hxxps://google[.]com

Analysis

user interaction
yes
max time kernel
900s
max time network
892s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample260705-e5wh8ac16m

Score

8^/10

aspackv2 bootkit discovery execution persistence privilege_escalation ransomware upx

Malware Config

Signatures

Downloads MZ/PE file 5 IoCs

flow	pid	Process
221	3708	msedge.exe
221	3708	msedge.exe
221	3708	msedge.exe
221	3708	msedge.exe
221	3708	msedge.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x001400000001b35a-2244.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	PankozaDestructive 2.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	covid20.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cmd.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
5220	freebobux.exe
5336	CLWCP.exe
6044	inv.exe
4764	covid20.exe
788	CLWCP.exe
4172	flasher.exe
5284	MEMZ.exe
5948	PankozaDestructive 2.0.exe
3376	MBRTrash.exe
2524	1.exe
6004	2.exe
1212	3.exe

Modifies system executable filetype association 2 TTPs 47 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
220	raw.githubusercontent.com
221	raw.githubusercontent.com
219	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBRTrash.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "c:\\temp\\bg.bmp"	CLWCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "c:\\covid20\\bg.bmp"	CLWCP.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000245b8-2048.dat	upx
behavioral1/memory/5220-2059-0x0000000000400000-0x000000000083E000-memory.dmp	upx
behavioral1/memory/5220-2089-0x0000000000400000-0x000000000083E000-memory.dmp	upx
behavioral1/files/0x000400000000073d-2190.dat	upx
behavioral1/memory/4764-2220-0x0000000000400000-0x0000000001A7B000-memory.dmp	upx
behavioral1/memory/4764-2253-0x0000000000400000-0x0000000001A7B000-memory.dmp	upx
behavioral1/files/0x001c00000001db1d-2543.dat	upx
behavioral1/memory/5948-2577-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/5948-2604-0x0000000000400000-0x00000000004FE000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CLWCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	covid20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CLWCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBRTrash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	freebobux.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PankozaDestructive 2.0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276995265002522"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{256B6ABA-6A38-4D39-971C-91FDA9922814}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe!App\windows.pr	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0362-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\bootstrap.vsto.1\DocObject	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE95AFE3-3026-4172-B078-0E79DAB5CC3D}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{224E9CBA-535C-3132-9259-5AC8471612F1}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F04C-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{48E73304-E1D6-4330-914C-F5F514E3486C}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0351-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0382-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CDF168A-6E3C-4004-93AF-A3D5E3C8DCF9}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.mp4	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0121-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\ActivatableClassId	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11\Dependents	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E4C93DB-9EA7-417C-9C7E-A22A3C9B6B0D}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00000200-0000-0010-8000-00AA006D2EA4}\2.0\0\win64	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx\PropertyHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024463-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09760240-0B89-49F7-A79D-479F24723F56}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30590098-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Extensions\ContractId\Windows.WebAccountProvider\PackageId\Microsoft.AAD.BrokerPlugin_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002088B-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002099C-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage\28593	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2D20E1EA-0942-4429-8725-916EA0D91045}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{5931055E-16BA-101B-989C-00006B82871A}\11.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\ProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xfd	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0123-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0335-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{50A7E9B0-70EF-11D1-B75A-00A0C90564FE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ape\shell\PlayWithVLC\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0231-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.ui.xaml.2.0_8wekyb3d8bbwe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{69CEDC24-BC35-3354-B324-6BD5F3ECB757}\2.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020907-0000-0000-C000-000000000046}\LocalServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B21FB2A1-5B8F-4963-8C21-21450F84ED7F}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0204-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0253-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208E5-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020947-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CB-5A91-11CF-8700-00AA0060263B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\windows.fileTypeAssociation\.j	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\NcsiUwpApp_8wekyb3d8bbwe\HAM\AUI\App\V1\LU	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/json	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6AF6E882-A139-3B8E-9B1C-3315A1AF366D}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m3u\shell\AddToPlaylistVLC\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{305106F4-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxd\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DC-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.jpeg\AppX2jm25qtmp2qxstv333wv5mne3k5bf4bm	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0212-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}\InProcServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0\FLAGS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21E17C2F-AD3A-4b89-841F-09CFE02D16B7}\LocalServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0239-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA3AD8C8-6BA4-4AB2-8D21-BC6B09C77564}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage\65000	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9800F18F-3D86-4744-A7D0-540989C86D7B}\ProgID	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5948	PankozaDestructive 2.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2024	3924	msedge.exe	85
PID 3924 wrote to memory of 3708	3924	msedge.exe	87
PID 3924 wrote to memory of 3288	3924	msedge.exe	88
PID 3924 wrote to memory of 3288	3924	msedge.exe	88
PID 3924 wrote to memory of 3288	3924	msedge.exe	88
PID 3924 wrote to memory of 3952	3924	msedge.exe	89
PID 3924 wrote to memory of 3952	3924	msedge.exe	89
PID 3924 wrote to memory of 3852	3924	msedge.exe	90
PID 3924 wrote to memory of 4076	3924	msedge.exe	91
PID 3924 wrote to memory of 3852	3924	msedge.exe	90
PID 3924 wrote to memory of 3852	3924	msedge.exe	90
PID 3924 wrote to memory of 4076	3924	msedge.exe	91
PID 3924 wrote to memory of 4076	3924	msedge.exe	91
PID 3924 wrote to memory of 2100	3924	msedge.exe	92
PID 3924 wrote to memory of 1984	3924	msedge.exe	93
PID 3924 wrote to memory of 2100	3924	msedge.exe	92
PID 3924 wrote to memory of 2100	3924	msedge.exe	92
PID 3924 wrote to memory of 1984	3924	msedge.exe	93
PID 3924 wrote to memory of 1984	3924	msedge.exe	93
PID 3924 wrote to memory of 2612	3924	msedge.exe	98
PID 3924 wrote to memory of 1800	3924	msedge.exe	99
PID 3924 wrote to memory of 2612	3924	msedge.exe	98
PID 3924 wrote to memory of 1800	3924	msedge.exe	99
PID 3924 wrote to memory of 4996	3924	msedge.exe	101
PID 3924 wrote to memory of 3688	3924	msedge.exe	102
PID 3924 wrote to memory of 3688	3924	msedge.exe	102
PID 3924 wrote to memory of 3688	3924	msedge.exe	102
PID 3924 wrote to memory of 4712	3924	msedge.exe	110
PID 3924 wrote to memory of 4712	3924	msedge.exe	110
PID 3924 wrote to memory of 4712	3924	msedge.exe	110
PID 3924 wrote to memory of 3224	3924	msedge.exe	112
PID 3924 wrote to memory of 704	3924	msedge.exe	113
PID 3924 wrote to memory of 4940	3924	msedge.exe	114
PID 3924 wrote to memory of 216	3924	msedge.exe	115
PID 3924 wrote to memory of 216	3924	msedge.exe	115
PID 3924 wrote to memory of 216	3924	msedge.exe	115
PID 3924 wrote to memory of 4844	3924	msedge.exe	116
PID 3924 wrote to memory of 4844	3924	msedge.exe	116
PID 3924 wrote to memory of 4844	3924	msedge.exe	116
PID 3924 wrote to memory of 4576	3924	msedge.exe	117
PID 3924 wrote to memory of 4576	3924	msedge.exe	117
PID 3924 wrote to memory of 4576	3924	msedge.exe	117
PID 3924 wrote to memory of 5764	3924	msedge.exe	119
PID 3924 wrote to memory of 5764	3924	msedge.exe	119
PID 3924 wrote to memory of 5764	3924	msedge.exe	119
PID 3924 wrote to memory of 5832	3924	msedge.exe	120
PID 3924 wrote to memory of 5832	3924	msedge.exe	120
PID 3924 wrote to memory of 5832	3924	msedge.exe	120
PID 3924 wrote to memory of 5752	3924	msedge.exe	121
PID 3924 wrote to memory of 5752	3924	msedge.exe	121
PID 3924 wrote to memory of 8	3924	msedge.exe	122
PID 3924 wrote to memory of 1092	3924	msedge.exe	123
PID 3924 wrote to memory of 8	3924	msedge.exe	122
PID 3924 wrote to memory of 1092	3924	msedge.exe	123
PID 3924 wrote to memory of 1092	3924	msedge.exe	123
PID 3924 wrote to memory of 1212	3924	msedge.exe	124
PID 3924 wrote to memory of 5220	3924	msedge.exe	125
PID 5220 wrote to memory of 5304	5220	freebobux.exe	128
PID 5304 wrote to memory of 5336	5304	cmd.exe	129
PID 5304 wrote to memory of 4564	5304	cmd.exe	130
PID 3924 wrote to memory of 3028	3924	msedge.exe	131
PID 3924 wrote to memory of 3028	3924	msedge.exe	131
PID 3924 wrote to memory of 3028	3924	msedge.exe	131
PID 3924 wrote to memory of 2984	3924	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x23c,0x240,0x238,0x2f0,0x7ffa34f9c188,0x7ffa34f9c194,0x7ffa34f9c1a0
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,9738137004007591628,7468372465213774267,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,17944084115080552264,7420346407382645683,262144 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10690275723379296007,16754035064032547774,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16260517599305448748,1835005846642216347,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14886656187824644028,6441394033248715335,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,15857554931067564282,17174040289248186511,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,2969377581048368758,4329606084623310694,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,7274076506021947594,17593587344408825112,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2107175381374050264,14366564313117699102,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,9565182343532986390,5228007302001281107,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,9565182343532986390,5228007302001281107,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,8994244595850416716,4078955930503743371,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5728,i,3036471695579957353,2156692510864500306,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,9329542081127168625,2478282923943550916,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,9317976194123242409,12248361286191309215,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,4225556726633952535,6190815798545239692,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6688,i,167657988625710183,13778732100459074472,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5764,i,6675691531538968409,16280733642498570774,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6608,i,17921670105712406452,4188613586298777782,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6836,i,7085014456111004167,8755170501665422514,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6916,i,8149429134101719393,1559541406124971797,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,15370603257243871162,2278815435596068552,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,6370729541183221150,3928276352583267061,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7028,i,13910470276245034814,3978981172645198303,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7540,i,1932022954425247568,10843427838478057907,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:1212
- C:\Users\Admin\Downloads\freebobux.exe
  "C:\Users\Admin\Downloads\freebobux.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4BC5.tmp\freebobux.bat""
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\4BC5.tmp\CLWCP.exe
      clwcp c:\temp\bg.bmp
      4⤵
      Executes dropped EXE
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      PID:5336
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4BC5.tmp\x.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7140,i,15433807975644915846,2423513874688609244,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,6120806528369027252,7951731810093127140,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,10959216366110519831,13393687011140954195,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:5944
- C:\Users\Admin\Downloads\inv.exe
  "C:\Users\Admin\Downloads\inv.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7352,i,3620058489812234451,370059727382467981,262144 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7296,i,17971986192748822211,18382631019278632330,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,12067378413266403286,4963987119884139778,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,4569069570083658065,18423998524801705469,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:5300
- C:\Users\Admin\Downloads\covid20.exe
  "C:\Users\Admin\Downloads\covid20.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2368.tmp\covid.bat" "
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\2368.tmp\CLWCP.exe
      clwcp c:\covid20\bg.bmp
      4⤵
      Executes dropped EXE
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      PID:788
  - - C:\Users\Admin\AppData\Local\Temp\2368.tmp\flasher.exe
      flasher 5 c:\covid20\covid.bmp
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4172
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2368.tmp\corona.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6484,i,15311754206007643613,8601190492697150687,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4657726879563289215,5302485047076228531,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:1280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MEMZ.bat" "
  2⤵
  PID:5104
- - C:\Windows\system32\cscript.exe
    cscript x.js
    3⤵
    PID:3808
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,10137284052605117928,12691761929395672224,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,2510930717812956611,11911542312117581699,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,4083448678972198430,10462434142564388987,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7756,i,7588410442411689669,18138882770052161429,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,6285965326456852327,11993610641054948349,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,16670356234116814761,3114535630059382308,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8036,i,5791115528257652317,17481041656769650804,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7924,i,17642144728607394146,6062525991021686596,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,14806879112758348888,6074194517253882299,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,14806879112758348888,6074194517253882299,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6344,i,13115738463074466398,3552214488204957841,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:1524
- C:\Users\Admin\Downloads\PankozaDestructive 2.0.exe
  "C:\Users\Admin\Downloads\PankozaDestructive 2.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5948
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\71F0.tmp\71F1.tmp\71F2.vbs //Nologo
    3⤵
    - Checks computer location settings
    PID:1704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\71F0.tmp\z.cmd" "
      4⤵
      PID:6136
    - - C:\Windows\system32\msg.exe
        
        msg * your pc was destroyed by PankozaDestructive 2.0
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\71F0.tmp\MBRTrash.exe
        
        MBRTrash.exe
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:3376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UCVTSRzzkAAtUZzX88xoMdhw
        5⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\71F0.tmp\1.exe
        
        1.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\71F0.tmp\2.exe
        
        2.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\71F0.tmp\3.exe
        
        3.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1212
    - - C:\Windows\system32\reg.exe
        
        reg delete hkcr /f
        5⤵
        Modifies system executable filetype association
        Modifies registry class
        
        PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=5296,i,171521519824263376,8494426533196605427,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6796,i,2092310850423105049,11981046983991928243,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8088,i,1109006672391959364,10697094039892134481,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,17203810053165735716,7308736280519455829,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7992,i,9768092526300423998,5781228914954690979,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8096,i,4290589533721154899,16039624343516843265,2097152 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,9504550180957122346,8356559955199985852,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=8240 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,4786622973550371143,15564998449377460046,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8420,i,6355077884600997033,6029326012769036052,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,12323390530423988812,11972905134131054322,524288 --field-trial-handle=2392,i,10112299607683373598,11592861710765798148,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

8463eada-1a62-40f4-ac76-099e1a7bed0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8463eada-1a62-40f4-ac76-099e1a7bed0f.tmp
Size 392B
SHA256 3a0c243fb805c9c7b22ac13dab244536fc1f703e960757054b8c05a40381cbf8
MD5 258d3aed0b23d24100ed6c1757242aef
SHA1 7da539c0433dd1a03d00a2cd2f47c71aaadc0c5e
SHA512 76d680056a1e021d9ab46bf30f24d263c191a912cccd608a5fde9c361aa3e038457cff92c5cbee62c16ccfb50d8b06654ea4b284bb8c12889bf13490821e61ec
TLSH
T1C2E00203970400F3C01C03344693214072E3803562F20249CD0501615813A180D30F44
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f89974bb9dd61fdf7d3613ca625372eecc9326308acd9a71603384e7e7d559e0
MD5 3937309ef400682972306873f29dd2bf
SHA1 fb32d017c308429b473e60a4779589f291076f98
SHA512 83612043bb77f1a8a15ce9ab82fe9f782d9118a657f8b5114cccdb2919e805d382a93b3a686a137b88340969751499b8792e9897df39df610100bd80011fc5e7
TLSH
T1B8E0D8BA09C8C21D93207AC78164830D5280371AA3C4AF462B14CC693205A547BC2DA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 11031a34baa50edd5fd2346ef4c3d81116966db0b8804e38354b2eb6b853f553
MD5 bbb6a1c0413b68c5d9b7d3a21bc2febd
SHA1 365322d9a26ed328791decf36104224fa847d9ea
SHA512 4facc2989d1d4aa689be2fedbde19ccfe77da577131e66189d16ee1a20536ca72a5f7ed584e31bccd66b00ece0e3d82fe16be56350d899ab874d21a076ea6316
TLSH
T165F0463D0BC0C3A54321A6C78155C35A84907317FB8CCF5D2718688C2552C68DFD5FEA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 221382a8c7c6c08ced0533b4f8a0b3dee7f51af602237ecaf1b9666c506dec35
MD5 34474a5efc84a23256b2e8ccea2d990b
SHA1 c659b7f179f46696ea9e88bb9b542798d3a00ad8
SHA512 06c8dc5d74963b2165a9aad5145d78c6b297e5c5d8e0ebe8ea48b5680db075917a8ef71ac6d26064dde04f6e4b7bff4f0607d176b77daf5a2a84e124688b1352
TLSH
T101E0D8FCAB88C1AB1315FA878554C31581847235B34DEA597394B8BD5A0061C77A6DE0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 11KB
SHA256 63d4a7326c5dd341841908ee7730d5b8239abc63842793d8d8ab6cda1720fbf2
MD5 932aa714828f51873b9918318931fc03
SHA1 106b00878cf792ea8c057b50f5bbe07a9201571b
SHA512 3328ba990144c8cb4c78424491eaf9b59970acf1421274d359e18c0118e89d65f6781225acd7ffc22310bb09f4b6d2305ef2b5a901f70b7c8da714b9652688a2
SSDEEP 192:TGcROQE8XqBDQgd4Ni7HE+B6warhVZpHa5U7dabwkhI8WgRfGuWY7wWjcY9xP/v7:TGcgl8Xq5Qgd4cxAzhVZp6YdHkhTFRZh
TLSH
T1F7321C66EBB6B4E8F71B9870E8C369423174E72CD417CFA20254D83CAA927DF6E54035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 297ab1578b879558cb2d466abbff2f45bef4473be6b7a5a657b26516b41ab43c
MD5 4c60991b7bbb430d383a61fe7c217511
SHA1 42582b08a4c05b7286eb4c51a29f2e6388666e44
SHA512 23bc68c05de79f1f735af6047ce7f540f1e10ea02d40800ec57a018de71a1fded3fda2fb3c95771f60dc2781e2b1d2d43e5c4b5c3192b842af1a4630efc22f08
SSDEEP 192:9GcROQE8XqBDQgd4Ni7HE+v6warhVZpHa5U7dabwVI8WgRfGHWY7wWjcY9xP/veW:9Gcgl8Xq5Qgd4cxizhVZp6YdHVTFRgWy
TLSH
T1D6321B66EBB6B4E8F71B9870E8C369423174E72CD417CF920254D83CA692BDF6E54035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593bc7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593bc7.TMP
Size 3KB
SHA256 05ff2e82aad59511773e2b81f8e6b78e61f93f574e8c83d1d94d88cdf0a8db5c
MD5 0e5beb357a65fd37ab55a0750f2a0e9c
SHA1 617e3ef707f995553124477cf87d5b0562376853
SHA512 a2c956261606778a5ac2daf3c45621a6a4b6252f27c8d9c13622562ae020a1a0f7eae4249ea7f47e7a605e06b137c57917f49c440eca98cf669bc5dd00ecf012
TLSH
T163714D94CEB2C591F3633C32D2D371297539B6B94D13AF260344ED3C6A2AB2E7EA1144
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 126KB
SHA256 e72b623d3ef688cdf73720e06b52f7445f6b5a768013e6aa6012b1c4e1a718f8
MD5 44abe0e12ced281503cbc84ad41dc862
SHA1 01f93dc69a593d7f1e6a09a18677c586ac4ddfb8
SHA512 873ce799b63ec0f1547fe809150b472124e2481d1dffe589860e8fd2d8b0e045961c1720500af080831b373994759d2086fa08ed89ef5e432171b14a97f57cd4
SSDEEP 3072:50IKm0HFWIKX0HAGIKm0H9Itm0HUsIKm0HLIvm0Hj6IKm0HX:PAhLcAqfqA0ZDA3
TLSH
T14DC39E9573E6A81BF97F483B6BB63AECDB3139A1FC1CC48D5109AE0D0971740A910B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 384B
SHA256 7c8cefa7da4566df6214dac484ac35a6deba85bb389b0559b23316148a146743
MD5 2cd63edde4d3fe5d2ad1404e56495bc4
SHA1 f5b5163f830fcdcb6483f6c048d30beeb4933ffb
SHA512 5c7401321fdb23f5d896746b6b9922d8dd109cf9ed2dc10723d3eea2b865ba3ee70611b7bd7c89d7359f5774dd9c208653926078990c817370d940dcef3328a0
TLSH
T139E0657845CD859F625824968168BB0DA2E2361BD788ADC56B018468B241094AB9EEA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG.old
Size 343B
SHA256 8a8ddabbd11451ccef80c1d1b08ecdd8110ba89ebda2e06878a7115f914e6d61
MD5 05e1b371fd4498fcaf09d40e070ba61d
SHA1 6f12c47bdd414aab58bd388ff0a75944c7584c68
SHA512 2adf8fd5b02c2bc64de528ee75ea9653bdeaa93270c8038f4a2fa12e58da109b73cb39b32cb403cbea071d20bf1febe7f0926370e7bb19d14f29e750e14d5398
TLSH
T1A3E0617C85C4C21B131421E240387709C2A7220BD7886D490F51C814B143084EB9EA91
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 feb1174a343908d4d98515449d5efc5b44ba4699c51a0990134075ef92f5cc0f
MD5 32c2b8cd7bfb21405d951241a761bbac
SHA1 f0fba6a370110c98f81f622d3b3f410f7b314de2
SHA512 2076ad3ee3035a530cf0ecdfc277879312c6c3f5f9b02a53ee87ef8502d3562d80982f00cb1a884b80a687db4fda148921f8bbc75a585fe2c0715893d7ab3d1d
SSDEEP 192:DWpLjTZQmVW2ci1jjgvmD5T7xWOtcZt/Gtcmzj6NOBcraQmBmrmtmDmgkj44QPZ:DWpLjTZQmVW2ci1jjgvmD5T7xWOtcZtx
TLSH
T132E19BF783B1826DEA1196F0EA08AE1FCE6C0551436C386985E0BE17A3F2471E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c1b6f3dadbda86aa7f99e714e2defddf5f6f713d66c68d7e4ce04b053bdd3a1d
MD5 aac30897d0c8277b9fae74b94473772f
SHA1 c9c093c170eb79f41757941a84b9f665ce8b7e24
SHA512 c6dde4ffd7c83606af1bb2dc55611182247b63fde6e0d97e853817617d9fabcc199e6f03a123c5f385592fdf727e15a82201ab72f1360e249935d4633bf95d38
SSDEEP 96:DFOsaESPMvmMzBwBjd2EFvmOlmD5HzGOxRUOtc0FDZGtcmxGmnBmgmtmu:DIsa5PMvmM1kjd2kvmgmD5T7xWOtc0FR
TLSH
T12CC19CF783E5826DDA1155F0AA18AF1BCE1C0552436C3C5A85E4AF07A3F28B1E152B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a2eb08d00d1a2c908757b982f5ce814581cdf29b297e914af97c9c3b6126c65d
MD5 9a5df60b10593bac4baa0edee5e00fa4
SHA1 f047d73b0944c8a328fcc0b3b898e49aa871b1df
SHA512 28ee5eb90636898dc0c1e0ff151e54c01b9f20887b205a1a7fd243f5d0b4d474583e20968030d0dfc5ab1f23e6ace008a587521bb44d4cb1f897041255080b2d
SSDEEP 192:DWpLjTZQmVDbn1jjgvmD5T7xWOtcZt/Gtcmzj6NyFHbLaQmBmrmtmDmgkj44x:DWpLjTZQmVDbn1jjgvmD5T7xWOtcZt/Z
TLSH
T16FF1ABF783F1826DDA1195F0EA08AE1FCE6C0551436C386A85E4BE07A3F2471E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e4dc8ec032d126727183df13a2fa5c25c5e9fd0dcfe14fafb87a4c51e5c855fb
MD5 ce353612abd6d97f8a033b2874fdabb5
SHA1 059bcaf6d830052df54b37b16b96c92a17162529
SHA512 03d9e27b5e1fc802a1682afc6be86bfda14d62e02c5f7b4250f9168fc1b06ccc1d8b2f4b0a411bba634c9bc4a30e99d152fd3e42cc188de4c3cb09f6885b8e3b
SSDEEP 192:DIsa5PMvmiDbd1jd2kUmD5T7xWOtc0FDZGtcmrmzkj672yFHbLvmBmgmtmu:DIsa5PMvmiDbd1jd2kUmD5T7xWOtc0FN
TLSH
T14A029CF7C3E5822DD91155F4AA18BE1FCE2C0951436C3C6A85E4AF4BA3F2871E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 6a3fe93dd2a7a965e42bc24091b908c962705c227f9224f5d15dd5221d0288f6
MD5 9d2c0728967a7d633048733c5d5ef80e
SHA1 cbf59c8dc30f4b9c34d1fcb711410472d2a90f25
SHA512 88f187faeb32d8db823d6a21e1e42bc43e6623d4d5affc89f21952c42a0e9f1c86bc9e3cca5891455018fda1653067bf7542848e6e3b6907dd6f2a6e364069df
SSDEEP 96:DFOsaESPMvmMzBwBjd2EFvmrmnBmtmOlm5G5mgHzGOxRUOtc0FDZGtb:DIsa5PMvmM1kjd2kvmrmBmtmgm5G5mgE
TLSH
T1D8C19CF783E5826DDA1155F0AE18AF1BCE1C0552436C3C5A85E4AF07A3F28B1E152B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 b47d97789e4a5189fd07f335ccce341a78d04d73ac8771cabb5c7305b3751eee
MD5 68e8595879ce06e058e54e50cfeeb0f5
SHA1 e5290a11b7978a64b74c62de66bc68ce88fd98cc
SHA512 d1f464ad96b71c8530f88726af888f7bd69e3628ea3051851333eb8dee01858719a7c7975962d05a199b2f4bb89d95887bf5bd8402b6e93307b9ad281054edfe
SSDEEP 192:DWsa5PMvmiDbn1jd2kUmD5T7xWOtc0FDZGtcmzj6NyFHbLaQmBmrmtmDmgAx:DWsa5PMvmiDbn1jd2kUmD5T7xWOtc0Fd
TLSH
T171028CF783E5822DD91155F4AA18BE1FCE2C0951436C3C6A85D4BF4BA3F2871E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e8af4a72d3465e052e628c4248d0cf025d03debfeb92802dd83cd84454a909b9
MD5 bdac3eb73587489573138a7839920fea
SHA1 024f19252686d0c709093abe64231dee5ef3ca9a
SHA512 342aa075ef9d88a0d50fcf9852a7aad937138ac5675d93338c5a791e8eba7b6c35f08a805738dfb6c32027ff69ee14b2ee44d0ed92dcff66cfdcd21ac474e4f7
TLSH
T18FD0A963128421B9A9683A8A486AF88E8B6660280883DEAA10D0A9A8462186C4B0B180
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58d869.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58d869.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ae8259d068336495427ec06e0edb2140b63dec4f286fe5fe297f11bd6134bf02
MD5 4bb75266b66eac00c52649c9f29911de
SHA1 a283ab47699bec0066185e614aca67f9a3f15d17
SHA512 4e51c1e9d7602485d71ded50a916e8e20cc92d3a8214045fe466b4b71e68b7a59713cfbc6c55faec82528df8b63af3822e485a058f1718392a9034e188c1b3fe
SSDEEP 192:sxZrRJyM/jK1Ml8MlO/ffsIARmjiUIdpJHW6+WNGYLlyhVIgrJ:sxZrtdO/ffsXDNJHbGb9
TLSH
T15842F8166B345977CCCBD209FA55BB53D6F90473A2900E48A9FCCA0C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eabf45d2965c20c7e3232e918c50304fe6758fc7276e4f0bdc68512dc417c5cf
MD5 34dacd800839de364a729351c41001d6
SHA1 4c603a3e99317ce166a485342763a7dc585b5d7a
SHA512 48c4a8818ea8cc22703ce45b2bbaa162da8a15b1e452981c87b38612db5d31faa69753c5908c927b8c0f47d88b9442c3228b1320bce5617266b74f58b87f67a9
SSDEEP 192:sxZRDU9NRJyM/jK1Ml8MxOO/ffs4ARmji7vbRgPdpmiHW6+WNBqX/YL12hVIg5RJ:sxZ29NPJOO/ffsnDZsZHbi/vF
TLSH
T1AE62F9126A345977CCDBD219F901BB63E5F85463E6940E48A9FC8A0C05E6BDD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6aa1971a067ed056607369b88bf64d4b86feae4508071da06046b625bd22d466
MD5 379931e0823602c2f19d82f7451b9d5b
SHA1 6139aeb239b821524be853fe63e7378122cac82a
SHA512 78b2697384a74948c934f32a2e29b8102a359ef4cdf25f59b34f1cf03f1a8570b097c1faeb67286b460e81781752dffe5f94f6588db58b7c6dd6fc8a6c9bdbdb
SSDEEP 192:sxZRDU9NRJyMojK1Ml8M/cB1O/ffs4ARm6iWvbRgBddpmolAHW6+WNzMMkXYL52q:sxZ29Na3m1O/ffsnQwqOHbUXlG5sRd8
TLSH
T15E82F912662485B7CCDBC219FD11BF63D6F854639A550E4CA9FCCA0C05EB6ED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 64d05bbade51c7381df848d46c1b45466dc2831e045fef1c1038bafc7e4b7c44
MD5 e89177dc57b00b3896b5374ae6351775
SHA1 d6d23eb8dbb4a93d7d9eb03676bb05b00aecfdc2
SHA512 57f0811d8e1d59aeb10c82734559e8b3ebb02a23f9120efab762c7ba22579ca5b8708658aa70e5f7934b207df6600a7d136ed596530cd36d2ec1a7fc455a333b
SSDEEP 384:sxZ29zFqbm4O/ffsnQFoRyHbDdWXcw5sRd8:sYzUbm4O/fIQFRHb2Ud8
TLSH
T10B92F853552049B78DD7D11DF965BF67E6F80462EA804E88AAFCCA0C01EA7ED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 14592f42b0bf4f3a4b0e334a4c981b6fca1672e90b2c2339b3650d0ce560b428
MD5 bb696baac02c1b55e51a17037144e753
SHA1 49015aab4087a658cf0f779cf93e23a5be4652d9
SHA512 106af74e84e58b9fa8af4e0d7270dd938862b2d9704b75c762666cb9a39dfd2bf0e53026ae0a618bf3c1be71c1a06b88e406dd5d12b2c76cf6383c0a121bef85
SSDEEP 192:sxZRDU9FBRJyMojK1Ml8M/cB1O/ffs4ARm6iwvbRgBddp9LoKOxHHW6+WNAOMMkG:sxZ29za3m1O/ffsnQaqyHHbEXlw5sRd8
TLSH
T13B82E852552449B7CCD7D219FD61BF23D6F81463EA814E8CA9FCCA0C01EA7ED221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 db2a50025ccb7b95bc840896547f3b1581b51c33fb29f661aee4deb98375a75b
MD5 d2fcdd1140652c78716393297fd36924
SHA1 f7555f213bd632e8b373bf2f4dc1a47be8bc4916
SHA512 374ec8ecd8b978904decb0a28b9f989dfd9d63fa24a16558d1f1fa12f2d011f32dee799e4c8f8a73a1392b4827d20f5971b8dc24454cafe4df2637c24cf258ac
SSDEEP 768:Ies6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNPromY:Ies6pD1WvxzWju1jahILIsNcmY
TLSH
T10AD2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\70599668-79a8-4baa-bc5b-42404e70b9c9\index-dir\the-real-index
Size 72B
SHA256 7ed89da1805f48204e0edb3bea006b890657f0c8d11981fa8c4d45445fca43e9
MD5 4dd91af94c444b9c76da5610a0e60af4
SHA1 6089472565d1efd212e4118b2d6f681f22e79c76
SHA512 cb9ecb5ecd684ba8d506cfe1eee119240034de936f3caab0fef4c6e120c78e3f4223a0d2cf73d0f064b4fcb5a04333430c63895f299e84c359a8633a071f7816
TLSH
T1C7A0023073F54565C50546B8914615516B54DD152E4EC7074DA04C55C9591A84941074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 9571c789978f85f9887147fbd1fbce92aa2c3c2e58e960181b62232fdbc4681d
MD5 69a63037db50cd81dc023af4abaac615
SHA1 e4237822772276c519e74295fa5e5bfeff7da156
SHA512 fb5fdc04e4de1ebeb052b15292c8974e3d4512e4b5d619f494e55a8343335c44db3e5804dd3e9211e602474e74468f4d4a1e043aa08c69b980ce7df4b98423b1
TLSH
T16451C90F4E46591ACCA8127568FB14D5373AECCC6B888B1B20EC6839BCCB739141536A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 2KB
SHA256 c6558fef860a3726ba33e07fd569717240b1801f8db94edaa2cdbb88a8c9bbf4
MD5 57e8d5b29c0102d1e6bf302cae67a738
SHA1 24d960037c05b6d2e2b436e2944f1b67a2a51d44
SHA512 70b0cae463eb87b3b1c72577801eee9c12c6688076a55af5c62a240635404339f0ef9b276e68e0038993289a4d6c066a7fe1b254868b879aa809fa3290c41c05
TLSH
T13451C64F4E61995EE8A842B314B364903374DCDC1B55972368EC2131F88775A290B7E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5854a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5854a3.TMP
Size 2KB
SHA256 1e989bdd97be0d1f245c83afa76e674c6fdcc5f509c6d4dd02171173b195521e
MD5 64f9d003f1d7e0e37d9c50302f8ebb16
SHA1 a9a63f229060310d5f4c9c6408e175bfcb3b88d1
SHA512 39eeedcac2086d3339fba53e09bb0221c04284b4d4dc4d635744d66c7af41c51123be6a053e2550f1dab4edf508922fd00ad41e57a25dcf1e0d7d22d941a6bcd
TLSH
T17F51955A8D424639E8C4417709E3A4B4373925008619BF5374FC9636ACD27AE3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0001d87-2b05-4c73-a06d-465dd05eb75d\index-dir\the-real-index
Size 72B
SHA256 df63a297124a547768c4a3a6e4aabe68ef0a32880bad1794c31ac1d092729b29
MD5 604cd3b3af582a3e574a068b767eae4e
SHA1 665f3369ba8cf60f3e8a34060509bd5ae33f381a
SHA512 a4ff960184020ebf7021786cd4673375d5e116f380392bb11bb5730c1a99769255279aff03593df7dd17dc6968a3501dcca447d889bb66cd270e6481d493c8d9
TLSH
T172A00222268F0C31CA0203B6544792C922144AF45345736146ABE1F9FD502C55381300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b0001d87-2b05-4c73-a06d-465dd05eb75d\index-dir\the-real-index~RFe592f92.TMP
Size 48B
SHA256 1fe36506bc369c21718bd41d4ce1d4faf5ba83895e78eb317540016ac7ec0e99
MD5 7c7c239a24f697e294c566ca281d55e8
SHA1 b1f10b38ac584741ac01467c89f91d4fd090282c
SHA512 b834031644bb22d114110dc6fac35d14bce2b963c43bfb30e7e54d24b8c5fb0749a3524cd74a25f7a50afc982bf8759d615de6cd6ad68807bd68531ee96c0d1b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 09aa1d2185bf97e3312728e5b416485b4e430bde7f298b02778c1870f889367a
MD5 6db2603f5ef5ebbc217218dc5f70a659
SHA1 8305dac3721681fbb778524c2b7ab41ab5f4b510
SHA512 eb127e55f4d3905fb7ccd690e6aa9d09db00bf383a8018e7fc820c1953923e54c29f8c884c13677be6e57e5c96fedcc332193233e7a1483611ab3dabeae4ec75
TLSH
T128A00221CBC03005C05213F3159313816304C8D05200634B40D605E8DC514404DC141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 3779718a4773b67e02815b20f2ccb14373b82c1b588c83c6a23e980b5051089f
MD5 45eee3e04caaa5ba00eda77ca4a7642e
SHA1 6c751c59b7a513ff989abdd45fe50f79e7793114
SHA512 2f3134502c2118418462d7b2085e6b3e7cc31005520763fdcbf57b188f23c94e210e935baf426628a469a312aa6a0bc9a9cef54479ad8918bbb80c0a15bbe828
TLSH
T1ABA002A60680440DC12613B425E60165A22ADA291206D39981918154D8505954D6500C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 9ec3aa3f47d1c98570022a73fd6002c3d6acb667d209956bc43405f3462a3a84
MD5 93a91bcf91a0e5fa73d918829a09a088
SHA1 2823b0050312b612ce16e30139c1bdd48ee656f5
SHA512 926a5466698b90aad6f497cafe13b968fd4ba8c2031ce6480f7a855bd26a274007689f642463c48496d4d98f4f1b0947229bb90e39d32f9739c956cfa36fb87e
TLSH
T188F05CB77FF72C14FCABD3E62430647501453C2CC825FC0F581AA79390B0225385AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 500adb5e8044670763baec4192a721bfe2bccda0e32daef844706aff57ab469a
MD5 f8f4b5abecb2f26a17f400956ac624b8
SHA1 a620ff9124e652a52d8112cdb6c4ecffc9b24289
SHA512 d42055ab556e8084f657676747d5379c53a356bebeda2e1186c7e7dce95bca5413c9e0d1eba5c52f22b3ebea0ca75182a1d345b06bf8ac28ec5370bdae8c6a0d
TLSH
T13FF0E2A77FB72814FDAB92D62430646205453C28C815EC0E581AA68290B0215785ACA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 10bd3f62854438778b317102630984f9af3006d0de06f226803eb6758eb77d07
MD5 778b528a12e137bacdccebd27a2e26e7
SHA1 e3ae0ab2585b3e068db23c15980a850b91da7f19
SHA512 339bec66a681cc0820b13d48751ea247edc91e4a8484d6d17f0c0e686155905d80645c8f1729ab7431262532f9d2eb9aca9e27cb1c9fd696ad29f621cccc00f8
TLSH
T18DE0DFBB6EA76820EDABE3E72870A4B50281382C8805BC4F686A9AC350B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d4a26aefc2f52b6e46b13ca10260c9034140c7e42a033f3e5268c6970785a8cb
MD5 22caaedb371672378cd293db5d4a74ac
SHA1 6212afa6d1ab9446d3fd14ba73f119c0da0a23d9
SHA512 7f703bb4a408e565e941d5ecd7b2d6cdcdf48ee9ce79edac0392f79c8ab46554bb9808e6bd5243e89bf1c03c2c1639c287167c2b894991967661308df171cbf0
TLSH
T11CA002A2C25A0851E0000370B4810596E212DD11560E636347B455E6B86A1418612524
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a97a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a97a.TMP
Size 48B
SHA256 9a70a2edbc8eeffae7bb63a16de20b59078186c3823e6a2267679ceeefa3aa65
MD5 2c6a7b8468440095c46dbaf7aa4adc13
SHA1 19af994d3dba8b185a2446697037d047637595cd
SHA512 830fdb10832cdd1dceca8f858c6c8148aa3428bf5d90f2cd489f46cfc64fc4db9af544ce3cf80e9aec29108fb27e4c8ff8c01331470eeb9f99f3301422804c93
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0f62638dfccbf8850afb4951862ae8bf91cbb4c6df39881fc5042406cb32d703
MD5 cde86919adce8e4fc96ab7fe6a315591
SHA1 bae2a31c28bba67c5b75c919aa62df95aa78c500
SHA512 9d6de97ef206d97bdc6e9c2550653794c7623b2750f341597915d15a9813d7d3ffc6bcde527a903ecfceee128907d546ee06b87be44f35e7f4016426b0e21e9a
SSDEEP 96:KUAAKtePuV2Ku8SKy0K3KE3SKAUeqooK52HqP2qcF:iixdf+Zj2qP2qcF
TLSH
T144E1071232BB03033C3E6948A2558B274B86B1633118F42B7BE905B51E67E355DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590e9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590e9c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ee22f0bbe16658cd5ef986524c1b5addbc2d1989d2bdbb9fe0e48fe228c63f24
MD5 b13a98546c703cdbdd1bb5e08cef435a
SHA1 cbeddd155dd3d33fffb9ece87c99cee842b36589
SHA512 eb61f193eb47467bb044ee5fd005ec96339a09780e6863e4caffb4da8a29ecebe5c7e15aec283147b43a0c52dbc8c88321d4ef8003ea3e547b104827ecaa64b5
SSDEEP 192:uSrLsNSjQuTWc7+3v5ZmQmiU1BGp4atb0X+FA42YyuNaLM6qctqU8:/XsNSjNTWX7CK2a91AlWjtU8
TLSH
T19C3208366C386C675EB2E145F54736139FA4406BAAC92F90D6EC5F0C01EF7AC235A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 91a3c7ccb6bebfafc953941d4e625a63c5a6ac28892a4321fc9c86325e64683d
MD5 7cf49d6edca77b0c987f1fec3ff8b1b1
SHA1 64dd8cd3b19b6c4bc9e844a94a82e25972ae833a
SHA512 293af7e9922925a839cb83c4212e4b421eb4ae3e248820a74b66d6ce7df62afa72d46f55f829b17958fd011b36283639d79c1649646cd298bd77e981d60a5e46
SSDEEP 384:FKiF1tNn/s3n9SqzsNq8TUNTUlIleTITWX7e432a91AlWCtOObjI9G6w7Nt:FBF1j+9R3wggF337ct29MNt
TLSH
T1E7C239F248D78976D9AE8743B77E2D168EBCC067B5812A40B3D85A0CCD9B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0c2d56b2abd82d9e46cccbad6247969b7ac03727479f220e9ad53c017a989328
MD5 eb83cb2566cc64963228020a6a406fd4
SHA1 40f88d69b826225f7c675b23b01d3c3306c0210f
SHA512 bfe3fedc9f291d60a6382113c28f74d6b18a410dcdd77542335dadae7f6cde8272fb6eb191e75dd81535a0f833b8b08c295649a9b35f2a066aad83cde01a6ebb
SSDEEP 192:uSrLsNSyT9uTWc7+3v5ZmymiU19G38Batb0X+FA42YyuNaLM6qctqU8:/XsNSyTITWX7em32a91AlWjtU8
TLSH
T1564209366C786C675DA2E145F54736139FA4402BAAC92F90D6EC5F0C01EF7AC235A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6cd0e9cc04b50b6f9bc64775e13ae011db6c414bea639a078bb0fdef42abb365
MD5 de31d29c20cf4d2bb3e47f12f4c058dc
SHA1 f06f2e6404d632f20b98300955ad28507b1ee999
SHA512 4ded02b317cc573f8c8e6ae7c0bbc00ef17da9a38a3b7e3fb25b299ac8def1c0385177ed3c2dda58e7075dfa8882413e8d29a1d2a343a3fdb311bd0ed395125c
SSDEEP 384:FKiFVtNn/s3n9Sq7sNd8TUNTUlIl6TITWX77432a91AlWqtOObjI9G6w7Nt:FBFVj+9pCwgQM337wt29MNt
TLSH
T1A8D239F248D78976D9AE8743B77E2D168EBCC067B5812A40B3D85A0CCD8B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f6376b2502270da3a34a89c4e315a8a9ff6a2d161b83bd820d11fe6c866e4e96
MD5 0e81d0e5a6f183df8944baf42b5f2fba
SHA1 2d49f139eb29a9cc8b1bbabb87a880610631b0c6
SHA512 17db2075385709c71ca1778b240edc395c5b649fe3dfc0d71cab82869f2af23f19e5a797ccdce1297698cdfc7005fd21c179bbc5f2ad6e764dda941bb00b4c4a
SSDEEP 384:FKiFltNn/s3n9SqLsNd8TUNTUlIl6TITWX7/432a91AlWutOObjI9G6w7Nt:FBFlj+9pCwgQw337gt29MNt
TLSH
T1EDD239F648D78976D9AE8743B77E2D168EBCC067B5812A40B3D85A0CCD8B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e756face154e621dedd296f50a9b6fff1eda836c3c144e6d1fd1cd0fac1f3584
MD5 abbffaae7f8ef4287ce0ed10181f66bd
SHA1 d5d44e093821d58eeade54c48eea1f94211d7d4f
SHA512 23d5b1f2322279677c858f236b303a0602a7c17ccd5d68821f0289920fe7b66d6f54e747deafb3bf998ec69491ed3663ba2c6c2ed4c779f2b401fa168390a7c4
SSDEEP 384:9ftNn/s3n9SfsNSeTITWX7eL32a91AlWjtOObjI9G6w7Nt:9fj+9U4E337tt29MNt
TLSH
T16B929E366C296DB74DA3D545F58735278FF4402B9BC52F40D6ECAF0C02DB6AC631A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ccfaf2f685c9b18b45e5b022411928ed7ed5ff5b21921f22322ab28322482a8e
MD5 af5e007cdad396bbf550d5ed86ce8f08
SHA1 7ca4887baeca988041aabbdeb28dad2dbadbe5d7
SHA512 79642d9b6912d1f44abb29577f886605fc1d5637d74ea0c2a5377a885c2dee64f4cffdc4ac876a59720befacb5dec0afefbfc9d4f07bfd8728d92d1a0bc09d31
SSDEEP 384:FKiFKtNn/s3n9SqCsNq8TUNTUlIl6TITWX7f432a91AlWRtOObjI9G6w7Nt:FBFKj+9E3wgQQ337Lt29MNt
TLSH
T122D239F248D78976D9AE8743B77E2D168EBCC067B5812A40B3D85A0CCD8B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ddcd36e7ba0c2b6b988a3827e06f826cb6e3a4744bb7bc38aad3c8c52fbe76c1
MD5 4b2f8fe9dc1f3e29edf278d3b94cd73f
SHA1 7d662ddf6b9b647d4c7d9f49e15068d3bd722ae3
SHA512 bfd7473364095c85ac1c2ca5953030db774c6d63daaa91fb18fd8ee0535a4d5483b2e5b5d0efc7fda113b81c6d03b2994e679995e48577233ed6f807e4667017
SSDEEP 192:qONc6O7+3hQmiUyrdGttb0X+FA42YlgGSAU6:qONc61WGt91AlQzU6
TLSH
T16902C8356C786CB78AF2ED46B5873B235FA5103BA9A52F84DAE81F0C00D765C2346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 26d9c765f53ad1333fa7e481acfda7ddb472ba3ef47087e30d4428fc5ed0894b
MD5 dac8aec340e788faeb36dad6c65aa433
SHA1 1b2e099fff56056f8034d89e300e44871989eb97
SHA512 6e956543beda86eda2d30bc5b12eb2c28cc6c7bdfad9106a16767bd39b496a822146e2381181d6cd074a13993296970c764bef17e09ef2d7a8c09d8f7b200bfc
SSDEEP 192:rRONT6O7+33eQmiUy4dittb0X+FA42YyuNJcN6qctqU6:rRONT6laTit91AlWetU6
TLSH
T182120C366C686C775EA3E545F48735134EA5413BEE8A3F81D5EC5F0C01EF6AC234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c71f87320a25588c5d38a69eac49282d30121382bcc05db5ca25003d3fb99990
MD5 61aa885ec1763050d3ab75cfe5c815fc
SHA1 c99a0609d47d1b1fd40e3838f73a3517f002e582
SHA512 34f31bec82ca8c7c6d7b175200d360641dc81dcd07a943edfaf4d9fc22f28ab1e486c81c3138d742ff5abcb06149a395e31ff5abcf5db7fa7048099af69b96d1
SSDEEP 384:FKiFutNn/s3n9Sq4sNd8TUNTUlIl6TITWX7m432a91AlW1tOObjI9G6w7Nt:FBFuj+9qCwgQN337nt29MNt
TLSH
T14DD239F248D78976D9AE8743B77E2D168EBCC067B5812A40B3D85A0CCD8B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c2b3f1499c0739e422783282611a3aec763ef4db27ffcf994f3dec6b41bb5305
MD5 3642a65b075164be9d50b38e227f7f18
SHA1 f843c026ee82a2026a8e501cfd3c5a65396a25bf
SHA512 ba7b117b2facc478e72b15a45bdd9311ee2e437729f39a133e72e9e485c4e9ffe3dcee8cf6ceff1dda876fc0f0b4109af4937299486f3b3a221486770a6407dc
SSDEEP 384:FKiFQtNn/s3n9SqdsN28TUNTUlIR6T9TWX74qaa91AlWUtOObjI9G6w7Nt:FBFQj+9D3wgtxb7Gt29MNt
TLSH
T1F1D239F648D78976D9AE8743B77E3D168EBCC067B5802A40B3D85A0CCD9B1BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f96f3bcd42a96121a51ed47c016771c2ebcdf346b3b0c073b76036bddabc0aa6
MD5 28dabbfad3cf0fea55789eaacbee0e92
SHA1 90f67ae96ffe169cf040e8011df61ef83107dd10
SHA512 9352482dd3af649ff695b1a67b9cbac636c6c6248cc2f3229730cb4e9daf2fd3707d5c85e01adea70e07347d6ee7b15ac7d7b9722db6451c76792e7e6807f56a
TLSH
T1F6E00103A70514F7C028033446D36B5077F3D03563F3038B8A2501755C23B182E30BD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 90d594f02756461d590238b57079ff5b23e2a5ebbe9a636a909cf34df0882d44
MD5 64122f840398ceaa68db9ff2ac0d8aa4
SHA1 913e0ac288439271db4fe36445e15e87622ce7a7
SHA512 07dd6acd242852a53ec13a74335652647c2227471bfcaa7d76cb43195f7abb4cad09b33e27e5b2e84407e97e3f9c6e579deeb5e23ca78bd3a64e86c382a81128
TLSH
T174E00103970404F3C018033446D3224073F3D03563F3034A890501715C13B180D30B44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3b4b9433ef387b30383e2e040ce1e6caac40cb1c0e0ea8a55ce1c733d8ad3bd0
MD5 24afe28fd47bebf4d56e2e1c477ada5c
SHA1 443af95176810fb05040db2b9743afc534eef0a3
SHA512 285a74dacc1b556626485fbbbf3e4bee773404c90788567f482ba46e6158264a8505a896b60b8fc1e5467dca4f16b8db5d5523317edd03e213ab160d0024b09d
TLSH
T164E00103E70511F7C068033446D36B5077E3C06563F3038B8A2901756C23B182E30BD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 163348226aa40435f696cd4dcdfcf74a275381d0cfb7dc5524a32584f3cb2f89
MD5 d9fd03b0c68d9658ae44600c59bd54fd
SHA1 d5e6d756ebc04946989bc7e740b6f6ef0c1f05fa
SHA512 ebed81488d4425ffc729195ec2f21634ea83f02bcf2ae4f12f640a13646838a889ea136cb019483f3e12fe69d15a1a984f849f80198ad96012f7de9eb9af09da
TLSH
T188E00917A70581F7C0A8133446936B5077E7C065A3F2038B9E2902656C23B182E34FD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 95cad2e985b3e2231ef294f04f17a97bb4b42b5b6e4369eb4f40734dbb44d0a7
MD5 7a946082932eeaffcf96446ae7301219
SHA1 0f7752ac09c02df280fc6a6f416641685c552799
SHA512 4143121e7df87f9e0151ae211843ad2b477696b0b7e392a069ddb2ef2da802e7ba14c619cd5dca06f2dbf3de98c721b8d68c08ef563e757c4c63cb00df58095d
TLSH
T1B5E0010BD30280EBD03C033401C32B3423E6C02163B343AB8E2002656D13B182E30BE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3a5e9724f2c5f872403568f7877a4a889bfaab80a66528a1c994a2f3f04a1150
MD5 fd4c3366d74c8d2abd856ac69e074b68
SHA1 6f53fd862f6b0e34afd08cf9ac52eb69ca33bc91
SHA512 3311d17057213427eb82cb68799605ba2ce3c1e2ce33e8624d58216156259ab67c1838e28fd87536ca32357450ff2d8d4baa76635d633af73937c0be4d87c94e
TLSH
T135E00107D30280FBC068033001C32B2033E6C02063B3438B8E2402616C23B182E30BE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8a2a867964829c0b6728c16ee26039b1b037d5cd27fbf4b373750850e47b6aad
MD5 7d02880d6793220e1834285dad6d2ff0
SHA1 89b7d252a9b409688d1a6e3680ca88e713665b9f
SHA512 955efd5f2f717eca0ad7a2a5dba5740a90efff85a38dad0ffbe28b0bd042bf52632bdc9421924453089417deee65dc13e66a978d7f032a092a093f23b8a618bd
TLSH
T1E6E0041BA70581FBC0A8133456936B6067E7C065A3F2438B9A2912666C23B182E34FD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe594d4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594d4b.TMP
Size 392B
SHA256 763053baa737828d42a97dfd3b017629748c19e354e932c2d6656299cf0e1492
MD5 aec7f763753afbf8fbd83d68d06a37e5
SHA1 552ff15c83a81756620f02622843be1e73e11e41
SHA512 c4f0ce03d19f8d46511b5797872f11121798064eea58c7a7aebf5a36368efa1dace4535f54e7088ca9b9eb1ad9032882a859c727b96e557a57c49b28c4fe93aa
TLSH
T1B7E00403570400F7C01C03344553315073D3C03551F1034DCD0401515C13D1C0D30F44
MD5 SHA1 SHA512 TLSH

Submit Download

b44f5d6e-405d-4a3c-bae8-d8cc2fb8169f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b44f5d6e-405d-4a3c-bae8-d8cc2fb8169f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e888e6cd06fb6ed21445d54fbbbddf05306466b98fb42aca2f115c045e86bc1
MD5 d6284491b6ca14fd51a870f58330ab6e
SHA1 c6eca0d4b2a84bed7abcceec8450371dae20b6a0
SHA512 107b1199ce012a36ca9bf170bcb98b3433aa9a90280ec8ff547b2b6f4bafc9572d42ad0592bdf583535f72b18d35a2294b8a6693c6de6b0405ec211f14c605b2
TLSH
T131413B98A6FA1158B3B37F1AABF6A46D487B79672F0AD55E00110E4F0523A40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

bg.bmp

Path C:\Users\Admin\AppData\Local\Temp\2368.tmp\bg.bmp
Size 21.5MB
SHA256 d8f864128f2a79e2ff8179255ebfd06619325fec86103722b6418c3cbb41823f
MD5 cb065726febf9c1a581f3008e678f524
SHA1 f9a0058a57213cf7ce72eddf0616a938c8f4f4b1
SHA512 b54a81cff5951b34478e777bc27cc4fd4a292b548f38162602c01e2594848e40fcfea5becfd789153c9a4fa75c354834a3a37cf3032c9857e9246bf850d24880
SSDEEP 196608:qrw6AlPWBud7HQ02GstwRwYmRy45ADq4DtZMUUBlXXX4Tb78wA4Bztp/4Zmfuwtd:qrwllPOqrQ0nstmHvMU2lXXoTu8lB/
TLSH
T15237FAD25464D70AF49E072D105633AF50F8D572C9AE80B3ADBE24CF1F684B6522B4AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

corona.vbs

Path C:\Users\Admin\AppData\Local\Temp\2368.tmp\corona.vbs
Size 130B
SHA256 82ac48c4f7edbab182aa0a8c320d5616ccdd2f0e83dc733b91e45521f85462a3
MD5 e61624dced063c4ba5352bf487f12410
SHA1 40bd08928900cd97f444ffaa78d93dcaf913b274
SHA512 2a27db12d2af35e7b51a307eb8860800075867922d3d63a69da608c96bec045f3c64ac757674d2a40d7f4d9e55179fc2bddc17691919e18e109a5d4669c607ac
TLSH
T1B9C09B61A35450D5158D13017C92C825111425CE7200569D3CD5114D6479097D6729B0
MD5 SHA1 SHA512 TLSH

Submit Download

covid.bat

Path C:\Users\Admin\AppData\Local\Temp\2368.tmp\covid.bat
Size 445B
SHA256 2c68caeada2c251c5fc12694b7288a5790114ced4142867179e75d313efaa50c
MD5 b08e02e536917f897acb2d21f42f0a97
SHA1 a078f1addfd3eeb0f0cb5fd206ff78e9dc0f3e45
SHA512 1d1901c3c676bb6d99a39d1a0bab1a6ee378090390bb5e7fe66cf754b8dd772ac0b79ba1215fa758445db1deac200afcc5e1e1e32b2562df946c82b530ca95ab
TLSH
T127F0EC02B790D0401A46FD06F977F77D745423CB73009EC83ADB508C4A7635879AE9E0
MD5 SHA1 SHA512 TLSH

Submit Download

covid.bmp

Path C:\Users\Admin\AppData\Local\Temp\2368.tmp\covid.bmp
Size 147KB
SHA256 548c9e22a04650efec06a0414d205d24600e08e0fac1beed7e8b4c03730962bb
MD5 738bbd119d8877f8342e1ff00fe60dff
SHA1 fc11d85e3c5b46bd877e06985fec1a601ce396ed
SHA512 f7a12c9a1403c9a1953387c5871d6e7865ba80c405f37c51f5c3e093bab9235b8a8ba62ad8b27f2079407e9672d47ac365c9cb08033ef349bd8c9906a30fefad
SSDEEP 3072:0aszBvivs6aeVjlvlayUf79lly18t+uFsb4Wypn:GzZTePlaVf7nAU04Wyh
TLSH
T190E3B8D16F5DFF0273CAE824C2FEBECAC8D674960B5656B9F17CB14A830E6A0455D202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flasher.exe

Path C:\Users\Admin\AppData\Local\Temp\2368.tmp\flasher.exe
Size 246KB
SHA256 30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
MD5 9254ca1da9ff8ad492ca5fa06ca181c6
SHA1 70fa62e6232eae52467d29cf1c1dacb8a7aeab90
SHA512 a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a
SSDEEP 6144:/85Z+Y97t0Kc0Nd5bHzvvj/R87Z3BxonZ:/8vd2KxNPjs3gZ
TLSH
T16B3412475FB40175C85B39F248EE6A3052EEB13B40E2C32B2216479FAF4AA41DC0F667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLWCP.exe

Path C:\Users\Admin\AppData\Local\Temp\4BC5.tmp\CLWCP.exe
Size 505KB
SHA256 13b4ec59785a1b367efb691a3d5c86eb5aaf1ca0062521c4782e1baac6633f8a
MD5 e62ee6f1efc85cb36d62ab779db6e4ec
SHA1 da07ec94cf2cb2b430e15bd0c5084996a47ee649
SHA512 8142086979ec1ca9675418e94326a40078400aff8587fc613e17164e034badd828e9615589e6cb8b9339da7cdc9bcb8c48e0890c5f288068f4b86ff659670a69
SSDEEP 12288:kDupRTrjf1nJp2NLtVu4jPau4p+lE3dWq:SExrj1DAt84DaTU4dW
TLSH
T1B7B48E61F2E14537C1671B389C6B62A89D36BF103E2879876FF91D4C4F39781392A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.bmp

Path C:\Users\Admin\AppData\Local\Temp\4BC5.tmp\bg.bmp
Size 3.0MB
SHA256 13ff1d9aee82f15e4df8621c0b68ca31844bea8a0a5e5b194dfeabac7a646521
MD5 2229bdea09783e544015db10917ea91c
SHA1 9d8fd01f98f6de2f2889bc441847f25146190660
SHA512 c1abd12398bf749fcc07de144ada40e23985cde634d7ba756f0199614ec4eec918c706f0d8af2f4fbec2539c256e638496e8c57cd18e2f5cbefe204d3770d089
SSDEEP 12288:xCdEghhbRsBDHzqdIqD8XrxMWJcQ8O4Po/833+/3kf7mf1YWlnl:dv00Mo/
TLSH
T11DE5BC084DA53478CAC73922C71E221D077F3B21281CAA5F67CEAA7D7874D9F9582E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebobux.bat

Path C:\Users\Admin\AppData\Local\Temp\4BC5.tmp\freebobux.bat
Size 176B
SHA256 9d99aa3263624e3a9434af76bac620f71598c082b35504de738d1c04af079fab
MD5 202d76eb2952aeb2e241c13defe48045
SHA1 34e26a3407288c7ea63bd1cd305c27b06b163386
SHA512 6a78847878c3ee4ef82a61d03e4f61f681ad7c2d62d5ff10645f17fa2acf63bc76b5862043bb94eaf7d80ce0ab2c35a904ef6de178623d42111c453c5ee9f3d3
TLSH
T14DC08C4ABBC30E1168880A3879032E56F40A1ECA2F000E682FA308CC4CCB444E232830
MD5 SHA1 SHA512 TLSH

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Local\Temp\4BC5.tmp\x.vbs
Size 65B
SHA256 a6154ba12e45de717c0f6cef752c68897ac80438d1ad60750b258f1d35a39e25
MD5 ab30794d761af418b216eab48d003536
SHA1 edd4c2f1813c70cb8739b5c3b8efa425072a4911
SHA512 96214a59bd691d2210a758d1679e2db7e6b186c2f0b8bd9a4286ea3a8aeaa1f35632c6c078371bf474e7dffca9e23bd0d6cc4e9c0c114c883ab3374be81f291d
TLSH
T1B9A0228AB3A8082208B00330E2008C00AA0C08C03A000F2008F2200C0C0C008C023030
MD5 SHA1 SHA512 TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 13KB
SHA256 ba100a74c6603dfcd4fe0e7ded04fca6fabe7f6610b6f5ad4566e85c1203995e
MD5 d1f882da71d058bde723deb56f1d912b
SHA1 b40e3a31de3e21f53596c12f473ff40fe3d59c53
SHA512 f80af087e3ff584b8f0ee37aee85bc220cd59daf59b8767fe2b0547e5df6c806a17638e0627698625b1ba0c3231744f97167d786ef4f77dcee3d44a88037b57f
SSDEEP 192:BcM5BGiTV2nIeqDT44DlE74FRVnfMFFmyf2dvGhBanAl:SM5MiTVjeAj8YjfOteGzaA
TLSH
T1E7520A87BAE49007E1F2C57A34B06334DF6DBF632FA18ECEADF15E425691C866406352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

MEMZ.bat

Path C:\Users\Admin\Downloads\MEMZ.bat
Size 9KB
SHA256 fb5582429ded721b4853f64f75c157b5e6e3f30a52c9b7b946190dccd52b03de
MD5 1c33f99e8498b7ddc1a5d2a194b72230
SHA1 3e93d36f70568e5899652ab6e24bec9f75584dc7
SHA512 466dbb123cfb21461a5f94aae4898a537f1bd22a0c5112bb79d5462a9c7ce0409c0511aeadbf0ef5ba522703e0bad18dd68d2fdbb1690776b7e69de12608a404
SSDEEP 192:4THhQLMPlY2/p4+tpJaCXCpoqDnVai6k1Ldw+OVLeP2FcF3W97bXJ:4TCI9z/p4+trXCCqk+OtTFQAbXJ
TLSH
T1CD227D38B492845E0D7651093C05C6E4FC8563FBDAA3AC827A5BD0BC78662D336BD70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PankozaDestructive 2.0.exe

Path C:\Users\Admin\Downloads\PankozaDestructive 2.0.exe
Size 734KB
SHA256 86b279800d7aa3025b59391f4f8bab2039c41258d0daf3d85365b0c3ddf05065
MD5 b172b2bcebd8e4797ceaf0503c5840ae
SHA1 ecaec7910a01b4a142741a0ff0d49c0a47acdfd1
SHA512 f1e2a996be71155e1a101ad5e28c826ef61baaa4d5bb5a003b7038531e647d02438a4b82f67ab26d96c0b6af412b7e0b45b2568a8325beb1b90b81fb4266947a
SSDEEP 12288:/gyq+/b1bnZBkd87AzpF69TFDgfQzs9K2+9gF9DkWE0ozoS9nNcTgUKad0/zbTPQ:oyLdZBTszpWFDgYEcgFGrHnNcTgUKad7
TLSH
T156F401E5AD27C983D78062F0CF66EFB143291FBD2562C460B8E42D8FB59DB1B4C54229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenMelter.exe

Path C:\Users\Admin\Downloads\ScreenMelter.exe
Size 455KB
SHA256 9f2c6d14a476d10615fe8e099ef8f87681b80382665b81c041eb5128ae7c7cb8
MD5 615d04a80c94f9e36efb9c567a8afc34
SHA1 cb3b158ce9b5a0eef3097c55c226e6084a4f4877
SHA512 0b4c3e073d170b7de1635e3b6af1f641215d217ce9f96d6c57d2ca8a6af45c9aa94a84b6b9f0876a7a8a7a31763943ba5e3bb6f44316a3a2007574359c461294
SSDEEP 6144:PBAefjQ2NE4KzNtTB0z9KJrRGVw818kAOrTy:59fjQ2NEDNZB0RKJrgVw818kAOrT
TLSH
T1F8A45942B994D5B0C52878F4EC22E4B9473A7EAA1D444B4A34BC3B0E1D73093ED5F96E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

covid20.exe.crdownload

Path C:\Users\Admin\Downloads\covid20.exe.crdownload
Size 4.8MB
SHA256 56c6b80e9f525e9010b47112f8085751e8e3fb744e111df3330b481df6a7e954
MD5 fde53eb92140afb22152cfa283ef26cc
SHA1 b975f240e69307f809e54fabf6ea547183edf130
SHA512 df5eaa0e429e618d7c94eab0dd6021d774abe50ad2d200d3608d1d1c50b70e65eccff564baa2fd2b86a5dad999ff7edb04152ac5cbff209fae7d93c329dff771
SSDEEP 98304:i1EB4Av3kOW561R4+8QxEmKDxUmEhc0R2lIP9W0uJPg4dWzN/ODIw9AtVje7gQ:EEi4z1R4+LKDPEK0RBFduJ44dWpiHAtM
TLSH
T1973633D2C65D6703CDB2F77672479BB9BDA3C045E6291A602C5333A6452CBC123186EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebobux.exe

Path C:\Users\Admin\Downloads\freebobux.exe
Size 779KB
SHA256 5ac42d75e244d33856971120a25bd77f2c0712177384dfa61fb90c0e7790d34c
MD5 794b00893a1b95ade9379710821ac1a4
SHA1 85c7b2c351700457e3d6a21032dfd971ccb9b09d
SHA512 3774d4aed0cce7ed257d31a2bb65dda585d142c3c527dc32b40064d22d9d298dd183c52603561c9c1e96dd02737a8b2237c433cf7a74dccb0a25191446d60017
SSDEEP 12288:QLttwyELMYnrfWxYLlHVyEaX9/7tWsGQyWkbtRoSxB:8ttIMYnoYBVyP97t99Ut
TLSH
T17E0512E1F2DCB239EB85627D2C3AE45F21102CBE5D9A5E1633E937CD1B3015066C1BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inv.exe

Path C:\Users\Admin\Downloads\inv.exe
Size 359KB
SHA256 28e979002cb4db546bf9d9d58f5a55fd8319be638a0974c634cae6e7e9dbcd89
MD5 ebb811d0396c06a70fe74d9b23679446
SHA1 e375f124a8284479dd052161a07f57de28397638
SHA512 1de3dcd856f30004becee7c769d62530f3a5e9785c853537adc0a387d461c97b305f75cbaf13f278dd72ba22d4650e92c48edf3c3a74b13ed68ffc0d45e13774
SSDEEP 6144:qizJVFAO7rdGlh4sQstCPhiomhiGM80JCMlTe06z0aPawSoQBAlAq4SYwhl:RJ/AO7rAlys3tCj80x6zlawSo5Aq4Xwv
TLSH
T186747D33F6D15437C2732A7C9D9F52689839BE003E28A84A2BE91D4D4F397813979397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\Downloads\x
Size 4KB
SHA256 de7c2f358de3bebe188b5c002eca2dbc8a536aaa3f46e41175923a6d3c775efb
MD5 73dfd82f3f6aa94e1379e52c449af63b
SHA1 b542f559a9a22d8771516a4a702e5290fbbaaebe
SHA512 9a33afae7badeef330ec1a36c949c30d746122b89ffdb014000432280ad734c0f75dfd91905c2a098867ad09ca1daefdf6a26fa2104e1415c82b3c642bebfc1d
SSDEEP 96:/PHhUBYK4QyzXkFI/ulPAJ2mqMyWzaC7SuaMAm4XyM9ogy76Veup5krFp:/PHhMZ4JSI/ompDzaCbwiOo2Bp5mp
TLSH
T19C919D3486EB869F1322295E3C5AA0F89F423CF3F683844115AE215DB5323D89338D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\Downloads\x
Size 8KB
SHA256 5c296bd9c5216781c3414ec17704155d4b31fa72604a2a320668f5fe74c7eded
MD5 b605def4bc2ee976559ba26ab6de2ea8
SHA1 024073431e82308c0d2d60268d34e6c000af42ed
SHA512 a41f597e10eba9fbf7d1384fd2de87a05648d9244b95b8c7111bc65162717087c536c3b1787f682acd0f3ce2284c0e67f26d4423e73afe38e261fbddc0f3b07b
SSDEEP 192:/PHhMZ4JSI/ompDzaCbwiOo2Bp5mFwRLRa+WOE3U4ZaXWz:/PmuJB/omp7bwiF2y+WOc7Zj
TLSH
T14502BE3CD4A3C8AE42A55509380586F88C4122F7EBD295CAB69D60AC79B62D8433C54F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\Downloads\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\Downloads\z.zip
Size 6KB
SHA256 e19b4a5672907931803f20f76445441f9d73a149ecdb43d40d6815dffa401aec
MD5 b299bd2ea62a3798465208b7153946bb
SHA1 341a96f1c79fbc6571d73f61b43a7554a72709c7
SHA512 9f187b738ccf2890adaa8bb6284ae86ac915ef99c9545e91fded4bdcd0d7dae51be743bd76dda63c11e212cdb516333241770c48911c80df1c048d604e92ef1d
SSDEEP 192:uyXJf29INouiFiSD/fWQKGw/1yFhWCO98GKyYkdUk:df2E6iSrfW1GwyjWB98GKyYkdUk
TLSH
T170D17EB6563B34EFC60211BE0CDEDE3652D009DC52A090959BEA14A3A8515E37B2169C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-2254-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/1212-2687-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2524-2685-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3376-2606-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4172-2273-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/4172-2914-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/4764-2220-0x0000000000400000-0x0000000001A7B000-memory.dmp

Download

memory/4764-2253-0x0000000000400000-0x0000000001A7B000-memory.dmp

Download

memory/5220-2059-0x0000000000400000-0x000000000083E000-memory.dmp

Download

memory/5220-2089-0x0000000000400000-0x000000000083E000-memory.dmp

Download

memory/5336-2083-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/5948-2604-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/5948-2577-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/6004-2831-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2686-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2792-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2697-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2814-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2760-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2755-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2768-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6004-2734-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/6044-2506-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6044-2177-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6044-2168-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6044-2829-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6044-2282-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6044-2695-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6044-2660-0x0000000000400000-0x0000000000460000-memory.dmp

Download