xmrig | hxxps://chomikuj[.]pl/action/redirect?url=https%3A%2F%2Ftinyurl[.]com%2Fyckumn8z&token=26384e27c6a72ff6ba2f3352ec900003fbf00f46

Resubmissions

11/05/2026, 19:16

260511-xza97scw3j10

11/05/2026, 19:11

260511-xv1pascv7q10

11/05/2026, 19:06

260511-xr6fdacv4k10

Analysis

user interaction
yes
max time kernel
461s
max time network
461s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
11/05/2026, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://chomikuj.pl/action/redirect?url=https%3A%2F%2Ftinyurl.com%2Fyckumn8z&token=26384e27c6a72ff6ba2f3352ec900003fbf00f46
Sample260511-xza97scw3j

Score

10^/10

defense_evasion discovery execution xmrig miner persistence ransomware upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/6848-3423-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3427-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3428-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3426-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3425-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3422-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3429-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3430-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6848-3431-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4724	powershell.exe
3456	powershell.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	setup.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000\Control Panel\International\Geo\Nation	setup.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
5684	setup.exe
2312	setup.exe
4040	Watykanczyk.exe
640	Watykanczyk.exe
1260	updater.exe

Loads dropped DLL 1 IoCs

pid	Process
4488	msedge.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows DLL Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Watykanczyk.exe"	Watykanczyk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows DLL Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Watykanczyk.exe"	Watykanczyk.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Watykanczyk.exe
File opened (read-only)	\??\E:	Watykanczyk.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5032	powercfg.exe
5196	powercfg.exe
4432	powercfg.exe
3756	powercfg.exe
6420	powercfg.exe
220	powercfg.exe
6868	powercfg.exe
7084	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	setup.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 5136	1260	updater.exe	253
PID 1260 set thread context of 6848	1260	updater.exe	257

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/6848-3416-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3420-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3423-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3427-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3428-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3426-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3425-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3422-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3421-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3419-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3417-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3429-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3430-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6848-3431-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_229013655\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1081057905\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_229013655\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1081057905\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1081057905\shopping_iframe_driver.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1923991633\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_210798626\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_844623252\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1888203471\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_229013655\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1081057905\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1923991633\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1081057905\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_371032566\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_899772013\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_899772013\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-cu.hyb	msedge.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6072	sc.exe
5272	sc.exe
4368	sc.exe
6256	sc.exe
3544	sc.exe
6560	sc.exe
6888	sc.exe
6080	sc.exe
4276	sc.exe
5584	sc.exe
4532	sc.exe
6812	sc.exe
6580	sc.exe
3652	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230006379225058"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903610002-708294114-949261322-1000\{6DCF122E-D4AF-434D-AA3D-D95412076B13}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5984	msedge.exe
5984	msedge.exe
6420	powershell.exe
6420	powershell.exe
6420	powershell.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1768	OpenWith.exe
4924	OpenWith.exe
5464	OpenWith.exe
4952	7zFM.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 61 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4952	7zFM.exe
Token: 35	4952	7zFM.exe
Token: SeSecurityPrivilege	4952	7zFM.exe
Token: SeDebugPrivilege	6420	powershell.exe
Token: SeDebugPrivilege	4040	Watykanczyk.exe
Token: SeIncreaseQuotaPrivilege	6420	powershell.exe
Token: SeSecurityPrivilege	6420	powershell.exe
Token: SeTakeOwnershipPrivilege	6420	powershell.exe
Token: SeLoadDriverPrivilege	6420	powershell.exe
Token: SeSystemProfilePrivilege	6420	powershell.exe
Token: SeSystemtimePrivilege	6420	powershell.exe
Token: SeProfSingleProcessPrivilege	6420	powershell.exe
Token: SeIncBasePriorityPrivilege	6420	powershell.exe
Token: SeCreatePagefilePrivilege	6420	powershell.exe
Token: SeBackupPrivilege	6420	powershell.exe
Token: SeRestorePrivilege	6420	powershell.exe
Token: SeShutdownPrivilege	6420	powershell.exe
Token: SeDebugPrivilege	6420	powershell.exe
Token: SeSystemEnvironmentPrivilege	6420	powershell.exe
Token: SeRemoteShutdownPrivilege	6420	powershell.exe
Token: SeUndockPrivilege	6420	powershell.exe
Token: SeManageVolumePrivilege	6420	powershell.exe
Token: 33	6420	powershell.exe
Token: 34	6420	powershell.exe
Token: 35	6420	powershell.exe
Token: 36	6420	powershell.exe
Token: SeDebugPrivilege	640	Watykanczyk.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeIncreaseQuotaPrivilege	4724	powershell.exe
Token: SeSecurityPrivilege	4724	powershell.exe
Token: SeTakeOwnershipPrivilege	4724	powershell.exe
Token: SeLoadDriverPrivilege	4724	powershell.exe
Token: SeSystemProfilePrivilege	4724	powershell.exe
Token: SeSystemtimePrivilege	4724	powershell.exe
Token: SeProfSingleProcessPrivilege	4724	powershell.exe
Token: SeIncBasePriorityPrivilege	4724	powershell.exe
Token: SeCreatePagefilePrivilege	4724	powershell.exe
Token: SeBackupPrivilege	4724	powershell.exe
Token: SeRestorePrivilege	4724	powershell.exe
Token: SeShutdownPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeSystemEnvironmentPrivilege	4724	powershell.exe
Token: SeRemoteShutdownPrivilege	4724	powershell.exe
Token: SeUndockPrivilege	4724	powershell.exe
Token: SeManageVolumePrivilege	4724	powershell.exe
Token: 33	4724	powershell.exe
Token: 34	4724	powershell.exe
Token: 35	4724	powershell.exe
Token: 36	4724	powershell.exe
Token: SeShutdownPrivilege	5032	powercfg.exe
Token: SeCreatePagefilePrivilege	5032	powercfg.exe
Token: SeShutdownPrivilege	4432	powercfg.exe
Token: SeCreatePagefilePrivilege	4432	powercfg.exe
Token: SeShutdownPrivilege	5196	powercfg.exe
Token: SeCreatePagefilePrivilege	5196	powercfg.exe
Token: SeShutdownPrivilege	3756	powercfg.exe
Token: SeCreatePagefilePrivilege	3756	powercfg.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3456	powershell.exe
Token: SeIncreaseQuotaPrivilege	3456	powershell.exe
Token: SeSecurityPrivilege	3456	powershell.exe
Token: SeTakeOwnershipPrivilege	3456	powershell.exe
Token: SeLoadDriverPrivilege	3456	powershell.exe
Token: SeSystemtimePrivilege	3456	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
4040	Watykanczyk.exe
640	Watykanczyk.exe
640	Watykanczyk.exe
640	Watykanczyk.exe
640	Watykanczyk.exe
640	Watykanczyk.exe
640	Watykanczyk.exe
640	Watykanczyk.exe
640	Watykanczyk.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
1768	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5464	OpenWith.exe
5684	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4616	4488	msedge.exe	80
PID 4488 wrote to memory of 6108	4488	msedge.exe	82
PID 4488 wrote to memory of 2868	4488	msedge.exe	81
PID 4488 wrote to memory of 6108	4488	msedge.exe	82
PID 4488 wrote to memory of 6108	4488	msedge.exe	82
PID 4488 wrote to memory of 4644	4488	msedge.exe	84
PID 4488 wrote to memory of 4644	4488	msedge.exe	84
PID 4488 wrote to memory of 2436	4488	msedge.exe	86
PID 4488 wrote to memory of 2436	4488	msedge.exe	86
PID 4488 wrote to memory of 2436	4488	msedge.exe	86
PID 4488 wrote to memory of 2616	4488	msedge.exe	85
PID 4488 wrote to memory of 2616	4488	msedge.exe	85
PID 4488 wrote to memory of 2616	4488	msedge.exe	85
PID 4488 wrote to memory of 5308	4488	msedge.exe	89
PID 4488 wrote to memory of 5308	4488	msedge.exe	89
PID 4488 wrote to memory of 5308	4488	msedge.exe	89
PID 4488 wrote to memory of 4884	4488	msedge.exe	91
PID 4488 wrote to memory of 4884	4488	msedge.exe	91
PID 4488 wrote to memory of 4884	4488	msedge.exe	91
PID 4488 wrote to memory of 5128	4488	msedge.exe	92
PID 4488 wrote to memory of 5128	4488	msedge.exe	92
PID 4488 wrote to memory of 5128	4488	msedge.exe	92
PID 4488 wrote to memory of 4240	4488	msedge.exe	93
PID 4488 wrote to memory of 4240	4488	msedge.exe	93
PID 4488 wrote to memory of 4240	4488	msedge.exe	93
PID 4488 wrote to memory of 4948	4488	msedge.exe	94
PID 4488 wrote to memory of 4948	4488	msedge.exe	94
PID 4488 wrote to memory of 4948	4488	msedge.exe	94
PID 4488 wrote to memory of 5792	4488	msedge.exe	95
PID 4488 wrote to memory of 5792	4488	msedge.exe	95
PID 4488 wrote to memory of 5492	4488	msedge.exe	96
PID 4488 wrote to memory of 5492	4488	msedge.exe	96
PID 4488 wrote to memory of 4048	4488	msedge.exe	98
PID 4488 wrote to memory of 5632	4488	msedge.exe	101
PID 4488 wrote to memory of 5632	4488	msedge.exe	101
PID 4488 wrote to memory of 5632	4488	msedge.exe	101
PID 4488 wrote to memory of 4028	4488	msedge.exe	109
PID 4488 wrote to memory of 32	4488	msedge.exe	110
PID 4488 wrote to memory of 2036	4488	msedge.exe	111
PID 4488 wrote to memory of 5532	4488	msedge.exe	112
PID 4488 wrote to memory of 5532	4488	msedge.exe	112
PID 4488 wrote to memory of 3828	4488	msedge.exe	114
PID 4488 wrote to memory of 3828	4488	msedge.exe	114
PID 4488 wrote to memory of 4000	4488	msedge.exe	115
PID 4488 wrote to memory of 4000	4488	msedge.exe	115
PID 4488 wrote to memory of 4000	4488	msedge.exe	115
PID 4488 wrote to memory of 1680	4488	msedge.exe	116
PID 4488 wrote to memory of 1680	4488	msedge.exe	116
PID 4488 wrote to memory of 1680	4488	msedge.exe	116
PID 4488 wrote to memory of 5644	4488	msedge.exe	117
PID 4488 wrote to memory of 5644	4488	msedge.exe	117
PID 4488 wrote to memory of 2996	4488	msedge.exe	118
PID 4488 wrote to memory of 2996	4488	msedge.exe	118
PID 4488 wrote to memory of 2996	4488	msedge.exe	118
PID 4488 wrote to memory of 3076	4488	msedge.exe	119
PID 4488 wrote to memory of 3252	4488	msedge.exe	120
PID 4488 wrote to memory of 3252	4488	msedge.exe	120
PID 4488 wrote to memory of 1032	4488	msedge.exe	124
PID 4488 wrote to memory of 1032	4488	msedge.exe	124
PID 4488 wrote to memory of 5924	4488	msedge.exe	128
PID 4488 wrote to memory of 5924	4488	msedge.exe	128
PID 4488 wrote to memory of 5984	4488	msedge.exe	129
PID 4924 wrote to memory of 5128	4924	OpenWith.exe	132
PID 4488 wrote to memory of 4408	4488	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chomikuj.pl/action/redirect?url=https%3A%2F%2Ftinyurl.com%2Fyckumn8z&token=26384e27c6a72ff6ba2f3352ec900003fbf00f46
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff91462c188,0x7ff91462c194,0x7ff91462c1a0
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,11279073018455698225,10873035889201457211,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,127845926438998160,3978849110821106886,262144 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,16361092067487963300,69614483393467971,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13173207566967543768,1974930904600405686,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14706017343233326332,3460357359690941548,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,15573452383300705473,6014585714256870681,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3488,i,2611484080566066705,392978075582765224,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5204,i,15503446278218309999,16369560837223612752,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5336,i,13178948431701283311,16362100259058675632,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4820,i,17804782249434906409,1279957376680577745,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,9754978224069680733,18274071135288990017,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,4573702630892779561,4020553140972959057,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,6355767178450138769,5321810182668498894,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,6355767178450138769,5321810182668498894,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6980,i,9703117998658317863,13790128648943589167,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,6982230244768958193,10713113112921550154,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,14279446341387898486,7576093772241002716,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,12517707748731970746,6408533581517511036,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,3746144164796613846,11839133399909646322,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,167482413552173751,17827771500988417743,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6816,i,15243680472490418352,5713155825644799295,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6680,i,2727665228597665974,8717640327015404143,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,3821736681392694984,5183289331588190465,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7072,i,9453178803815560500,2025887076481477791,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,6439904010993825160,5981456922680973570,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,367260410274302068,14672579008607596150,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,17415645506364490559,16120639523060554041,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6295284962102154191,6864928107161318789,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6916,i,8005174774547412708,9970745063589181436,262144 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,14213001883764171259,16669554525307043678,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7620,i,16413474893549904118,13360898576510571107,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7444,i,12813194944778271680,2171845151981173943,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7796,i,17036369352606156390,13812409842167299965,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7600,i,17434273153129825802,15372087878920045340,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6664,i,12347596188303397121,3249160581701011501,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7820,i,16508762243259580602,5171963237921116570,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6640,i,12840592495646838870,10569464978405827188,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=3544,i,13095151765270083177,6264368086555379519,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7436,i,686406086535875576,16355493123120107697,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8096,i,7463635502817763315,8660607827695175833,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=3892,i,4559717963233813334,6906645719684482076,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=3940,i,17368769346280765683,9765968876097347251,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8408,i,6944808087016427261,13539072663633397488,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8584,i,2930922497217789552,2698657589077312433,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8780,i,5775779126174601268,17807524525789430492,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8828,i,7685453477241431286,1045008128753152013,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9080,i,4761556277952475608,17986295209841254110,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9232,i,8824536176545503630,3030954815925743736,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=9244 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9424,i,16666376501671120497,10427334205432578757,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9428,i,11895653500390824945,4130872958204698089,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9696,i,7963571495815501036,242834430700586158,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=9700 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9844,i,1847077226846418771,1665299175946615374,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10000,i,16165245135721735537,2916788913628702858,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10008 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10296,i,987532355980251583,17676674682585594386,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10300 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10432,i,15070148406415922898,7953422292128170507,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10448 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10636,i,15675401820814065641,7391212346938806985,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10648 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10672,i,9715964862678305060,17594337656799618794,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10652 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=10916,i,15966406524206676850,1983844037804460859,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10928 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10936,i,12688456270743954678,3189054366015814630,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10948 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11236,i,1651401533441277087,4508807797540087455,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10908 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11344,i,15767292620342584218,13127524840237593554,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11364 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=11484,i,18222547152440888327,1487003029203041847,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11432 /prefetch:1
  2⤵
  PID:6200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10444,i,15789682719099271809,3520014018116631458,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11048 /prefetch:8
  2⤵
  PID:6440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10536,i,3960622701991379096,17247625497748446832,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10968 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11968,i,16268334127687679276,702943369857775565,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11844 /prefetch:8
  2⤵
  PID:6728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7892,i,11037718517007770494,13203324903587182455,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=11196,i,14220661531886535124,2932794038274284304,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11768 /prefetch:1
  2⤵
  PID:6996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8116,i,12725676583057327018,984916561990292976,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:7080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=12108,i,13179699332005147434,16571384471307342561,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12112 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=12164,i,4448376682190841149,14252988560645303343,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11940 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=12116,i,12226178036763524578,9947769384954206733,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12128 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=11800,i,3305074280231866415,1235539917072802907,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=7892,i,8508948240972161619,5970089589896750931,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12108 /prefetch:1
  2⤵
  PID:6752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8532,i,15239260674329135881,10527797092205896008,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12068 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8160,i,16463079080521695743,693431363896885570,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=10732 /prefetch:1
  2⤵
  PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=12468,i,9548205471734179518,14568983964095368048,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12400 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10440,i,11718284931920394073,6355638944273421944,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12652 /prefetch:1
  2⤵
  PID:6492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12424,i,8004933407672422071,2835559338188494529,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12600 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11976,i,13866855562078726124,6374420178592277353,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11152 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12292,i,3905158516769937975,12491524111672622011,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11160 /prefetch:8
  2⤵
  PID:6976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11828,i,2642652178063134587,2580663118179283588,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11156 /prefetch:8
  2⤵
  PID:6852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11784,i,9186935699504377417,1885587149386246026,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12108 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8496,i,15494865257493771381,11475828723166977657,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12564 /prefetch:8
  2⤵
  PID:6724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=6836,i,11817743304679835005,15057527657409789581,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=6748,i,10177307931935365134,15595112562152237503,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=5556,i,8512687004686384555,15170604628339969236,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12776 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10440,i,9561511776055715595,145390815064741730,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11640 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=6936,i,5686605629588160947,15164053123857965104,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=11040 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=6000,i,9531251708675378552,899812968346338872,2097152 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12076,i,16299282664875518344,1803719254109195086,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12652 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11828,i,5567221484713601595,13680559600158421130,524288 --field-trial-handle=2256,i,7922044987978125601,13115681594829309048,262144 --variations-seed-version --mojo-platform-channel-handle=12732 /prefetch:8
  2⤵
  PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Watykanczyk-main\README.md
  2⤵
  PID:5128

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4e4
1⤵
PID:2224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5464

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\setup.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAeQBwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAaQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAZgBlACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6420
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2312
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6796
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5364
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:6256
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3544
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:6560
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:6888
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:6080
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3756
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
    3⤵
    - Launches sc.exe
    PID:4276
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5584
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4532
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
    3⤵
    - Launches sc.exe
    PID:6812
- C:\Users\Admin\AppData\Local\Temp\Watykanczyk.exe
  "C:\Users\Admin\AppData\Local\Temp\Watykanczyk.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://karachan.org/b/
    3⤵
    PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://karachan.org/b/
      4⤵
      PID:5600

C:\Users\Admin\AppData\Local\Temp\Watykanczyk.exe
C:\Users\Admin\AppData\Local\Temp\Watykanczyk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:640

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:1260
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:6928
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6888
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6580
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3652
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6072
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5272
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:6420
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:7084
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:6868
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:220
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5136
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:6848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69a1d6c2546f99910c6f349ddb665d530af289283332c1b54d92ff0340de7fbc
MD5 9dd12f0f7f7c020c27ee69da3c41ea58
SHA1 83e40ce506be9fab44d721ec8ab9f5af9722b38e
SHA512 b7f32c8b78e6734eebbbe7cf2944484340e3f32441ca6943b39c0a677d4424de3f45feaa48338f99996e31b46c55212827a384d66c07ed3571ba6ffd51c436ad
TLSH
T195D0C02C13B12C20C0D89938028C3B4F2E1CCC12054B47153C7338BC0C030103CC91D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e4390263332b49310079a02cc848f21df0f39a24c4aab62aa7ebd8b81049e1b
MD5 d089951d187ba695032214ab27e63492
SHA1 2b7ba57e37f32fc36ad6b687b7f0e040a56351d7
SHA512 9f7ed4e8d98a1a71eda06e479622d5a11e2aed42dfb8ffea9326ec13406418d3283243cb8e3ae8eb477575d126f199cfffe0b2ae65d0ae17056a60d484073136
TLSH
T130D0A737279D7405D66C52389363964A1B29481024574B15FB18C49C967D0957BC5187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 681328c8413fda75a51189b78f6379b1ee0309d75144ca8ff33a2656ec84cedb
MD5 0ff4eec6742c3eafb3e4d2b1be8a17d3
SHA1 87b776cff4e20b419791c0a7a5a49da8d91229fb
SHA512 525896cf68edf91db0d0dc681112ed436a3ebcab42ad2f03d796fa9e2472cd279feafba9b809dc18476c574b82a1f657dead8511e80a203527b2971ba86c4824
TLSH
T100D0222813B11C20C0C4993802883A4E2A28C812054B47152CA228BC0C430103CC9197
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0ecc596cb4c16c25cf3c0260a6e4c069ae1abc7ea2cb0172717e0dabc82ba738
MD5 d3bf71317fbeb7427947981f30157130
SHA1 83a6a478c12230b836c8da346133b115e6fc802e
SHA512 2ea387672045995ee5c4dd1a4cc2a87474e0155422e1cd2002b871cf2c99ab6836a15d672ad8e4fb5ea8ecb78948d7edafbc9a609d1f985e3eb6c6e79ece4356
TLSH
T123E026C408C8C31FA640B4C74274870EC3F0364A96C86D4A6704C4C83082480A7AB5B4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 df17f25505b26a8bc6cb2a9d702fb60619e6fc46eb7cd8fad70576cca1dd0b68
MD5 7d56265fc76ce21d37ddfac986593b75
SHA1 5b5dd8f025e6647e76cffb03fcf754bc8ba9e3fe
SHA512 16885875173b3294997933146c53ab56227988f727cf1eaaed7af7ffbbdb95bbc5c48151ca99b781db5790651d24ad4a67f6688a698a4c9eb95a0c96ff96a928
TLSH
T1F8E02BBACC65AC3B09F8071D60944746E751135B2B40590F7A3CC3088FB163A12C5C7C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 34KB
SHA256 afd4782e0b7442187ef3334e0dd04804eec2f7e78b66f2486e9aad0e2c0f415d
MD5 86838477fc764344efbfb59db3377e02
SHA1 975ba960ae9f272dcbbffa0bb4846ae66a217bca
SHA512 c070be0783368b0cfc2c82c404a77b3d3a54d4fa7276947675c29af0c0f1596c0820ab6b7f55ffef78204b6270599e52685c465a5e5a14719affedfcc6e5171c
SSDEEP 768:UyU08MPVeXS+IFU8EHGmvKhcxSDctxyvsi0PD:IsdeCV5mG3hcwwLyX0b
TLSH
T1AFF2E1309D56284B8376EC684F46B9E2D4953252873AB157063E974835F13ECB3899CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 97KB
SHA256 08c1ade001a530f1e243f27f19e1b070ac4b43ed38dd3bb1d7c40715dc4c87f2
MD5 171a26291b479857a5abeaece2104b09
SHA1 82a1796ad885412da94a5f0f15e91f3e07ca888d
SHA512 9ca77cc7db39ee4dffae42300e1494f9f8fbd6233d7740e9e9d5679b7d8979a58bc8ea510262719af0b4941a62584cafc404f0e8a875fa90baa0a9c1a5af93ac
SSDEEP 1536:wq/tCttbQz328dc9mqGiTLFu5ptbSOcOL1Rnz/Cl0jMHweWcPJsD/gPG2wMpatK:wq/tCjbrYUmqGiTLc3BBHMHweEkw4atK
TLSH
T10CA31289F732DB1F9313943896AC73046FC80367244986FE104FB9D32EDA55B2276D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 66KB
SHA256 2225018d679fc81163efbc516cdd6aa70706d262573c3139dc82b7145c75b196
MD5 d93d7b445aa1b6a68a1844e9abe2beb6
SHA1 5aa0f5ce58a6099b9830c2d255cab68db8dad91a
SHA512 406347e5483759eb328711b10ebbafe6f59269fd04ba665d382e923285f094ba8e24c6de78d501b9a072e58dd7450ae4cc4694e3ec5bed81bffd0fc2e742a009
SSDEEP 1536:Z14N/UYZ04DRf0fCsx3lv0NVnQosTLgbb0bnV0SsFIg:3q/UYZ0Drxt0PnQ54b0R0Scj
TLSH
T15563138F93509AF4B0A222D8B673ABF9343241B263008E374404763756D9E593FEAD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 402KB
SHA256 5979103bf1781ed81aace48a95b314e656899207302c7492f7304203477b56e0
MD5 4f7878c743d98eff99569c864d45599d
SHA1 c20b0c5152fe15f46ed7e70038ddb4102d520968
SHA512 a2cc0932c338b258b732fc03e752c38cb17e3914b457422719cfe0089fa98dad8f4eb35cdf19a69d8a88e1e830351aa9b0d861d497d0bb68be8506e64c1a95b8
SSDEEP 12288:n1Q9CJD8MkuJXm8EyDx0p0dz75nkBpOEtJbR85N:1Q9CpvP11e0dhkBpJ+N
TLSH
T1509423C0466E5F4CC83559ACD0DE2CA087C4CA74AEF54C71FCBFA5B470B41292AA9C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 41KB
SHA256 9cde84025e82f83866e3a0c61cc7243c01ef79469d4557ceceb8d2d965a5ace0
MD5 c4c13958a36ef641cb0085783a202449
SHA1 070627cacd85a4bf495ca26efcbf651531e0ef1a
SHA512 ccaa28ee77f92bb2e97777aa723dc21b9f81822c5a10d3f5d2d9439300af1de4ea6ca2ef71c6bb50d1d03df2116d1ad4fb653c6b403e0a7391cc23886e768afe
SSDEEP 768:49UiUakq1jFb59k5EcBwIRqRbGxptSZirl/xMynaHhjitux0spjqDb:4JNFfk5Ep95Gx/8irf28cx/eDb
TLSH
T14113F23DC60F1F39DE8C22B5BD1ED252DE56CA53143C72D12F990F8024E9A98A78BD51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 170KB
SHA256 e470bc9628ef4b718eb4ca18a20689953008ddf98a60d02f0e7b86a04268fdb7
MD5 e5d25c6b3b61de52ed76ab24e05b7cfd
SHA1 bea64e7b0ba76d98b8a3bf2ef63d9968fa60faee
SHA512 5d0271452772aaa7fa3e29d5fb19b9c0a29f6040fe0752c39648c666e8bfadd12c8d6efc921bccce254abe09740e8e6be918f866d4ed6773b06e8328b80d42ce
SSDEEP 3072:Iml15iLaHoRvhTf72ylNvtwhcZ4dqC1fXb7yOa2Gc6jk/xx5hsy:IYxI9JHrIPhXbubo6jkfbsy
TLSH
T1BA0423792A95279F51E4E5BC10B4A5D81CAE18A0CC3381A1ED007B335D2DA53AC7FF9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 128KB
SHA256 7570185a90fa32b163f34e2c2808e85c2453b753a75dadc0c427ee21a14726a1
MD5 971d4be2d9a0da7f5020a756a78f34ea
SHA1 492ebc493edfab603dd2c3a193275d41f4fbaab0
SHA512 65fa1c1499ba9814bf22e58d21e57794c89d3122a5532682eb43efada0bc4f996668edb80a42a0f8eb52c3d4006eda5f06e9a03045f7fb31ef11c2adcce1b781
SSDEEP 3072:Mjq5jyJ0z3d+hG4jcmErNsRgql27aqPHnra5:MajyI+h5ZYglszPH4
TLSH
T1C2D30141F3651DE6CE870738F8844906876B276B24D8F36A4EAE9AFC30481728B1A7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 128KB
SHA256 e26c72728c98ef25f40ecdec620c3003884c79a1476738443c544b209c804069
MD5 9b260b685006cbdbb15f9a96a17e63e9
SHA1 393d72cc9d928b7c1696a9b8cd31c3157a1a7988
SHA512 73dd76887252e4bcae44a972045c722150953fb08c4d4944df95127c4ed51ea6246ae2b588debea6de59f1aece9109fc9831951cd493b191bfbb5691e9cbe209
SSDEEP 1536:gQPkrWMede+GO9YZz5ZT6v8fWkma9YubH2WAkNa0dqZqpLHb4qkkT9lpWm0oqv:CrWf4fDoAWkj9Cshp3TLQv
TLSH
T197D3AD71F7C39792CB432AFEA07D2E774FA901C221C919474953AC12A148B31E75BA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 128KB
SHA256 8b584c48779d727e3638c8922aa47b1413d8906130bd3c480dbe0774186d2915
MD5 e729e8699547cb5bfb4f424406b8f551
SHA1 5ab8f998ba9fc47a60c1af131c29bc9f6b656b53
SHA512 027438641482b3deb4c3ef779542f0ea5c1a97fa90a24523b645b9d53ff13e03da89a102f6edff4752d0a0b517cb131f3a8c7a4f54fe20f23ead8d357ad970bc
SSDEEP 1536:gVMmjuo7X4oOkxryHeWoZqGEBYzwRIiEa7iShnsPfjKvrWskDoD6IDY5w:kMIuo7ZyohwYzwGnZCwrGS/DYDkw
TLSH
T1D3D3BE64D7C2E783CB532ABA643D2E772B9001C475C61A0B09A35C7198E9F36E70B57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 71KB
SHA256 d40ca516a00f4b6ae9937cf0eaa8e1f0c2033aaf783dae3c461d68b8b142bc4e
MD5 8f850aaafc8da0df7f8f0a0b682a934b
SHA1 ef55df2e866abed76fe19b05ceb51c1147a6961f
SHA512 15160500824282d1e829908670dc7405abeb4d571ffdcf94532f55294fce77552c832f27fc14b91141ffd2aa142c441fd8e48df8e43cdbfe9283a043da2460dd
SSDEEP 1536:m4kLBYkMICj9ZBz3ff3Vpsrc6gy86ywUOWo3xmWVNKz/8A7yWuBKZS4PHS:elsr9Lrf3VGQ88hLoxPq/N7y0ZS4Py
TLSH
T14573F15242B8D90C1F6550E30BAA1EF1CD6B18CB94D4A0CCE8C7EF9DD259EAB4D66880
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 128KB
SHA256 7a585b6bc904769860ba80499cd8bbe50f2f75f1db6a831ca6de4a85cc48b84d
MD5 d3ad899ef6d314e078caf478e7a2c723
SHA1 cbda8ea1659223493a14d9f2e612e8da8f4690ac
SHA512 a8661b8acdc4596487a65bb4731bef9a496273d2ad60aa9cdcc18d728ed71677befb4d78c3a45ab9fb5f14e62b17a608934f36aebb0e4e6b5ed6a5053f5705bb
SSDEEP 3072:tCZVYzG5zervfZGDywzHICld/6Es6jP+a/5HtwjQ/+oH62j:tCZ6cervfwJLT/6Es6jPR/dtwPoa2
TLSH
T1FED3F17AFB9363C4D3836BBC947C1E735B2610D073D51A1386A2ACA564043968F1BD6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 17KB
SHA256 2d12c39e141470aed32ffc57edd15eac65fe9f812022719fb285dc453bc308f5
MD5 71656fe8ae0f75972ec2238d10b74e6a
SHA1 dff6110aec68f332bf2f565cffbf01962bf99169
SHA512 732d3fd97938b2f6209af3a7406691545bc3f0d8d54056e271b6747ae835ec0da96e669781d5feb197e3938e1608c233962a4224776e831f192236708227acd4
SSDEEP 384:7XtHyShiEjFWKBuTNQO/+iL3ypqmOV6KXKRr9iO9VCnRa9Ubhu7:7dSShRjMKgTNQ0pyEMKlGMRaAu7
TLSH
T15D72C0B087C2E7380EDE710E37F760612B192494A7A1AA99DC64F25BE76E49179400FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 18KB
SHA256 e2fceaf3804d44c273a8cd2d00ec727a9ffe3d3f704377062c6cbede273ea826
MD5 29cbfe8a8f503b9ddf58e827eef745a6
SHA1 708c812ea3eca2d0625e0fe9f173cfc762122ae0
SHA512 11d88fda1744fabb945d6f28c4423b18262200f3af44a5fcd63da018486e6e8e7115a57f7239fdbf6accdb21657dda5e714a1d0e4e7a5d28a486b2772ea035ef
SSDEEP 384:vdOVNs+Jgo4/ko5IQGu5gu5TP+m9S9MeTI1G1T6V0BReMe:vIc+Go4/ZbbgkKhNe
TLSH
T13982E019D1BA4CFA021DFD243FBD7124F45B21CB193886897EA212226FE464F95207BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 20KB
SHA256 8f59d991341c8e22d31e871a9bd640b2ce45713be4860c6699e7e4575ca243ec
MD5 7faaaeac25b005f2a08dd70f3e151588
SHA1 e571e665649308b14ae7037265d7cdee9675ed96
SHA512 4d81df8c66863d7442e4d864beccef70bdceabba452f26602bb1d0270d571e080cb5eecb7461dd461ae7a13869cdb72a12d8faddd405421733277417832a563e
SSDEEP 384:USf85IOtOSLBn9XOHc3icGyvTbLeBEJs51cyXNWyakqclkv0zurQD8KtWoxs+tD:kKOtFB9e8ycGyvTbqIWYyOclkvquAtW+
TLSH
T1FB92D002AE331698863F68E7CF4F4E5A1BC9DE8713FD1D546DB844089CB1225A7E7641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 53KB
SHA256 440799e83f80d8621205b20603e5272b47ecb0d84e4ace3a5adddf6196b4ff88
MD5 1daf347ca1fbe4053075ea5c97013bd9
SHA1 dfc92450980559ff01081827b8672b119ce7f9df
SHA512 063f71ea004cf8f422f35d2704fb768c2c35acb24009675f07d08c3f71ce7848cc69348037ec481a89b482aff8fcfe5191b64f29d9faaa06ec2b757cb3cfb737
SSDEEP 768:ZBX1aiHIvhYtr864etIl3OdbHJmfD9a4xabqEVZTx0h6Cs3e/LQ/sPbHQX1UQl+o:ZB+pEdCE4MbvYoJ4lwFfT
TLSH
T13433F1085D85C759298E88AEC24C5B32D75586B8DDC0DB51B3928F8D8F87CF4DC89BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 35KB
SHA256 874328e769172e110eef86dc0226400dd87cb1f68d37bdd198ee8b921cd8a950
MD5 34d5bd5e8eb056587a7a247c2379e63b
SHA1 87ae6e3551132b601957b765986f28ca80e9e355
SHA512 dfa8d928ca6a9e3cfc0d7eebf9e3e961d469a702239bf0b9521f758132d1983f3024946d361ab4a28901c85e69e57ece710227daf6513ee3d4582adc2ef24f03
SSDEEP 768:ZBNVhu8LcBUzGC3g5IASX1BNndwDsoF1exTlWtU4d2:ZBf5Lxd3g5IASBnw1e/Wt92
TLSH
T135F2F1263137808E8D966C7592F013C46090B6B93DC23BEF8BF5A03CC981B51DBE5B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 16KB
SHA256 d71e23ad7ecfc4850c6ec8710489d9586fdd4d5c14ac5c95f1e120710101c364
MD5 74b4b1cd187c7591882ba42c8215f983
SHA1 e1e9c5240bd8d2465d38e649934e77b877ff35c9
SHA512 8e15a41bee01713181796e33cbe7aefb945a713031b49b26d3bfd1c76890d0872ff7755bb308e4406331f57904cdfe264dc8422fef598ad3758e6cdfe339df83
SSDEEP 384:UKztZLA0RuwI352lwYzZZv+VOZH9S2nxmjfrO86O0:ptZLAMuVJ2ljzZQVQsymiO0
TLSH
T14572D0A349054FDCA4D74C777D2BA0C29B28496F11E5E0F32DEF80934ABD6A89EF4144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 18KB
SHA256 502d14cc3290d3e66988c866a5b91f58084cdf17b56701179f9827eb972a9f8d
MD5 3eb047705f13df80d8185521f7f6bb92
SHA1 9e5930daa4607f3b798686a4fc28d9a4be850acc
SHA512 8a9bb462d553b12a3a5b6f7ec8a5613ac2e303488443a3276baddfab28924865162ae0cbca9e4364073766ffe86a6a60ae69110cea516eb09d3c05d2edc14370
SSDEEP 384:FmHvRTJIfiUf+s4k83BqUPMs5AiM+jR3orALg6PF3SUv425iNj:UpJIfXp8xB0s5A7cD025Gj
TLSH
T1AD82E1E3608D92C5A63EC1B3D963BEFC01C4446CD56C2AC6A32F8094BD1C2B71BE84B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 68KB
SHA256 4ad601c70ed7615e044931de2d0d9c24efdb78df38eeafb5b31128b73c608705
MD5 b5062c2c09682cdd63e4fda053acf12e
SHA1 7efe12fd7283fc6aae2cd1206f5f04d36ea6de6b
SHA512 86a64354cb92f4f507f1da0e3315b02d3cabdaca349121723cf4e01b480401062027ec5f9f53e94835e7b44a6e7de35b185c5e6fd49aca7f8c1a0e60070a0ee8
SSDEEP 1536:Rimoq0CZYVaNUf76Z+AGYguWv03e30iIiV43s6WFYlXx:8rmyV8X9GjuW83BUV43sTFYlXx
TLSH
T174630223FBFB076A70E95438F13D632146E1BC5AF00B57061A77AAC67D32E62248430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 37KB
SHA256 346ea97ec5aa47587d93e6347417ac2f9f9e7c85adf447c627a04af5926d08fe
MD5 336366f1121f7cedc056a917bf0f2fc1
SHA1 1d79799f95cdae8946042d09c056c5075e3babf9
SHA512 e730cd5de6b898ad719f905cc8d488945393206baabd17cd1e0902e55b46f71c2de9fea9e1b72981697f979ba084596dc09687e31cfe89c2ad1184e37f0d13b0
SSDEEP 768:zo30e1yjwXoHp8WOPEyD2l5QYnCmqimlrL+78O+fktopf:G0LjwYJgP1DY5VValrL+78O+fktKf
TLSH
T1F103F11C0F934D4984A3DBEAFD5C2B0068191E0F687C4666F3DD67EC3469DA6203B0AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001da

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001da
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6e6daa799e94772c7d8cc34daa3b64ae0c65efa9c9d4af4abeb8ab169a4fa419
MD5 c929eaca2b71b77e7dfac44f83c10189
SHA1 c6b5c0b85cc5804b2b229c40285c62cd318ebb54
SHA512 9710bfbfb0281032361facfbe996ca6413366c47e5ade21ce3a3ae1039db128b84aab74e9dea6a1efb8f38a444bd365d939f55681a25cd76337fa5c46cd31e41
SSDEEP 192:KQp/7CjzuDM3thX13iM1+1wJGnrDdaHLw7aLIRiSCyUCNlphV7D+PG15BcXaLc:V/7CjzuA3thX13iM1+1wJGnrDdaHLw74
TLSH
T133E16F28DECD5014FBD6217894D0AF0B71FE86592C233F7ED6D468FC8526BB20A58718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 36f962f192317e94fd20ab8106ad2edc55b4d04af284c7d5692f95ab00655243
MD5 c4993d10dff092e0f026d0a48c5bfd07
SHA1 eeebbb4f2560f8c2b828ed47820c72e904848828
SHA512 d163c3181acd3fcef73bb21442576ec45179227b1f2e2fcbbec6a9355725b530d9887bbe3ac8abb6192d98bd0c666995ab2966a2df9fd4e02e7d8cbde80f4bed
SSDEEP 384:iDw9rf4TYO0FLP078QjYUo16YW5Ubn1s4LKDOMcrQwrtaq0JlexN+sEKxwNNY9ML:sw9rGl0FLs78QjYUQ6YW5UbG4LKDOMcy
TLSH
T1BE52B614C9C91479EBD63138A4DE9E1B35BFE05818233FFECBB551BC4223BA11469B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 e320ab52aad3b64504c95643689bce0e869523bd9bf9203843b337a0c6f2dc01
MD5 0f6f9e5dfb2a8e8aaf1d244124f03dbc
SHA1 5013bc9141d5016bb7d13a467ca60d890bad327f
SHA512 8fbb88b1c914388f907eed0c2e964dbd98645e85783950e9c7c9d3cc45d3b86ac829c28fea7ae23d30488c2ad4ab0db352d33345fa05f4579688212ff98246c2
SSDEEP 384:+Dw9rf4TYO0FU078QjYUo1YW5/bn1s4LKDQcrQwrta2JlexN+cEKxwNNY9MWnSYE:Aw9rGl0Fp78QjYUQYW5/bG4LKDQcrQw5
TLSH
T13942A714C9C91475EBD63138A4DEAE0B35BFE15818233FFECBB551BC4623BA10469B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 35733389f5740d793037b88e87925080a2c66f054f3c27ebba33e860219d9e67
MD5 7acd606a97d8e34971c7d1714e63c4d8
SHA1 233e1f7063153dcb21cfc63705b0b39ca99d2fe5
SHA512 9d9f12d8f277e20425ca6402aaa63f4c1c9cdd9998d78ddb4ae377b000c315dc520d2f710f139f3f6bafbb2be8381e2908ea7a1bc3d7fb26f04445900ec5f7e4
SSDEEP 192:ypA70LR8TC7PxaDM3thXFrzQweAMc2bjYUa19TOmJ1MuLKXAdlLu4H6+w7U3ooZE:yAYLR8TC7PxaA3thXFrzQweAMc2bjYUD
TLSH
T1EF122C24CECC5024EB963178B4DEAE4B71BFE15928233FFED7A454FC8522BA10958794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe585956.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585956.TMP
Size 3KB
SHA256 9298b72e356db24d83a377e3ebd7707956106a47c717fdd8e9ab7a3bc2896edf
MD5 4f44a934b421b646ddf51dbca6b41baf
SHA1 32b5c4cf430181d6fb78e199148d14df3f39a8e1
SHA512 e2e08f50e571fab62187d3bd59bd60f6d5e9d30a8464c7eb7d949f24ff79513a6a69f58a3dd8cb99f7db13bedf4e7b06640754c7b0673ff35ed78ce2e2ed2d4c
TLSH
T140610948C54C4419E3E5757DEAE2E34F32F286991C727F3DD2C448FC866276208ADB28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 66cdc91123389268efb25ebf58a151d34d38e79c593f12502e7fd9e7c4e9ff0c
MD5 2a926e1a18dfb5dbe3c70060e3569bad
SHA1 a52c02d6f5584a93b53ad24ee8e3606e16a438b6
SHA512 94be524127498c47f1c8ff17e32ec416810bf7b96bf8da464d31b3f4412cbc8d8dd006803210436308c6f3e2aafd0dafe4fbc121d9a5fc8ed4419b18014c8b12
SSDEEP 768:JuCkSAPKya7ao4LR+54cFK+kMrMsziXly2mV:RAz+KcI9y2mV
TLSH
T16ED25456B5F8420AF2BB5EBBA8B257954C7ABE562D04C81E5870620D4C71F80CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 847c133d4d88a676cec5c28ef16a0ab811d3a56ef8587b5cc0d907185f426fc4
MD5 4472a497e60e3321dd6329acc47a287a
SHA1 db3734e6a2a9971bf171ffba6706468dd4f5cfe4
SHA512 a5e84c153bbef74ca4723a528ac5e987c1a255f3bcfe6c22f8177ff63f2a7abd5996404f4e3c6036960fe9b4d90dfb798ae58ce1926bb06c82f9e7a822e49f40
TLSH
T13DE0DF7888C9C26BA2A450E60636FF0EDABB660AD7C87D460F5CC844B082084B97E1B1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b1b21a6d9d8c1c0fae7db05f22dc765b836b68b7d44e00705c6af39c207d9fbe
MD5 682e5dd0dfc86c6a63fe13b930e64d6c
SHA1 2403b822dccb39ee5554021a5179e0cf8dd73bf1
SHA512 4a1342eb0923f8ea1934e384655e65b8afbab5dfd86052875a7d248b1aa78a9a482ad2879e1b5c4f8e2555852e94f2d5407b27b9947a7f2289ac476b2aa55df9
SSDEEP 192:D88tK7t3KZm8aLJ6YKD5jtzmj6hGfvc75aKQ/tnMamrmCGmgm1nmDmtmP:D88tK7t3KZm82kYC5jtzmGhevc75aKQf
TLSH
T13EE1DDF3C3E5866DCA1195F0EA186E1BCE2C0515436C3C6A85E4AF0BA7F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 63KB
SHA256 f91a55731a3e698536556a36ca3baabbb42099bb70ba6a2c73cd4062bbdb3579
MD5 90723093d5de99b88924d50a5bfa6b04
SHA1 710d40a08a4a4f68adff14e84f8ddfe1c06c265b
SHA512 eece371f9628c7e9c080c4ff532ada3e32baca6f0c4137f12063c3a0c51cad0c8f63cd6379d00e2a722b406a1acd89b74621040cf74268c0976ddfd8617fef58
SSDEEP 768:PmXCjZ0qSQi8PxVx835zuMQnKtVxrs/F0TnfWAGaVcc8:v25CMvTAUn8
TLSH
T1E353BAF783F4C66ECA1153F4AA142E1BCE1D0655432C3C1A85E5AE4BE3F2872E156A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 44KB
SHA256 c6077ec1f0f6a5f233bd48883d647afdba08ca923546de7e1a50420c2b9ad102
MD5 714f8bd8e5251d5615dddfa1c8822886
SHA1 27d5e2a02cb717f8fba77cea5bc3deb5d9a838d7
SHA512 6b9e20a64a09debcc078a7327518ace16275064d277db9d4c31c534e2b92ae65f977c914bb53740622acb46c01950170ccdca5baa01dc9be1e5a2e960ae6e059
SSDEEP 768:EEiM0qSIi8PYVx835zuMQkXtVxrsQo09R:A25CMhTmO
TLSH
T106137CF783F8C66EDA1553F4AA143E1B8E5D0555032C3C5A85E4AF1BE3F2871E281A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 210B
SHA256 069b8d086b44f7ccc1c58969069ffd7300e5a3d7cda5afafb042d16658b97e25
MD5 fcbb5cc24671d7f1bbea1a3b8f54e9f6
SHA1 ae6495907bf06612dfea8041fe850efd997b7da8
SHA512 b5d33e5a6f8f90db2c2b91ebcdd6160154f89502568e01f6683990db8abb7129dc8fe375874287f8fa50b1afdc6fba54c1e357df6170a1c74fbc43ff6d719589
TLSH
T138D023A317017175577CDFD1C05AEC8ED725502404C3DDD610E06D99093F45D0547144
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 b6475c4a9eee46e274185616ec9b4e9fb50a1a00379e4df713d92293a59229d7
MD5 811105a837322775055434d3a8558c8a
SHA1 2ff5a82f2783c66d423e5f1c10210a7f1836100f
SHA512 c91d29f9c6b58ac09c44cf1b614af535e480629223fd200f79e006b431e910986a81c29e57e7f0387906fc4ec77c3485eb057597b634f9d026100c30f00d3506
TLSH
T193D0235317017079577DDF91C065EC4FD33610555883DDD410E05D9C0D3545C0547545
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 37f298580d0ba444622e1de6b9ed75cf9ad58fbe67e09cb479457b6633b24a2d
MD5 480e7d04c9190c9a02c5f77e37bad252
SHA1 dcd8f5a5dc57942e93c3d4b69527a4c9a0bcef43
SHA512 76d9ebb4241d22a0be1b8a5daff8031f485771aaf47fe66ede410c278b25b29ff48e5f588147bcdf5759a33c7bc985a43f1034e43b5bf342edbecfe61fe43b2b
SSDEEP 384:sxZhnjsLfm1a/fnsdP/qEpw+zQoYSvzAyeCBtuHbzeg/CsnfH+:sZjs7m1a/fSPCZMQoYSvzAybgHbjCG+
TLSH
T128A2E95266249977CDD7D619FE21BF62D7F910639D904E4C9AFCCE0C04EA6ED2202C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 c1b3b59c58d3420c245cf71e3b479c0e310b02abcc15827b848be37b1f107b7c
MD5 861439d765b529c1a21f75fed4c4b59c
SHA1 2691b1fbc0aed72b74ee51220462d96457f7d643
SHA512 b542a11d1b466308e1cac0c8b4def908ebd03c0880ea5b47c8e587b288f15e3b127b1bdfc715a96b8d28fcb1865e2c8c6d56f09a8681a118347015b7eada4d51
SSDEEP 384:sxZhnyLfm1a/fnsdX/qEpP+zQoYSvzAyeCBtlHbweXXCLX6LiH+:sZy7m1a/fSXC2MQoYSvzAyb3HbDCqW+
TLSH
T132B2D85266248977CDD7D619FA65BF53D7B91063DD804E4C9AFCCE0C04EA6ED2202C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 c4867de23cefd1aaf090731869927069b717193175d4c7b6680b42f4fe0abb00
MD5 7a4a905bb199bfc464277960a6e15f1b
SHA1 8ff88437af10b84bc50dd679cf6bdfc17ed2b046
SHA512 cdafd2fc48cc9b8aeca2b9330d26238f22c14573cc726b785f2ef016e366fb0ffe07e7cc5ccfd6e3cec9d2804440975bb92a1031fc4e7456484b7db35d6900f0
SSDEEP 384:sxZhnPLqvm4a/fnsdX/qEpg+zQoYNYzAy6CBtJHbweMdoPX6LAT+:sZPmvm4a/fSXChMQoYNYzAy3zHbYoeY+
TLSH
T1FBB2E85266348977CDD7D619FA61BF62D7B91023DD804E4C9AFCCE0C04EA6ED2206C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 33KB
SHA256 f5d85d1716317e39d39d924d76b17b6b8ceeced2baa661189a38d95ada6177a4
MD5 08ef79648032fdb39d5179d6880f9efe
SHA1 3effc96440c64cca2768204356d97660e40569dc
SHA512 1f86a4c2f1ad28b88ad2d5afae1bac9b4950392d703e52cb3680672f6dd721aaff3b979ecf456169f6ba5e18553b0226805b9d89a4fcebe2fed15f42d5ec36b6
SSDEEP 768:sZ3mvm4a/fSXCsMvzwNYVAoZHbb5nky9ALTJOY+:imvm4fXCsMvzwNYVAoVbwLTd+
TLSH
T1F6F276D3A1340A7B8ADA9536F4A4FB39D3921467CE904EC6AAECCD0C04D79FD7501CA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 53KB
SHA256 352ef7117a5ddb5f78bbabfcc69e4653540daedbd27d780842ce1ba4ee6494c9
MD5 e427dbfdba9dadd29a56f1d43d50b3ce
SHA1 2526d5e437e247e96fb85538f99bb75c31381043
SHA512 2a76fe86013f7bb6a7af4bc9d07880680d691ab8d62dcccfcf51ec4e795f01588dcc5afbc58645d94f39726312f3de8685631162e734cb8a7564fb3cb721fa16
SSDEEP 768:sZ8m8m4a/fS44Mnc7WeT+/CxMvzwNYVAonHbERVkw3WXpIm4b1hOm+:9m8m4fJMmWNCxMvzwNYVAo7E9m4b1l+
TLSH
T10A33B793A034C96A87C65D35F0B8FE3AD79514578ED08ED66AECCD0C00DA9FDBA01CA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 f78a15fc09dc9f45f6d6cdb592eaffd00f1bfbf9c0350e084b07b168c85a3a36
MD5 b8baf98934c00ce59f324b32114deaed
SHA1 916a50462213be57bf97d3ae6ad115087e5c7601
SHA512 6fe476b38bee96d180761bf33b8ac66d6d2c4300c1c623d78c72fe07a759556361839edb330d35e1e3e2ddc0cbbd6d103e3670268ac86ce1c314470a1b746ece
SSDEEP 384:sxZhnHLqvm4a/fnsdX/qEpt+zvzwNYVAo6CwEHb3eMd48qPX6LAT+:sZHmvm4a/fSXCsMvzwNYVAozHbZ4xeY+
TLSH
T1C5B2E893A5344977CDD7D629F925BF66D7B91023CD904E889AFCCD0C04DAAED2202C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 7a49c826373ae6709b3e2fd8cfd9d390135e3ab2cebdab1a3a070657b5bcfa59
MD5 22b042394f0ecf2727e2a87a64227003
SHA1 05faf2dbc12fd4fe511c22d9e315daf12f62d403
SHA512 4a87bdbad387e15b248bbed40ed2dfe0ac36cc3f2e99a51395a8fe732e92a847c44ad488efbfdfa73c992a98623bd56dc9209127a066f7f214cc903b9fe56ddc
SSDEEP 384:sxZhnjoLfm1a/fnsxPnWMpV+zYXHSteC0GGHbzeg/CfjfH+:sZjo7m1a/f2PnLMYXHStgHbjCL+
TLSH
T14CA2F85266248977CDD7D619FA21BF52D7F810639D904E4CAAFCCE0C04EA6ED2612C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f1f4709f498162cf55c2ab310bc3ead452ad33f6e63b9baef0f0a4c6fa821570
MD5 51f2b3a16699e271aa4d59eb4be8b85b
SHA1 93d1e27acd01fd657af0354225bcb8ef67888e09
SHA512 6c5344731d04b6e019fbd68d6e8bec7e9774f6c20fb2882a0ccad073c0fec5b31f4774ea5a5a4a197ac654749cdc86a966960775323a449ee044dfd76bc33546
SSDEEP 768:v4IL+AI7pLuL/GeWvGSnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQD2JLlVzetYro5:v4IL+A0E/GeWvGSnqu1ja1D2JLrCtj6w
TLSH
T11CF21B7B6C0CCB7E4F804E9CDD2ABE8A6DE8018B56D8C9544BF9880C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f39fd9edc2b1a6f4daf5de47876effebe6270adc051f31553d1cb94adb005df5
MD5 e573044b64698ec3cc0cb5a77e6c3804
SHA1 84ea60ced57786a9d0e17fe515493bfd73ee93ef
SHA512 11d02f355709e1b991ac456e8e9bf39dcf7342d8fcce557fd1e91318a85b4fe39850ba377ccb1046289e45f5b9b4f6f8e26a304eec0cf1f335ac2428f1584262
SSDEEP 768:vLIL+AI7pLuL/GeWvGSnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQD2JLlVzetYrow:vLIL+A0E/GeWvGSnqu1ja1D2JLrCtj6x
TLSH
T14BF21B7B6C0CCB7E4F804E9CDD2ABE8A6DE801CB56D8895447FA880C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86111b5d-c1c0-423a-8056-0366cfee6457\index-dir\the-real-index
Size 72B
SHA256 c4827d6271333010c22b7eb9902d867715cd2e855c754d057b3ea827df96797b
MD5 68f3f5f20b42562f489f4959d0c2fecf
SHA1 587dee68faa1af35b8f85012fb6b1e8a78d7c1dc
SHA512 bc7c0cda2021f157d438f258bbbb938b10f1025ff699ce4c0462e318948e306405203dd6501d87f935baf4c049e3402f6762e89bf34f28052bf28d622695fd7b
TLSH
T17CA002504D50100DC4900BF2109121A52E58AB6005D5630550F57069CB922716369040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86111b5d-c1c0-423a-8056-0366cfee6457\index-dir\the-real-index
Size 72B
SHA256 25712f078d6efa76666b9d4963d8120f9046835096bdcb4f8bdfc10ad62293f5
MD5 27bf60174f670c019ad9f734f09d3886
SHA1 3742d6514903915b56d3d1a5bfab5830aba3fe33
SHA512 f717fb5ecdb142be2727cbb827c2bff09557286f76d2d2d3efccdd52038da7c4d4dbf120c96fc8139a9b41ed2531afb25ac1c861a986ade97b13b5af88ba57b5
TLSH
T1A9A00215A6842849C0100BF2229103ED3254481503E6934150A874D4DB543504321050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584e2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86111b5d-c1c0-423a-8056-0366cfee6457\index-dir\the-real-index~RFe584e2b.TMP
Size 48B
SHA256 e6037603fe9101279d2990d9b09ff4ae99f2e4b43c2054fc4dc7b61135c2c901
MD5 b9cac44a516410be05c06fa54286d149
SHA1 5ff7017047a7de7d3840e7b8bc668d5e8ed27b82
SHA512 4fdbd8e0474511a5767bc8a445489a73fb53c5fe422b7c41d235c4bf500285736291c7573353e412e1f7ded717044022a593ddea084af3b065ef14fab296c7d9
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\96b31ee7-32e1-4f57-aa61-6d003928c6fe\4f2277ea2139c475_0
Size 65KB
SHA256 13928ae60ceb4a5bc557ef617b4231f8bc5b0c6f995be301f82b4d04a721231d
MD5 f0a08d29f0008eb618978720cac61af5
SHA1 8a9fccc35e665d556413431e4320633e4e1dc562
SHA512 9aa0336d30ddd486a5733e7131b14542238cd1d2bcba290f1c4f7a37941e4501a3d52031aa9ca792a373e7fd31747d6cab96196c44640803b95d103bdded729e
SSDEEP 1536:cq0ktJGXcNQ9jWdWkYs/b23Whz5CGmNHnZ9ZQGCl77HPwqpzkE/P8y8t8QF:clkjBoK/YsfhzUGmdkD/I
TLSH
T1736318A7B0626025C7AD21DA54AB3B00F12B17523544C9E8F07D79913F19E8B6277BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\96b31ee7-32e1-4f57-aa61-6d003928c6fe\index-dir\the-real-index
Size 72B
SHA256 8c965e05a787f53800c4fc65bf3259290515cdb18e48c2d37b2a0740f9d449ac
MD5 385f775aa25ab5bd8bf7be1c316b41f4
SHA1 e1b0cba0524b74b52bab703b088ac2f5188c7253
SHA512 65207743392736346b59ea415796437f381484b3a0a16b9f01dc33f410afe4bee23174727d71721ea0cf02ea4e333bc51e91d91630ea85e64fcf400dc8d0667d
TLSH
T1B6A0026019F40581C2410FF051C242512358EC15120553174195047E8C511E88D238D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\96b31ee7-32e1-4f57-aa61-6d003928c6fe\index-dir\the-real-index
Size 72B
SHA256 014c53083189a3971b1edb94b5a2ae9f223d1102c116517b8e51821063a1997d
MD5 3c8518a8812078e871dfec5829b7ed40
SHA1 001cb55732624df15bde0efe693cd97fd5337027
SHA512 b253d7c31d9c14b384525f5cfb109474932ca8ffe1d5d1325cf0558413983069dc161f1c610a34f75c6d6e488421decdfe464b16577db7386dabf0cbf769fb41
TLSH
T1CBA002B001B50141C19116F065D201606728FC25120393479091167DCC722DE8E1308A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d6fa845c-cb68-4123-9f5a-d02b08cc2ba2\index-dir\the-real-index
Size 2KB
SHA256 35cc9b28986994a094e81ea306255275c6bfff6ecf0c41cfe0d4c608b61b3d40
MD5 33444ccb995aceab652aa0aa9078ad6b
SHA1 201f605245a43ceae4dffbb0d48f1d5047a4db37
SHA512 f250c22ee56bfbf5ce02b31de388f5c20e3aae3a410c31d7c65eff4855425cde4d221dc52517150da964690f78b411f12b76a4d71b9602beb19cc23045fc6ae6
TLSH
T1D251B58D8D475A6BF8AC56B300B6089433B80ADC0B9456236CBC663ABD5722D1E5E398
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584f92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d6fa845c-cb68-4123-9f5a-d02b08cc2ba2\index-dir\the-real-index~RFe584f92.TMP
Size 2KB
SHA256 363910dd874eaeb22f955068dbc93133692e91322e995e63b0cc3008034baec9
MD5 fdba2a522acd989cbdc8270b40383343
SHA1 fd28765762d0a1fdf232382e91e490bd18391948
SHA512 f303ae6a95629d5c9a5040a0dacb1af696e84ffa4f487cc0ff4b59d51170c2b65917f1e7003f2416d17208c98ea5f600715315a2ce5f40fbd99a8de095a543cf
TLSH
T16C51D75F6C420732CA8482B318C64465373964554919AB0B31FC8A33BCD76BE7E5B345
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f019a38d-6406-422a-aed9-2d16217045b6\623cd082b6202da0_0
Size 65KB
SHA256 9c50e5f28eb0876647a96b0bfd43c973f1e085b2d010d37ba1e3fb52bb66ac07
MD5 3043b7d414cda3720e2b867e60ff8996
SHA1 c3268b2dd7a43d60fa47055aed8b766591fcf110
SHA512 a81f39592ec90a65ec64dbea36089bc434296f1732ce2b85acc54b7499c83aa8d5991491f7604963fce0c9fc0e38a100625d786ee81e49af248a97a48ea61dc0
SSDEEP 1536:20ktJGXcNQ9jWdWkYs/b23Whz5CGmNHnZ9ZQGCl77HPwqpzkE/P8y8t8QB:xkjBoK/YsfhzUGmdkD/M
TLSH
T12E6318A7B0626025C7AD21DA64AB3B00F12B17523544C9E8F07D79913F19E8B6277BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f019a38d-6406-422a-aed9-2d16217045b6\index-dir\the-real-index
Size 72B
SHA256 27e0cdce2e3f3b2a0a4f232505fad93c7669785fe357c442b0b2bc95f2160456
MD5 2c14ecaf4c8cd9ec69ad968f06711be0
SHA1 d458de4a4ae961ec2204fbee76da07db65c21a6f
SHA512 05e5a6085b7736e3cb0509929892690be51ca54491524f4f76dabb3174d14303a86a7c3b40c0e9d6905f1536dac2e03ec4935f74c94dde5ea6337e3d2720473b
TLSH
T19EA0026006860107D50F57B065DB12417324E8501211630753A26044CD94580594201C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f019a38d-6406-422a-aed9-2d16217045b6\index-dir\the-real-index
Size 72B
SHA256 56072e687fedd9bcc53b5a37b5203ebaa22a832e737a550cd4ac3d8dc34e3e59
MD5 d43b35f88c77c0b2e5a3b6b175624477
SHA1 900d23e7588594963b8cb584ecd95b66cc4815e5
SHA512 5e43a90833f884b87bc24421c6c59fc4f156316d4495fee94058e0163563b0a915a9b0f176380c7abca6a87bb27468895382c27c79d42841bc61802e5290e922
TLSH
T180A002A253A09112C01312F8A6A302426714CD504641339751A201BCCD549C4498310C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582853.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f019a38d-6406-422a-aed9-2d16217045b6\index-dir\the-real-index~RFe582853.TMP
Size 72B
SHA256 bf208cda61fc736bdd0dedec2cecafc457b9f44a7bb7dff08830fde6228cd38f
MD5 eefa1af8360605bb81c009994efb0356
SHA1 7d0c731b3c506d3607ac8736aa205bf041561187
SHA512 b9694ad949d321c375e6d36bdeb86949155de1c16da0f63007e4103be3a2431e8482b16b17928ae06d9d320e871acdaa6eb9c4442101d24ea21cbf7daf594a8e
TLSH
T115A002130380045DC56273B6295202451606D9281100124641918454DE768424D6112C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 1ae61b23f970f278cdea95aa0912c0343fadd47dbaabfecffae61b733688c077
MD5 5db002ad01c942db8e611fcea79b2e3c
SHA1 89d0996a0d9101c4000b852b94ea81d3711d0896
SHA512 695eb7c506f27e3dfadac2c7121d31b7d1e67d26322c8d2e599eee34f82e4ecaf891bce5c02b2a6444a404f84017c5126f35fd1c4f88dff2d6054e4be7ae5a9d
TLSH
T196F027B62FF72C24BD9F82D6607144A506247C44C545EE4F5896729791B1324205DCB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 01fdd248bfb2787b78fea7f7077e14519a20b0372be7d0d96037f638cfe1592e
MD5 2064183be504aa54d9f32d3bd9f1de8f
SHA1 b00cea334e6f0db3a7b308df47d334d1272bcecf
SHA512 d1cd7e33d8cb6057c63340993ed4af996581164e088e14fd36ae1421bb6418c7ec0dfe257f230d97a47514a0123884b581c699f28fe58c9ad230c9516061151c
TLSH
T180F055BB6FF72C24F9AFC3E6207144A502217845C555ED4F549AB2A792F63283099CB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 ca7c48d05ba7e056c3f0fa29883270449d12b3354bc3990c76f719564bc76ac6
MD5 4f109034740fbe6674cff3e22050d856
SHA1 dfc06a50a715afe1c5917feb63630d31fc01d990
SHA512 6382a7831b8dff73356cb68393c0331d1f3be7e3e4cc1b12ff758c31b5bf5d736b74ca8939f0932c44af0797b7cab5a0829d4f6dd76cad29997e58dd1c0ab41a
TLSH
T1BDF0DCB76FF32C20F89FC3D6203000A002103844C550ED4F145AB29781F23243059CB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\60ad05b354c6452d0bb34f0e00d8b5b2f562a926\40258cd5-70b6-4c84-bd92-cafa01b07e08\index-dir\the-real-index
Size 72B
SHA256 80a18fa3429b7ab4676462424f0605a8ecc891e7046b1f017b94712c5a421548
MD5 2a5febe1e14a221c0081b34e7d3be5a7
SHA1 fcb686f22ccb039f80a9ff4e011a7de18eca963b
SHA512 2c826aa3f95f6423fac2acd799c4dac303a65c5b23223c4fcee473ce89b6b2c9733b175f5d43af2f2a6322ef86090120a9d61de7984f8c4139d5489346cc673b
TLSH
T1EEA0029041C4C085D52517F210C5338063AD5FF412152777849655D8EE605405315261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a884c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\60ad05b354c6452d0bb34f0e00d8b5b2f562a926\40258cd5-70b6-4c84-bd92-cafa01b07e08\index-dir\the-real-index~RFe5a884c.TMP
Size 48B
SHA256 63175684f064691bb3d23eafd84c5751c865b592f619ec43bac3195fe980212d
MD5 e53caaa0ea728406d248cea5f21064f3
SHA1 7d44703c041f5d78b983ecddbbe38724a2d96c4f
SHA512 bc81d13d8f939478d30db4098eb632fa9ea85814bc438b117e974111be82806a0eb100a5374dea11f5682f23a0f627ea4dd301b45fbb636fd349d88e15c3b635
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\60ad05b354c6452d0bb34f0e00d8b5b2f562a926\index.txt
Size 121B
SHA256 1359f34796397442aa15e8243982431a9ed6423ac1bb59980cabacdd1013ae35
MD5 e59837b878a67700701c9eeec832c5aa
SHA1 d9f72ae7f246a8a4aefab691d8190b0646200fc7
SHA512 5484a619140b771948e47148d5234f9be83bc6eed840c7abc0d44cd0ed360ffc1c5bcc6b7f031f8d482060172b82d049c4abe68eee491e791c64ae05a7e8f086
TLSH
T139B022B3CB220002CF02E2F3083BF02EACB33CCE08F82208C0002302A000FA20002FAE
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a887b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\60ad05b354c6452d0bb34f0e00d8b5b2f562a926\index.txt~RFe5a887b.TMP
Size 126B
SHA256 f40947a79ea8e9d7751439bb73fadfc829039d509eebed45b9d1de291ad51a98
MD5 9060f1ad8ea4f6cd3b75a639e238806a
SHA1 f4af08a5b39931e7b609e25ee8bc92df6a698382
SHA512 9dac6c39ee5d43c9bfc006977d6cc48f3809a17611fde576d8c4554549868b7a98aa8da8cfeb30a985feb0eb993135583bff15241404b60b8fd050c80caeb03c
TLSH
T1FBB012F3C3761006CF5AA1F3993AB45EA8777CCE49E45508C0447712B474F62C296E69
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1d792d308483314faf3d404790c3b8803fea09179b64a6f44965cd03559d7ad5
MD5 a4d178a464d28ddf500dfcb9274d1a18
SHA1 e2bf977508bc7709b0355d53d5ac4c24d1dfec92
SHA512 e35c68f017d54143330cc54d4d207a2d426f53b07a5e86ba0f8712c4f6018959d7500fd11990c30261fe7695fb54f61180d7962a5fbd6a27127d8ccc0f8a2005
TLSH
T195A002539955048DC3410275908B47A4721498181709371182E5A164A851154413204C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 08c32e97fee9e44ba5e156841ef772d7fc4815e8642207a4b652e9b4ce9091e8
MD5 a6e43cd7f00f0b6691e38c8fff5c7f4c
SHA1 efea90d7da5211d8d0260eeb4d82cfbd73054a42
SHA512 a109e7c6e1d3c6fcf75a80513ddac8713ec71f48fa335bf4450466679a4c3323e9e95e0ad9b8e3929a200fb1d2e924036abb9be3225a521ed1f810fc0133402c
TLSH
T1C4B0220B88080002C00A2B30E2C28C2C302C0C300B0B32BEC0E8C0ACA0B02808032B08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584b0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584b0e.TMP
Size 72B
SHA256 0e5f431bcff6feb062c3699e36bfdec22bab0e347453ee805318e9c7c93a1c0c
MD5 66140dc0a2ab4aed1413dce139108e41
SHA1 bc330323d72a4de572b93f90f698ca8f31d4832c
SHA512 b444d6d1b0e761b28340ed35c26e27aaf3cd5f7f13eb6349080b9ee1ac305dcfa7c9050b15cd1be52268c877eddf3a9a5f0bcf4a26f0b366e41a678753a01328
TLSH
T12FA0021693491C00C588157E520563943725C85A0008232384E0F4FCEDA15615DC1147
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0071e5d9d94338dc283f98c98fe24bb793d7ec218c12a1403da66395be7fd969
MD5 752c5ee7cf1510b27db3cb308ecbe3b3
SHA1 37bc1d4be88890c28033c4191652da2a55da07dc
SHA512 4e6932f9b0e31892d620370e1feb02b74e2b312880dc130e9c12e7f368ca9ba7825c51f3355fb6c9fc9e16a13ac5f9cfb28f00a53e49c96d9cb9f7ab670e818f
SSDEEP 192:W75v/AjXMvdf93ElPpR8VhT/jyneVJ91JLKZJOrxt5f39h1v9:WdHAzMlfNE9k9fthF9
TLSH
T17BB24E3171FAC2103A7D39D89199BC27474230A27055E43B3FE900A64F6BE295DFDAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 78B
SHA256 7e0b18cc7ee68815589ebfc9ea05bc0a6e827e9432cd70d04234180ff141b4b2
MD5 b78fc5f9154f1a95afc961a7b644c713
SHA1 a21118b21a7945f2b24da73e6744354552e29201
SHA512 4ca190e1fdecc252b8fb98c61e320a1ab0d89bb7e4260583fbea8af24c0cbbd60d04d6bbb78b3bff977854db90b2db5d198bc661946760b811804f0474a6e6d0
TLSH
T104A001A71889A08E1A60E9E92024B61DE31F968D8CD1CDF1980C84422228A625002820
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 159B
SHA256 8cdef6b9fd4e67d7a1d9761abcbb33c374c564d967ace5d47522ccaf21d5e1c7
MD5 29dac37394c22791edfaeef4a31aa826
SHA1 081eb8ed3eee05df4a871d648832d24e13a4c3a6
SHA512 32fc5d3f553f489332ed97fb041f96a0bb7c5c5d817e5b358305f3659ff2084e856359f32769c4f1260162f47dc3637ce5b4da06f60e8313b6457fe8b620897b
TLSH
T113C08CE39420908A4FB1D6EB1034BB0EC71FCE1D8CC0CCE0E90D380130348138455C24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 152B
SHA256 c01d47708aca0cebc752d0d1dcc187ed25825325450a2b3267201c8b39317d44
MD5 93f89b9281d6987418781af9cfecef68
SHA1 e252a83dc386149cda4659acba6d397742e35a16
SHA512 e4d0c7159c87a233bcff6967d6b3c836c336ea94c31109d30193b7c37cb054c9384a41d3693a61b54e4876dfea5283ff52bb1d44d16ecc7172ec3f6c691f1bdc
TLSH
T16EC08CE39450908A4F74EAEB10347B1EC70F830C88C0CCE0D90C080121388124412C24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d640c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5d640c.TMP
Size 162B
SHA256 fe4cf8e8a9e2888eb86b61b6a6f0a1f2d51d9d67df0a2ac8449a0ea3dd0019a2
MD5 1366d026eeee5197b9ca322d546a100f
SHA1 4341ac4366e7cc9b66a0681f48b48d4f44ab5b76
SHA512 4bf12639d2ae085d2d8f9a9d7763bd1e0842a72e40b3830f9bb28c4452347663fa6209cb3bb458c1863379ab54113135fea0557e222a723cf9c0f8051f9eb480
TLSH
T1BCC08CAB18A690891B20D6F86034762CE32B9C0D9CC1A8E5A808B0C621783269202928
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 32536d958d0fc6df1fe18d7206c51e1c941d9113f8b2606de1bc4c801d321798
MD5 a4266b5691cd99745ed21b4e67416e69
SHA1 3755992cf2b7f5ce36319a5c550be11331d0358f
SHA512 0489a3d2a5bea89d44674e074bb0341fba825c04f0b0e335a93b1ab818c671e6b8950113fed182e6abaf14079ffa46a8c2e039fc35684db47ec9a9edfe3e9bbb
SSDEEP 768:8VFicppjgrwg9LaCFZKw7dI0bahkoFYS/EiEfR:8fpjgHLasehkoaM4
TLSH
T146E2C4F298D78977E89E4B87A33D6D429AFCC153B5885994B7D81D0CCC8A1BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 fab22f8665a9f99ae3fe8acc85e9a0535c6be5400875ec423633188a1840f8fb
MD5 82713bd4e13850cf4251bc17d333bee8
SHA1 2e2120c9795997063f0d472be3061200dfe36e8e
SHA512 b72bdd0f8fdf7f1911d80782543ae7e7f83252d4ec544a0181f495b9865e9a925af5e67481ce38a84e3ec5166792d00911a68305ac88ccaea020fe2dc9b1a092
SSDEEP 768:8VF/cppjgrwg9LaCF3Kw7dI0bahkoFYS/EiEfR:8ipjgHLaqehkoaM4
TLSH
T146E2C4F298D78977E89E4B87A33D6D429AFCC153B5885994B7D81D0CCC8A1BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 39e09c7bf1e239b4f0d6e3cb61e5acc96acd4cc8e17e6df9298d751ca2274fc6
MD5 d04c4d1f70330fd0dc3e31ef8c451548
SHA1 12d9a6542b1bbe9f4309fc39813134cb55e58b5b
SHA512 b9267261b18dbfb7b05852d6fafc73e65ea157b77f2981ba9f100c22b68e2cba34a060367764b0fc5e71c719e0fce4a44ab262318269e1c35c4f332c18aa7a0d
SSDEEP 768:HFccp6Hwg5La4F2Kw7dI0cahkoFYS/EiEfR:/6LLaR5hkoaM4
TLSH
T131C25B32ECA8D9A7ACE68BD9F74A7A43EEE00163868C5AD4D5DD1D0C00DB1ED530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bac4a203bf93650f1ea8820e610fd5a4029d041111711df98ba736b7859aa650
MD5 5f7220152768d9c64f3b2629b53d5c3c
SHA1 d697e752ee4f99fad79062561a019daa8cf91d23
SHA512 d1dcbf76e78fb9f074953c5de02ca42f5074bc1151cb27c80bf4c92a0f44dd79b96d52504cb2e822accfc9a66c0470f951d2762e63cad09742011f8c97b480e8
SSDEEP 384:nniFavqMg3sNF8TUNTUlImkrLFzXZBD4fwKcWg/KY5I0I0Ng8cLWkS+woD5SHLNZ:iFayv3+wgxbFKw7dI028cSwSNt
TLSH
T124C24B72EC98C9ABECEA8FC9E74976439EF00263D99C4AD4D6D81D1C00DB1DE530B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf816895f7435d9ac5b2f9147d9e175cbb539f295997cccd3b4c1a5487cf0b1e
MD5 8ab424f91947aa209341fddedc164bed
SHA1 6d2e1ffd70fbe2b84018fd72d606ffe0d5b6275e
SHA512 fa0405ffe20d8b1ca5c690f5f492eb40e2907a342ef59662c8d35141ce473178f832f56330cdcae2b9c14bd4c7e2f7efef0f35af556691379dc5a6a315041e4a
SSDEEP 768:lFccp6Hwg5LaGF2Kw7dI0cahkoFYS/EiEfR:B6LLar5hkoaM4
TLSH
T16AC25C32ECA8D9A7ACE68BD9F74A7A43EEE00163868C5AD4D5DD1D1C00DB1ED530BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1109757b903a63bab0402568758c3aea911b4d46eb09649308adaa580fe91511
MD5 80175b05d934e883f94b5241b616faf8
SHA1 7931091f68333a91d41ff10f35f60536fdec1709
SHA512 f677d802070a633c53b28023a3752166b867c5752869f6602884f5bbc9c538e0ac78da30c9ffd98b50d12576fda5f0bc7820641b78ec587289881b4000b60f25
SSDEEP 768:8VFycppNgrwgSLa8hYw7dI0vahkoFYS/EiEfR:8vpNgALauShkoaM4
TLSH
T166E2C4F298D78977E89E4B87A37D6D429AFCC153B5885994B7C81D0CCC8A1BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 cd0ccf24dd321be03625079cc681a445863c27a7ae49800b11e221b94cbdcecc
MD5 8904fd3a423f476c1c335d6ed1a8d368
SHA1 77b9f4deb5e5aed283561f846e4884391426dbb3
SHA512 15e168e0b5fac6819f1ddbfd4b66db977c1b09ee22fdf04b071dff381d0dbf8ba0a8054370e292503d6c160da66f80310b9e8fb59a57f0afa1bf967a38095f26
SSDEEP 768:8VF5cpp3grwgSLaTJYw7dI0VahkoFYS/EiEfR:8Mp3gALajkhkoaM4
TLSH
T15DE2C3F298D78977E89E4B87A37D6D429AFCC153B5885994B7C81D0CCC8A1BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4db721d45a5e7d1cc3bb1b288be23f0fe9c527d240764f2f040b5abaf0bc7ed8
MD5 2c6668b5de4c57c9c53a93cf9c594256
SHA1 622659d14fef2f7c17e1afd7480d394b3274336d
SHA512 732f3a6718fe35501a438d7f888ee3894c2727440208a5c0dda29f37d97b4ae5b5a5b813a2107ad74d3f7094e553be5780815e989c2c60ac1381630d5fb521a8
SSDEEP 384:n2iFavqMg3sNs8TUNTUlImkrLFzcihD4fwKcWg/KY5I0I0NO2acLWkS+woD5SHLz:dFayv3XwgxjlKw7dI0vacSwSNt
TLSH
T15EC24B72EC98C9A7ADEB8FC9F74A76439EF04263D69C4AD4D5D81C0C00DB5AD130B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4bf8f403524864d8d44b0a36a6c7051289721b588c5d9424ee6ee303196e9d4a
MD5 71713f6340bbab30e69dbebff316a5a8
SHA1 98bf436d9872d4080459f056af640d13ec3d8339
SHA512 4ea5a3996a7a2c81d47b7633cdcd4686c786443b3da786b161750962e74bac37dcc5eb122733eb1fa0309f799af3055dce3b8b52a1a529dd95679bbf2cac549c
SSDEEP 384:nOiFavqMMsNQ8TUNTUlI4k2L+TNFzpiF2D4fwKcWg/KY5I0I0NOLax3LNjk+5vIR:lFayxHwgSLaGF2Kw7dI0cax9G
TLSH
T16DB22A72EC98D9ABECE79FC9E74A7643EEE00263C68C5AD4D6D81D0D00DB19D530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 97ffb5bd287e2041cd0b0c49087fe0dd975658e5443b06f408f888cbb5ce9d67
MD5 7352b964d1b87cb01ed8a7343e3b6d57
SHA1 2fe09829d700444edb1c84da5e40e758840029cc
SHA512 92dbb501e4386f945e3d93a65f27eb626df5d8f75db85e791bc94de8d47209dd08b7301d9ce4e9cb9a67a477d54c523354681f67c392cd300e26b5e1c6c379b7
SSDEEP 768:8VFyecppsZHwg9LaiF2Kw7dI0RahkoFYS/EiEfR:8u3psZ7LavQhkoaM4
TLSH
T1D1D25C32ECA8C9A7ACE68BC9F75A7943EEE00163868C5AD4D5DD1D0C00DF1ED570B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5ac71f992c882db2b8719d4f669c751abe02b637e190061107f8564f4a31292e
MD5 935da7a439b689b9bad68868c5b32e4c
SHA1 6e8fd113c1ec768dc96abdc920554a414d49792e
SHA512 1dc92d682dbcd13e03e9127ce14f32c8892d80479e2cc0ce5fb240584992156c9bf119ca9785a0b3ba368f92a61ff74b488ab010eddc57bcb511ad94cfcee8cf
TLSH
T1DBE044838380A2AFC02E0330008B0B223AEB803002B202020E322A2C2EB33002E22BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fa03851cacbae808c629524c7e4844828a805d89dff7892e2fa3d5a62f067da3
MD5 184ce5a4ace2ec9a826aafaa63a07a73
SHA1 c5d5f818310c3dcb176b4127440b35e0f1b33309
SHA512 91db52c777c761840ddf02e9f85059d266d1aa4a2dca7a9b224e5ce4c4a02d6b0399e4c47781e08af2a6a9e8431850c27c41030d287c0c901e8d63150442614d
TLSH
T11AE00453978196AED56E133400CB5B622EEB942506B306561A321A6C6E733402E32BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8689110d22410f6281b2861a04f29729c4ac76143864f3b3b3c767a0d6981080
MD5 63a1d7f5765714fc117d9e6c0476fb1d
SHA1 fcc8767f20ea4ccf9b1cc413a8bd452fc228e102
SHA512 619998843e266cb4b7bbbdc54a4da0a50cee7a849c98c868633f844213de3a919e48d7393060ee7ce4192c7379304c0ae362fc6c165f2e60c3a3ea5502a056fa
TLSH
T1C1E04893838091BFC47D033000C71B2239EB803002B202031E221A2C2D733003E31BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 97bfd2494a358b49ed22103e2b4b5d23037a89f122c1e53859f5f3bc757cc1a2
MD5 e8ccf6e8f4b252b91001b133e1f71cd2
SHA1 66d50c1095b7bef687e144a20f28b6fbf130d888
SHA512 88b0842a5f40674fecdcb48c1db1a46eff3036fcf4a647fed42ada786e4db6c86f1c430bd825086de7710bb8cd45b85d8705ecffbcd62ee17e0e4cef3ac360b9
TLSH
T1AEE00143974086BEC16D133000CB1B723DE7903506B206160A31016C6E733003E32FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dbdcf63c6af4946ff34558c5f3f99a1d5e976d05c1ae45ab67a79071ae1a5ffc
MD5 688296e35cc83247b0c72b4a7815ffb1
SHA1 fe2b09194736ee29d7388d7cd806468c0a4c1c43
SHA512 5144f8f662a0046045e2caa0b5d0484190c48facefb59e6bf0dc8102662cdcbdfc1bf8b707ce50e9ba0a819d88579b7a354b597ffbb5dff4aee5f7be876c963c
TLSH
T1ADE00153974096BEC57D133400CB1B623EE7943506B206561E32116C6E733003F32FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e8138ba52c1fc4ed2f82c64b2cd7fc8787af933f2524d2c9ca3d309a0c39eaea
MD5 28a1a765be089f5887b762df8c373e22
SHA1 fa93feaa718eaa54db2d5ed6ad1500383449ae8a
SHA512 153229d3af33a8faa9bede26960ce5340457bc68f0ecd6827ff599714380a2663ecc606653ae5f596031b54f91c16ce092cc317e18376246ff6d4b385017909f
TLSH
T114E00453964096AAC569133400CB1B622AEA942506B306961A3216686E733402E22BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a136a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a136a.TMP
Size 392B
SHA256 082832869213f26394a4e523adcf1e7656fcd0134027805ca06df61d7044ab9e
MD5 780744f92bac91e6b24a1938ed45455b
SHA1 4d725b26464ff5f27e41b78c16e663037d22ae2c
SHA512 42294c147a771ed886498c2a762f0c4fa719e0a08b550609841db1432fc3d76bba1064bf98f2dbd168339f624cca1cc08d85f580c8d276106e2c64a489f31508
TLSH
T161E00143934086BAC15D1330008B1A613AE3903506B206160A2101686E623002D31F80
MD5 SHA1 SHA512 TLSH

Submit Download

00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a
Size 1.0MB
SHA256 00af3f07b5abb71f6d30337e1eef62fa280f06ef19485c0cf6b72171f92ccc0a
MD5 14ef2d35ee97e8be10d6046b2e1942de
SHA1 8ad139e47d4d58df369e40c025923be0d82a5f9b
SHA512 f6e646031caa27f972b222a94aee3b2b610db686009e1dee6fbf0c4ac7ba6edb632eafd9ed81e15bb011e2c31ed4dda82b16dac560ed68596159ec29064ecda3
SSDEEP 24576:OgtkaswlAtUVNexKSU7EmXzDRx2I1woiB/ArwoiBM8u:OgtkaFlMHQQ2zDRQII///u
TLSH
T1CE353322451D0388CEE76BB7EA4F7B4B612E1CD30A81B54B024916701ED5BE39FC669F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86db8339707145aece80862a555f623b36c23a4a7983742b4452b374d7de0864

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\86db8339707145aece80862a555f623b36c23a4a7983742b4452b374d7de0864
Size 1.3MB
SHA256 86db8339707145aece80862a555f623b36c23a4a7983742b4452b374d7de0864
MD5 deb7bafa7d89affea5c6de83840ecb7f
SHA1 4fc8bb28656edcde67c01c18cbe9d5a6a5fc0cfc
SHA512 d7ed5ed0d60de4039705bb6cb85a681c285507e9fb3ca01b82d0effdb0ae95a3164b8ec258eb0cb1e7f40cba62e9b9c9f1d0b081be36bee68a52093c029e0e5e
SSDEEP 24576:Dq10nbpEIFyDOD5ASjn0qAQvyyVn0qAQvyyVIWhYpZJCLQo59uUIaZ:Dq10bqIFyuln0sy2n0sy+IhvY8rULZ
TLSH
T1A55533235250CA91D6429A6D6A407F73FBA61930649B790F4EF01C028568DBF3BC779F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e7217bfe3521812c8c337692f7f7929d29a504b0d85677d613514381029c51d5
MD5 f7503e753d7c46b57b3061d43d39530a
SHA1 a57cd90274c2661edd09b0418f4faa48f262e1e3
SHA512 2e6e0ab6a750d13353b0dbd6167f4655eb026ec5e55eea793e848d56972168909bd712cc3fb88d9d07dd0c472999041a231b45eeb62cd0a063c61c6e41debd14
TLSH
T1394120E18C3D66D1D4FD0E2EB09B78FC95D8D329F4A8347D6828EA98053E51DA48543E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fcbe123dc88ccc9a27dbe587fd150acbd797c461b55f0b6f9c7486215066bea9
MD5 1f54a37f5c6fd7a0e92239e3829f1fa2
SHA1 e934a1c422b02208701e47e5a8c2b5049f3bf2f1
SHA512 caefcf6c0a3a5ccde779d5e768c58ee1ad10116a968ac6b19462f81b6b9e4ec063fee2760cd9f297dbfb5c59cc6d22a7f7ef4b2a2d9ff996cf01f07ee86d1516
TLSH
T17F413EE14C3D2AD1D4BD0A2E64AB38FC91D8D729F464347C6824EA94063E51D648443E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 963690674a7cc20aeb78f908f157fc69b6cdaa2a47a10822cc95df158f72e85b
MD5 b33350c7386c242f3f194c3adaf10d4b
SHA1 ad7fff2e6dc161fc1a8df1317bd9522f0f7ecb95
SHA512 7034f79b3ea6a1412885ac98bee9a17d118a6c50630290cf7af717b77e511c448d4dfee6eece9c8e4d2c2f966dae4eb965d1cf21a4ab3f4df2c920588ba7d0f3
TLSH
T1944140E04C3D2AD1E0BD0A6E749B38FC95DCD725F4A4343D2824EA94063E51D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b839b3b9b8ca88c94d4ada68fd537f26e26b2651b74bef51ac856ad3652a31df
MD5 63405f21d65bfa9ff955c923e71d16e6
SHA1 2caafdf4e57562cad5f54202f56deaf1a0a0c208
SHA512 141b9916ca771121fd3a0a63e6dffce23d64af5075247c2162ab7b2ae8258938b5ba8833ae5900e734812eac25b16a613ca7ff58f41ddcd0fadca146b972ee74
TLSH
T152413EE04C3C26C1D0BC0E6E748B38EC86E8D729F5A4353D6858EA940A7961C748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fbafbfcd4b2bbf9bb493538dfac57f5cdda7e86b418847cfccfedf244362aac0
MD5 c784a08d73636cac3e1d06dd4707a5fe
SHA1 4fa1f97589a9a7295c3b744a69b457dc92f75c1b
SHA512 68db7a92048afeef3e05933ba3dc230bb07344209144c30ab847aaea0f153c1ef9af3c7f99d8c7a7fbbe7c8df63218d5b2c5968cf4eba0de179833f082e431c7
TLSH
T1D5413EE14C3D2AD1E4BD0A6E745B38FC96DCD729F8A4343D6828EAD8057E15D388443E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 18d73ab05c2f815f7f2732d4e9cb17db97e5702b230403758b1eacf44c733410
MD5 98a135ec1e3f3911106f57af8e8913b2
SHA1 a3dc04cbec71fea4bb34ec063de23feac2324c12
SHA512 d5fa46558deb560687817f4f0746f89ee8ed6689c49b7590a25d79d16dd6e389979beaf9a853e27c80137e525ea2b7002ba3f3ebbc86c4e1fb53e2b2bc6bf553
TLSH
T1924150E04C3C2AC1D0BD0A6E749B38FC95D8D725F494343C2868EAD4067A21D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 16b758e4d2cde35f803f45c8bb991dd4c0aaa6db720f10b26a836adc77d7eb07
MD5 ef9742c41d10d7fa287436500dc15ffa
SHA1 897c594f32dcd532b1c1827847e2b1793f46bc88
SHA512 5f7f639840521116e22bc4ce3fcc3ee0f9be87014cec81a8a545682892872ac99f2154a7a8749c5e4d7f529911c2ccd37c499610bbf4a4962d89d03ee90f39d3
TLSH
T11C413FE04C382AC1D5BD0E6E748B38FC92D89729F4A0357D6854EA950A7961D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 95a369db4aea881a8a73f00150d172ac70db06ed0275a74befa46b6569e9f3a2
MD5 dcb448a34a32d9f117cf12968f830343
SHA1 a31b78931caac10988690b3e5d1d565699a25c30
SHA512 632cb5bac9072d30161681de365f9dd8dbf99cdf817f0b04c3be3cd7b64404a73714e579df9de103c8fa4e34dd169af36b813b1eb86bd48506bc540ee5dda5e9
TLSH
T167413EE08C3D2AD2E4BD0A6E785B38FC95DCD725F468343D6868EAD8067A11D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bb5737689045748527e7a696db0ca6dd2852c8f7c1ff427ea2471219aafd6518
MD5 57ca3066380df0dfbde033d87ee19661
SHA1 a4b500345c928eb8d9b59be510c350e7ee6815db
SHA512 76d9b75d781eab37cc9f3fe5f080ac74c22633de65dc93ef9e14b5d553052bc3f09bde927a2c5ab3096838870fb8a571f50faaef82ba44d9479def8295f93879
TLSH
T1704160E04C3D2AD2D0BD0E6E748B38FC96D8D729F1A4343C6868EA94067D20D748583F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f829f94ab61bf3a586e04266585e00e3328124ff87464380936bd6726f142cb
MD5 cff84427a196c4ff0d98522313d21fe1
SHA1 f8d272e3ad3aa8bc50bd4f8dd7bdcdbd98fd9750
SHA512 ab7472e514d3b84d09a2deaad50357dc5bfcb9dbda459e1cd3c7525f3e04796fd45dd720dd5c8a3a5e265800ee51a952fab3e4d4664fbdfdef0859b216f11d35
TLSH
T16041E659B6F90108B3B76F5A9BF6B86E447FB8771F06D49E10110E4F0A22B40C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

Watykanczyk.exe

Path C:\Users\Admin\AppData\Local\Temp\Watykanczyk.exe
Size 25.0MB
SHA256 36fadb37e85e42a758140f8c1c9296f80034b9d3ce7d1e2bcc6f106084c3de4e
MD5 0b35a40310502adf3657d4e6311c1b6e
SHA1 e5da2878c8ccd40c4c357d6acfcfd7711e8f45f8
SHA512 ade77fa180ee300e39f871a1f80573fe7606f5abc9605e7cd87e3f56f1118c4302c5777ea32605808c2e48d171972c1d41e43d6cfc53bf73681dc3d5920dd63a
SSDEEP 786432:jSgY6GZrzqKmTmb1zOKNQHNgoG49hwpgYZV/:jNgqKmab1kZ/BYZ
TLSH
T1CF472242A4C0E2A0FC7C8577B42358B90713FF7EED89B82920C8B51757FB1E15E69A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sftfvrf0.ozh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sftfvrf0.ozh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 5.1MB
SHA256 cf23c073640a37b989a4f79ed1416db116ea5b40600f3fd542817fe0e30f433e
MD5 e8575918b6da8b7a48c974768fe50241
SHA1 2a391dff2b176d1ddc0d5cf6f1c02cb7ec2b8136
SHA512 af5858c916f2fc7e31e471575bc1fbc8261be34c27fbd76ac61d884a9ea5ab449cb723ef8ffdd0f01f35d7efaa3170edc829b08f72130bbe54429b73aadd04e7
SSDEEP 98304:Sgoug1okOfli9GEJQPHIPCpQNPy6gTiHjNrhnaPMGFVlNS5cRyr7MiPwg8sYkSRq:SgoP1okOflpE+PHIaFOHbnaP5VlNSayR
TLSH
T11D3623AA75DE2583EB9B5430724811B8497627310F27E6876EEF3B0E8D1B6C21153F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Podziemia Watykanu.txt

Path C:\Users\Admin\Desktop\Podziemia Watykanu.txt
Size 20KB
SHA256 bee86c9e5a95be55269298ade72633bc6a8c9fd41f4d94bb4b07c33c19ce480b
MD5 aae3039d74bb061ab4336af5d5b9d2e3
SHA1 fbe5cd18a86ba06c5f3347d23e8e709547d8040f
SHA512 b289d3c5d4c939fc9351067fc56365f9ff75884c06e601ba6db48716e6855e41a6307ce739d6aa17a91d3c2b7a9a6aa034db47d3918d1e8dabd02a60bc9154c1
SSDEEP 384:Cq/6JNlq0Kq/6JNlq0Kq/6JNlq0Kq/6JNlq0Kq/6JNlq0Kq/6JNlq0P:ClJNwlJNwlJNwlJNwlJNwlJNN
TLSH
T1B492B50847EAC3FED9200493E396137E96CD109C6F5C89AF4C2F90BB69E9393A55704D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Watykanczyk-main.zip.crdownload

Path C:\Users\Admin\Downloads\Watykanczyk-main.zip.crdownload
Size 102KB
SHA256 0482254688333846ea358837da2f17c3d94d4a21d65892feb8f6e39c6fa5c844
MD5 7d4da3c42a9fb0099d3d4e9c149fadf9
SHA1 3dae8b63e6309be0841bfb3d3e30c76dd676943b
SHA512 d8fd408aef0bc3bc85cffd60a9d502f4ed74aad62fa8e9d8b55ba72f8ed5590213216543c205e599eef7506327e0fa5db6862b241c4a8fba6753b75e36b875a8
SSDEEP 3072:bscLDn5Ok5RW89NBcjWCsIEibPyUHGav+HANq:bthOk5RW89wYIESyUHGfV
TLSH
T1E6A301064585CDB6C9B990FF368721D6D389FA0EC0A03E593124FBE96B922794DCB1CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1081057905\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1237918409\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-2092-0x000001BAF7060000-0x000001BAF718B000-memory.dmp

Download

memory/3456-3402-0x0000023A76550000-0x0000023A76605000-memory.dmp

Download

memory/3456-3401-0x0000023A76530000-0x0000023A7654C000-memory.dmp

Download

memory/3456-3406-0x0000023A5DA50000-0x0000023A5DA5C000-memory.dmp

Download

memory/3456-3403-0x0000023A76610000-0x0000023A7661A000-memory.dmp

Download

memory/4040-3315-0x0000000000B80000-0x000000000247A000-memory.dmp

Download

memory/4048-1208-0x0000024EA7800000-0x0000024EA792B000-memory.dmp

Download

memory/4724-3359-0x000001ADE6830000-0x000001ADE6852000-memory.dmp

Download

memory/4724-3375-0x000001ADE4D80000-0x000001ADE4D8C000-memory.dmp

Download

memory/4924-2101-0x000001643A940000-0x000001643AA6B000-memory.dmp

Download

memory/5128-2102-0x000001F0E2AC0000-0x000001F0E2BEB000-memory.dmp

Download

memory/5136-3410-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5136-3411-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5136-3418-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5136-3409-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5136-3412-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5136-3413-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/5364-3384-0x0000021242280000-0x00000212423AB000-memory.dmp

Download

memory/5464-3203-0x00000190CBE40000-0x00000190CBF6B000-memory.dmp

Download

memory/5684-3303-0x0000000002250000-0x00000000022AF000-memory.dmp

Download

memory/6420-3331-0x00000000077A0000-0x0000000007843000-memory.dmp

Download

memory/6420-3305-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Download

memory/6420-3316-0x0000000006560000-0x000000000657E000-memory.dmp

Download

memory/6420-3322-0x0000000074C30000-0x0000000074C7C000-memory.dmp

Download

memory/6420-3317-0x00000000065B0000-0x00000000065FC000-memory.dmp

Download

memory/6420-3351-0x0000000007B20000-0x0000000007B2D000-memory.dmp

Download

memory/6420-3314-0x00000000060C0000-0x0000000006417000-memory.dmp

Download

memory/6420-3306-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Download

memory/6420-3352-0x0000000007BF0000-0x0000000007C00000-memory.dmp

Download

memory/6420-3321-0x0000000007530000-0x0000000007562000-memory.dmp

Download

memory/6420-3350-0x0000000007AE0000-0x0000000007AFC000-memory.dmp

Download

memory/6420-3349-0x0000000002700000-0x000000000275F000-memory.dmp

Download

memory/6420-3336-0x0000000007B50000-0x0000000007BE6000-memory.dmp

Download

memory/6420-3330-0x0000000007770000-0x000000000778E000-memory.dmp

Download

memory/6420-3335-0x0000000007940000-0x000000000794A000-memory.dmp

Download

memory/6420-3334-0x00000000078D0000-0x00000000078EA000-memory.dmp

Download

memory/6420-3333-0x0000000007F30000-0x00000000085AA000-memory.dmp

Download

memory/6420-3289-0x00000000027A0000-0x00000000027D6000-memory.dmp

Download

memory/6420-3291-0x0000000005090000-0x000000000575A000-memory.dmp

Download

memory/6420-3304-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

Download

memory/6848-3416-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3431-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3430-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3429-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3417-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3419-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3421-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3422-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3424-0x00000000011A0000-0x00000000011C0000-memory.dmp

Download

memory/6848-3425-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3426-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3428-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3427-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3423-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6848-3420-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/6888-3407-0x000001E287940000-0x000001E287A6B000-memory.dmp

Download