394

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
6cc845d9c34de274ca6b39c17d154751

SHA1
94465484d89a6cb6f4fc6b718727ce521cb96cc5

SHA256
8be16b059840598f9e7455c0cf20dc7bda3d682e42fcc5017ac122adab07cec4

SHA512
b8bb34e17b11bb39b5d4fb90146b3ed6f11fb0cdcbadab2fb5ece0ec72d1443380798bcd2c61f406e6fd05e0de21216b65e7f7014508b4027e7479c583b5727e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
d7747a8792f231ac3277692ee5ee3f3d

SHA1
74c2bb1d4086fa6b27b5cc0cc525366abba56055

SHA256
32e6784fc9d7ac6d38a587d8d5545c6bd642f58df5fc0d2c8819eb3e58931c97

SHA512
4b005eb06cc11f554ccf8b9dee327a8fa32dcb8973d604e59c14fb47f5b2ddcefc63ac3d4c34a36b6e38782b0c7accfb11cc2dd8cf34a4454142089f92f662a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
ed1aefb28968f49b3dbdf14067d1b039

SHA1
37a0655f5772e7d58b15e1a8ea2395e4cde1c477

SHA256
add32b80f68c5fc691c016606b07eddbf2e0871d5e4a2952418400aa045410e5

SHA512
9ce44980071d5abfdfa5b7ad81dd918611e6b7e14a4c78afba142c5e971515047fd5b3c2699141de3b2e34f660a081e2d9f990d81c399b25ad8b575b13b74fb9

Download Submit
C:\Users\Admin\Downloads\JJSploit.htm

Filesize
17KB

MD5
fe72039a21948ab0709156d88a59b536

SHA1
b85397cd1a1789afb310ad16088f829c4e9a4359

SHA256
0d4aecdc7d4b37b5c83050dd6044561ddd600ef8cbfca78dfd64ff752f82ec58

SHA512
43033ebe580b5504167f20653e964dd0fcd5d2c0c1f8eeda53f9ad1cde5a2ffe3753eb5b0dbaaf0ed3c98a3fbe4daa64b4e345af4cc94b2e5968bf31b9ccda38

Download Submit
C:\Users\Admin\Downloads\JJSploit.htm:Zone.Identifier

Filesize
112B

MD5
1948e713ca0fba7997f05643c64ad6bc

SHA1
84a5803a312f7e76123105b479f97f7015b16c41

SHA256
790dc80d13dde3a5736ecf628581072530917c8eda5cbf4eb29d3229cd48a18d

SHA512
f9b7622e3ad0eb773e81c3e04aa63baee89a351c5d970da67d96643d56ea10115652f0d481889b1f4403f4d908736b0e7f9f7b0e31896a0547e0b038cfeebc4d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 62435.crdownload

Filesize
6.3MB

MD5
d8be6f14b4dd7a85a5b5479e88b940da

SHA1
4c1ed04a00fb4fc31cc4c10172d0e6f310faacef

SHA256
c3daa5b6503c601bf868de990dc5fe055c266a7cba6e269115290c37fb8a4d05

SHA512
77964855eddaf57ebf7810185eacf2bd40bfdd883473ac063223ea496744d81db678c171707d44cfe19077df1fcfb8888a54021fc6af7cb4547dcc464ce717ea

Download Submit
C:\Users\Admin\Downloads\jjsploit_8.12.2_x64_en-US.msi:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1740-1223-0x000001F1D76C0000-0x000001F1D76E2000-memory.dmp

Filesize
136KB

Download
memory/1740-1232-0x000001F1F0080000-0x000001F1F00C6000-memory.dmp

Filesize
280KB

Download
memory/4092-1623-0x00007FFC59600000-0x00007FFC59601000-memory.dmp

Filesize
4KB

Download
memory/5984-1520-0x00007FFC59600000-0x00007FFC59601000-memory.dmp

Filesize
4KB

Download