revengerat | 07569cd953006587d716ee60b284baf1d77bfbd77706395b2c3b504d76267380

Analysis

max time kernel
564s
max time network
660s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2024, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ff2 external.zip
Size

15KB
MD5

b7b23f0fb1e8d035371a4b2a7f4a6008
SHA1

ff885b7b4bdbdba23e0d540f28ef4ffdf5072adb
SHA256

07569cd953006587d716ee60b284baf1d77bfbd77706395b2c3b504d76267380
SHA512

d0cb3406b65c157095e4ddc592d39f00a43cd8c686143ce3ead7469e29f4e80756787b479ffbecaa7f016287532efcb0e33ed3b8170ffad4573421304991bcad
SSDEEP

3:vhj/NVlllUtxgEEAI2tvbGllnZ5i2Qz//Z6+4Fz/RjllNVlllUll9xgEEAI7uWlp:5jb/qTIy2TU5rc15jb/q7IqWl+lMt

Score

10^/10

revengerat guest discovery macro macro_on_action persistence stealer trojan upx

Malware Config

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000c0000000234fc-1091.dat	revengerat

Contacts a large (1382) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral2/files/0x000f00000002363c-2122.dat	office_macro_on_action

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe

Executes dropped EXE 11 IoCs

pid	Process
1124	RevengeRAT.exe
4348	Bugsoft.exe
2600	Bugsoft.exe
856	svchost.exe
4416	Happy99.exe
1616	svchost.exe
3340	NakedWife.exe
4640	svchost.exe
4680	ZippedFiles.a.exe
2556	EternalRocks.exe
5044	EternalRocks.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001100000002355e-2183.dat	upx
behavioral2/memory/3512-2193-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3864-2204-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/4028-2230-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3512-2233-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3512-2245-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3512-2246-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3512-2262-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3512-2272-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3512-2369-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3512-2414-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3089151618-2647890268-2710988337-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	RegSvcs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
166	0.tcp.ngrok.io
193	0.tcp.ngrok.io
1091	0.tcp.ngrok.io
26	discord.com
138	raw.githubusercontent.com
208	0.tcp.ngrok.io
214	0.tcp.ngrok.io
29	discord.com
141	0.tcp.ngrok.io
154	0.tcp.ngrok.io
178	0.tcp.ngrok.io
137	raw.githubusercontent.com
211	0.tcp.ngrok.io

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\MSDRM\MSOIRMPROTECTOR.XLS	ZippedFiles.a.exe
File created	C:\Windows\SysWOW64\wsock32.ska	Happy99.exe
File opened for modification	C:\Windows\SysWOW64\wsock32.dll	Happy99.exe
File created	C:\Windows\SysWOW64\ZippedFiles.a.exe	ZippedFiles.a.exe
File created	C:\WINDOWS\SysWOW64\MSDRM\MSOIRMPROTECTOR.DOC	ZippedFiles.a.exe
File created	C:\WINDOWS\SysWOW64\MSDRM\MSOIRMPROTECTOR.PPT	ZippedFiles.a.exe
File created	C:\WINDOWS\SysWOW64\RASCTRNM.H	ZippedFiles.a.exe
File created	C:\Windows\SysWOW64\Ska.exe	Happy99.exe
File opened for modification	C:\Windows\SysWOW64\Ska.exe	Happy99.exe
File created	C:\Windows\SysWOW64\Ska.exe:SmartScreen:$DATA	Happy99.exe
File created	C:\Windows\SysWOW64\Ska.dll	Happy99.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 3864	1124	RevengeRAT.exe	137
PID 3864 set thread context of 5052	3864	RegSvcs.exe	138
PID 856 set thread context of 2724	856	svchost.exe	213
PID 2724 set thread context of 372	2724	RegSvcs.exe	214
PID 1616 set thread context of 3084	1616	svchost.exe	256
PID 3084 set thread context of 4420	3084	RegSvcs.exe	257
PID 4640 set thread context of 3128	4640	svchost.exe	267
PID 3128 set thread context of 408	3128	RegSvcs.exe	268

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JDWPTRANSPORT.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGECALLBACKS.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGECALLS.C	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGEPACKAGES.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SAMPLES\SOLVSAMP.XLS	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JAWT.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLN.DOC	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLV.DOC	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JVMTI.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JNI.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLN.PPT	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLV.XLS	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\CLASSFILE_CONSTANTS.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGECALLS.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\JAWT_MD.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\WIN32\JNI_MD.H	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLN.XLS	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\1033\PROTTPLV.PPT	ZippedFiles.a.exe
File opened for modification	C:\PROGRAM FILES\JAVA\JDK-1.8\INCLUDE\JVMTICMLR.H	ZippedFiles.a.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\WINSXS\X86_NETFX-ASPNET_STATE_PERF_H_B03F5F7F11D50A3A_10.0.19041.1_NONE_A71B18B9B7240FD3\ASPNET_STATE_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\SMSVCHOST 4.0.0.0\_SMSVCHOSTPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\UGATHERER\GSRVCTR.H	ZippedFiles.a.exe
File opened for modification	C:\WINDOWS\INF\WMIAPRPL\WMIAPRPL.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-W3SVC_31BF3856AD364E35_10.0.19041.1_NONE_74075B27A8B0FC6F\W3CTRS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.1_NONE_C3BC3DBD94DA3C61\MSOIRMPROTECTOR.PPT	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.1151_NONE_EC390BD802A1C630\GSRVCTR.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.1_NONE_CE10E80FC93AFE5C\MSOIRMPROTECTOR.PPT	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\.NET CLR NETWORKING 4.0.0.0\_NETWORKINGPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\X86_NETFX-ASPNET_PERF_H_B03F5F7F11D50A3A_10.0.19041.1_NONE_7CC3A8E15363EB05\ASPNET_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\BITS\BITSCTR.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..MMAINTENANCESERVICE_31BF3856AD364E35_10.0.19041.1_NONE_F33EFFCE7F94D952\READYBOOSTPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX-ASPNET-NONWOW64-SHARED_B03F5F7F11D50A3A_4.0.19041.1_NONE_D66D07DACAC85E2D\ASPNET_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_WCF-M_TX_BRIDGE_PERF_C_H_31BF3856AD364E35_10.0.19041.1_NONE_6A2A49572AB90F30\_TRANSACTIONBRIDGEPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\.NET CLR DATA\_DATAPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_PERF.H	ZippedFiles.a.exe
File created	\??\c:\windows\jk.bat	Bugsoft.exe
File created	C:\WINDOWS\INF\RDYBOOST\READYBOOSTPERFCOUNTERS.H	ZippedFiles.a.exe
File opened for modification	C:\WINDOWS\INF\SERVICEMODELSERVICE 3.0.0.0\_SERVICEMODELSERVICEPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-_NETWORKINGPERFCOUNTERS_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_5D7FB023EC33EF8B\_NETWORKINGPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BITS-PERF-V1-COUNTERS_31BF3856AD364E35_10.0.19041.1_NONE_17C681FDED11FC67\BITSCTR.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..RVICES-PERFCOUNTERS_31BF3856AD364E35_10.0.19041.1_NONE_00C2FFD3E29A5ADE\TSLABELS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\.NET MEMORY CACHE 4.0\NETMEMORYCACHE.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAPICORE_31BF3856AD364E35_10.0.19041.746_NONE_C2332356A565DF1C\PERFCTR.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-TRANSACTIONBRIDGEPERFCOUNTERS_B03F5F7F11D50A3A_4.0.15805.0_NONE_6B0477B0FB9004FA\_TRANSACTIONBRIDGEPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-_DATAORACLEC.._SHARED12_NEUTRAL_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_3B8D4DACC2EA6B71\_DATAORACLECLIENTPERFCOUNTERS_SHARED12_NEUTRAL.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-_DATAPERFCOU.._SHARED12_NEUTRAL_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_24ED4511DCC3019E\_DATAPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-_DATAPERFCOU.._SHARED12_NEUTRAL_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_24ED4511DCC3019E\_DATAPERFCOUNTERS_SHARED12_NEUTRAL.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.746_NONE_F619255888ACBCA6\MSOIRMPROTECTOR.PPT	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\X86_NETFX4-ASPNET_STATE_PERF_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_0C5E324537CBCE25\ASPNET_STATE_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\.NETFRAMEWORK\CORPERFMONSYMBOLS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TAPICORE_31BF3856AD364E35_10.0.19041.1_NONE_9A2AE60DE5F420D2\PERFCTR.H	ZippedFiles.a.exe
File opened for modification	\??\c:\windows\mail.vbs	Bugsoft.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-ASPBINARIES_31BF3856AD364E35_10.0.19041.1_NONE_42755BCB06D24EA8\AXCTRNM.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.1_NONE_C3BC3DBD94DA3C61\MSOIRMPROTECTOR.DOC	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\WINDOWS WORKFLOW FOUNDATION 4.0.0.0\PERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\TAPISRV\PERFCTR.H	ZippedFiles.a.exe
File created	C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_STATE_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RASBASE_31BF3856AD364E35_10.0.19041.1_NONE_C3D1756519CCCB94\RASCTRNM.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-ASPNET_STATE_PERF_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_C4B0FB6E234FA51F\ASPNET_STATE_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\LSM\LAGCOUNTERDEF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_STATE_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.264_NONE_8BD2F5FC0C992E06\GTHRCTR.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\X86_WWF-CPERFCNT_31BF3856AD364E35_10.0.19041.1_NONE_796F8F9AE78775E8\PERFCOUNTERS.H	ZippedFiles.a.exe
File opened for modification	\??\c:\windows\jk.bat	Bugsoft.exe
File created	C:\WINDOWS\WINSXS\AMD64_WCF-M_SVC_MOD_SVC_PERF_H_31BF3856AD364E35_10.0.19041.1_NONE_51277F142F1F9414\_SERVICEMODELSERVICEPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\MSDTC BRIDGE 4.0.0.0\_TRANSACTIONBRIDGEPERFCOUNTERS.H	ZippedFiles.a.exe
File opened for modification	C:\WINDOWS\INF\WINDOWS WORKFLOW FOUNDATION 3.0.0.0\PERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX-ASPNET_PERF_H_B03F5F7F11D50A3A_10.0.19041.1_NONE_3516720A3EE7C1FF\ASPNET_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.264_NONE_8BD2F5FC0C992E06\GSRVCTR.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\X86_NETFX4-ASPNET_PERF_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_E031B46CF0C9371D\ASPNET_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_STATE_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_PERF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-SMSVCHOSTPERFCOUNTERS_B03F5F7F11D50A3A_4.0.15805.0_NONE_2B4BA3FABCE2B249\_SMSVCHOSTPERFCOUNTERS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.264_NONE_8BD2F5FC0C992E06\IDXCNTRS.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.746_NONE_EBC47B06544BFAAB\MSOIRMPROTECTOR.PPT	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..GEMENT-PERFCOUNTERS_31BF3856AD364E35_10.0.19041.1_NONE_DB48407B484FA757\MSDTCPRF.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\USBHUB\USBPERFSYM.H	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.746_NONE_EBC47B06544BFAAB\MSOIRMPROTECTOR.DOC	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.1_NONE_CE10E80FC93AFE5C\MSOIRMPROTECTOR.XLS	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-R..T-OFFICE-PROTECTORS_31BF3856AD364E35_10.0.19041.746_NONE_F619255888ACBCA6\MSOIRMPROTECTOR.XLS	ZippedFiles.a.exe
File created	C:\WINDOWS\WINSXS\AMD64_NETFX4-_NETWORKINGPERFCOUNTERS_V2_H_B03F5F7F11D50A3A_4.0.15805.0_NONE_9D7F19400A8AEE7C\_NETWORKINGPERFCOUNTERS_V2.H	ZippedFiles.a.exe
File created	C:\WINDOWS\INF\.NET DATA PROVIDER FOR ORACLE\_DATAORACLECLIENTPERFCOUNTERS_SHARED12_NEUTRAL.H	ZippedFiles.a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Happy99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bugsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bugsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZippedFiles.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NakedWife.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3089151618-2647890268-2710988337-1000\{6D51CBBD-9A79-4C84-B75B-F28993804AF8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3089151618-2647890268-2710988337-1000_Classes\Local Settings	ZippedFiles.a.exe

NTFS ADS 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 689444.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 754449.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 172535.crdownload:SmartScreen	msedge.exe
File created	C:\svchost\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 89688.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 132963.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 121108.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\NakedWife.exe\:SmartScreen:$DATA	NakedWife.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 688646.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 58201.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 232451.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
4016	msedge.exe
4016	msedge.exe
224	identity_helper.exe
224	identity_helper.exe
5052	msedge.exe
5052	msedge.exe
4432	msedge.exe
4432	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
952	msedge.exe
952	msedge.exe
636	msedge.exe
636	msedge.exe
3184	msedge.exe
3184	msedge.exe
4204	msedge.exe
4204	msedge.exe
2092	msedge.exe
2092	msedge.exe
4904	msedge.exe
4904	msedge.exe
3084	msedge.exe
3084	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	5024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5024	AUDIODG.EXE
Token: SeDebugPrivilege	1124	RevengeRAT.exe
Token: SeDebugPrivilege	3864	RegSvcs.exe
Token: SeDebugPrivilege	856	svchost.exe
Token: SeDebugPrivilege	2724	RegSvcs.exe
Token: SeDebugPrivilege	1616	svchost.exe
Token: SeDebugPrivilege	3084	RegSvcs.exe
Token: SeDebugPrivilege	4640	svchost.exe
Token: SeDebugPrivilege	3128	RegSvcs.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
2600	Bugsoft.exe
2600	Bugsoft.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4348	Bugsoft.exe
2600	Bugsoft.exe
3340	NakedWife.exe
4016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 220	4016	msedge.exe	99
PID 4016 wrote to memory of 220	4016	msedge.exe	99
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 4620	4016	msedge.exe	100
PID 4016 wrote to memory of 3372	4016	msedge.exe	101
PID 4016 wrote to memory of 3372	4016	msedge.exe	101
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102
PID 4016 wrote to memory of 312	4016	msedge.exe	102

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Ff2 external.zip"
1⤵
PID:1716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\BlockCopy.vbs" C:\Users\Admin\Desktop\CheckpointTrace.docx
1⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc610146f8,0x7ffc61014708,0x7ffc61014718
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5052
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zipw1abo.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2624
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA07.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8CAACB8FE1984209A5B4AB13BE6FC6A.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ioqf4x0k.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3048
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAC3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCFB7D68EBD324713A3816F68378EFD6F.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e9em0fiw.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2112
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B5FE0CD4834A4AA2B8AC25E27AD6D.TMP"
        5⤵
        
        PID:4024
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5lgx21s2.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4460
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBDC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc577095179CB4E3F89238E21B43426E1.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kfzd4tp6.cmdline"
      4⤵
      PID:1340
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC59.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc471EC9589E9041DA938235B8C96A291.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cpwaqokg.cmdline"
      4⤵
      PID:3624
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD05.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc82544E8F6EEE4DFCA8EA41323ED37DC.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\05z0t5y3.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:676
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD92.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAA2A0314759E482DBFD94CE4D7CCB5F3.TMP"
        5⤵
        
        PID:1872
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x1wzdic1.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1488
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE1E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc69088ECA8DF24CDBA336DAC63A4E415D.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gaganipx.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5104
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE9B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5D416A6EB1DD4B7A871846AFCE73A2EE.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a9i4mknw.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1636
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF47.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2C92A8ECE6BA4D25B81E415CB61DC65.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fh7xohwh.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFC4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc543DA58F67E24C8BA18CDF526B1FDE2E.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uvr6jrzj.cmdline"
      4⤵
      PID:3868
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1F3F22DB85B54EEEA41DA2C7AC74241.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ykadfsoq.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:792
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7EFF837849346598F1F4BFCB2393F6.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nt2edsru.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1344
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES15A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDEF8892737494ACF87F5A4783438B41.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pdbml_qh.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFACACB7D31694C4BB526D9C83E8C3EB.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dqnhre3o.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES254.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1A31C5A56CC9498395B25E60F0CB572D.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vodvxlzj.cmdline"
      4⤵
      PID:1120
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7ECA3DCBE94E4FAAA5E6EEC4FB6370.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2x-gemiy.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4380
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44144D3B1F074559BEC887B7D5AFC570.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m3tk2lcp.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:668
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7473677CC2F4612B5EB7CB832EDBDDF.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\crl_v8ak.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES448.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc30E52DCB8C3B41D29D7AF886C657151C.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5tjbk7xq.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc30C0EC75176F490B96413B2486C642CB.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1392
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:856
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        6⤵
        
        PID:372
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2520
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rnqb-qsa.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB17.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC73E526AA5EB4ECD8D4A9FAFC896F883.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sbvpuf9_.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC11.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE1F53F1B29F0434CBA4B7AAB0711F4C.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:336
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_formspm.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC8E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC301ED2B54124E57A7E6E97B6535DF8B.TMP"
        7⤵
        
        PID:3360
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3lq___5y.cmdline"
        6⤵
        
        PID:1052
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD1B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA337FD03A05D421688F422743463513.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ummcewa4.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD88.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB962F834D0CC46ADBD3810B3527E210.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6ghzzrie.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE44.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9DABEED49CAE4E5D812EA6783B65E857.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\urfq0jxi.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEC1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1187AAAA16A4DE0A8977FEE25EA28C2.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cdqiykbk.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF3E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE3012802D13D496E85394AA4C824461.TMP"
        7⤵
        
        PID:4200
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nwiyfwps.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFCB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc365C6485FC68408099581AFD59DA8024.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p0_jgulp.cmdline"
        6⤵
        
        PID:2072
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB048.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6957BCF14014614BA28B77C5A208249.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Users\Admin\Downloads\Bugsoft.exe
  "C:\Users\Admin\Downloads\Bugsoft.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\jk.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
- C:\Users\Admin\Downloads\Bugsoft.exe
  "C:\Users\Admin\Downloads\Bugsoft.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\jk.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1836 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Users\Admin\Downloads\Happy99.exe
  "C:\Users\Admin\Downloads\Happy99.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Users\Admin\Downloads\NakedWife.exe
  "C:\Users\Admin\Downloads\NakedWife.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Users\Admin\Downloads\ZippedFiles.a.exe
  "C:\Users\Admin\Downloads\ZippedFiles.a.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7436 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Users\Admin\Downloads\EternalRocks.exe
  "C:\Users\Admin\Downloads\EternalRocks.exe"
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Users\Admin\Downloads\EternalRocks.exe
  "C:\Users\Admin\Downloads\EternalRocks.exe"
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7552 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7600 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:4048
- C:\Users\Admin\Downloads\Blaster.A.exe
  "C:\Users\Admin\Downloads\Blaster.A.exe"
  2⤵
  PID:3512
- C:\Users\Admin\Downloads\Blaster.E.exe
  "C:\Users\Admin\Downloads\Blaster.E.exe"
  2⤵
  PID:5044
- C:\Users\Admin\Downloads\Blaster.A.exe
  "C:\Users\Admin\Downloads\Blaster.A.exe"
  2⤵
  PID:3864
- C:\Users\Admin\Downloads\Blaster.E.exe
  "C:\Users\Admin\Downloads\Blaster.E.exe"
  2⤵
  PID:4980
- C:\Users\Admin\Downloads\Blaster.E.exe
  "C:\Users\Admin\Downloads\Blaster.E.exe"
  2⤵
  PID:2976
- C:\Users\Admin\Downloads\Blaster.A.exe
  "C:\Users\Admin\Downloads\Blaster.A.exe"
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  PID:2364
- C:\Users\Admin\Downloads\Fagot.a.exe
  "C:\Users\Admin\Downloads\Fagot.a.exe"
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3356 /prefetch:2
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17507206229163090353,8913713356713616269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1616
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:4420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4640
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:408

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
PID:1760
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost\vcredist2010_x64.log-MSI_vc_red.msi.ico

Filesize
4KB

MD5
fde1b01ca49aa70922404cdfcf32a643

SHA1
b0a2002c39a37a0ccaf219d42f1075471fd8b481

SHA256
741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

SHA512
b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

Download Submit
C:\ProgramData\svchost\vcredist2010_x64.log.ico

Filesize
4KB

MD5
bb4ff6746434c51de221387a31a00910

SHA1
43e764b72dc8de4f65d8cf15164fc7868aa76998

SHA256
546c4eeccca3320558d30eac5dc3d4726846bdc54af33aa63ac8f3e6fc128506

SHA512
1e4c405eca8d1b02147271095545434697d3d672310b4ea2ecca8715eaa9689be3f25c3d4898e7a4b42c413f258eda729a70f5ad8bc314a742082b5a6a8e9ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f20f2f04-9814-4935-a893-fe48fdb7964d.dmp

Filesize
883KB

MD5
818a5e6d1b259baca9aceccfffad2a0e

SHA1
78948caf66a4d6ae0fd8a0eb3e02a707abde3d77

SHA256
0647569e4dcf87996ead09b7712da1a7484187b4246f88643f784daffccf7a86

SHA512
0b7a31077628f826e5e23e5107e3208716c8075ae5b06971feed9124588bd486bef508ca4df9023cfc8ccc438d3dbcd3bef7b1919197b8955cac8781031289f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
506e03d65052f54028056da258af8ae6

SHA1
c960e67d09834d528e12e062302a97c26e317d0e

SHA256
b26d2695dfe8aed4d0d67d11b46d4542c3c9c8964533404dfe32ce7a3e6cfb98

SHA512
15da55267433c41febebbe48983023293c6d436f89a56138cef1cea7deb5cdd7d4bcf58af12835e1152a8ec59e08cfc965e521eb54eed47fe44e1f4c2d1557a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8e15789507476b605fade754a53b9f5e

SHA1
e778e1ca975d87b747a261bb4f60eece12c66a35

SHA256
8e3a2477c027554de5d5c7bfd15e2e5db685eda931f5aa266b9177a4b81a7571

SHA512
b9b76f41aba379f9b3c19ff4fb07918e55ad7add4c4d20205c9844a931fc3f516a3a29ef990548ffe8f7e4e98cd4cb070eae9a97e93a95c499dca75c0cdefd5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a15dea0d79ea8ba114ad8141d7d10563

SHA1
9b730b2d809d4adef7e8b68660a05ac95b5b8478

SHA256
0c4dd77399040b8c38d41b77137861002ef209c79b486f7bbdb57b5834cd8dbf

SHA512
810fc1fb12bceae4ca3fad2a277682c2c56f0af91a329048adbeb433715b1f707927274e3e4a4479222f578e8218663533440c71b22c49735a290f907cc0af1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
41KB

MD5
2a8a0496c0022a0e67d77d3446340499

SHA1
ed76b29d574b4dbfa9e5dd3e21147148a310258e

SHA256
f348937ab6c6d9835af1f55e3f1d3c51197dc1c071630611ebc6d44834fc44e9

SHA512
d3767a8eafe019a15c2142d1160271ecc62f6e7d5623c0ae5fade269c8c9cf7de3b80678ed64bb9546bcf4d80fa66e11cacd19f2a7e295a6fec2a64ec8068c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
1.2MB

MD5
74c0a9aceda2547c4b5554c0425b17ba

SHA1
d5d2355e5919dcf704192787f4b2fbb63b649b0f

SHA256
3b9e3adb939801b9ada1ce67afc7decef4538c016c78113697b89a35a295dd8d

SHA512
e178dce4a59cf184bcca3523e687092f4edc2a3c7af4eddf1ca1965ca06347eadf8901f851260264c14fa052331b2d1aeef2a6b9048b87758617285c9650b479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1b3aa2fc150d7b0cf68a6ed19f011eb9

SHA1
acf3ee119482e203ed7b644189b8bd36aba50bbe

SHA256
aea76f972a718d0a66acff2fc5bb68ddecaf58c86970dffd17f96c4649d37cb7

SHA512
3e348dfecc953162314b4f6e4aecda3d97609e4c1a27fd9dfb3f2ecd24a223465b40b1968c2301f958b1593ab71bfac313b2143da507c6103dee62a1eae1134f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
46578d85d9150aee40cbcfaa21e12d55

SHA1
0c43c2846c013b9b66f8e6bdd05964b335bd8b9f

SHA256
c1e6b65b2a952e8b9cbbe977e3c4c75743fc4e7807ace97c203f96406c23911d

SHA512
9c007af44aa1a36babaf18d87a39e8b2b9282af4b9898c8d86bff7ae831fc7716977c59eb1243b69339021fb1e94c42cdf62a65d9619d10b4f244dd12cd035a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7d2949538d2b228937f65ae152ac44ad

SHA1
0b9684bcffa3ae4803ac6d03125d7778b44866c7

SHA256
ad03c2a7c4f41b4874529f64b6743408a5151480cdd0b4e11e97f2d9d02ada0d

SHA512
d299045c29ad661d908bbfbfaac7dfe708d1ded218a679b18239bb3aff2c2e16c56f09a3e5891468fe67a247964b6c5fc74fc9f097651e565e4d79cd042d35ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4b71f50afee385d714d11ac82cc52bec

SHA1
8ff381189031a52e93176fd13c179c9c8cf1e6f4

SHA256
223be836e1405d66ee2aa07351655037b1a8d9e82808ad494c98677b6266687e

SHA512
ba3c8450d5cbcdf50f1067cf73468473bb9a1c71467a21d003de312cbf06456ef7dd45ff38ba7bff7db9b4b4f65db8bfe4951383c4cb73e349aa949c510a25a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10a509c28456995fe212acc47a54892e

SHA1
7a3eaa8d0088b017547ba25812d29030d7f9baf8

SHA256
a63bbbce42914f5c4c66b37fd2b895faf25d549f818fd1214ae1e9b88e27d7a3

SHA512
5f7de94381c6731d020c7ec6831d945295b4febdd0b671a79649c3af86ac6e28b4ce9e595fc7e2917c0e337dd4c12e13645320048b7d130a8e6cad5a3a5c35f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17b3badd8eecfbc98ad2c152e1d87ca9

SHA1
eb5251fca1729201e1ec94d1255646ddd09b866e

SHA256
87187ddeef6579e79d35a739410f2dd53bfec23ec04f7da9c3f1281259bd3af2

SHA512
16a501910113cf8bf2fb1a40e548fcb6b5f1dbf79284b286972cea3daf284c8cfc1a250fcdb832e98d87dd7ddcd8ba4354e09c13cfd849b4a2186faa7d254806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5da7005b3113ea74c6a769bac624abc4

SHA1
fcd1ffc59f0091e03da373bd0bfd8a3ad77b83b2

SHA256
55d2f000fb62cd78877dcbe4d5ee28650b224980d80c719cc9ed2a43dbea97cc

SHA512
dfdb64f76035fd693ab1cdd83a71ce58799ea89900f75532b1620dd3cabb399ecafc5dae768cbbe5068820a39b28281115d27f1d300a3a48b2290efdd6d8cabf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1538330f34d422aab2f87b6997836b0c

SHA1
8a3c8c7d42c6a875e84a81f81f8267be15d2c2ff

SHA256
0159ee86ee7cb820a18fe86a82c43114bd3cb0235cbe1c0318cb59d392dab022

SHA512
b1f0b98a61ad363f0167ea6094df52244a5e953efeb04cb422d2cbd27307d614713ea8deb68146098090df6beadb595a89c11a764dfe4a14940d37ab6efa88ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
01ec8e93728dbe6ec5f67cf2b61bc95f

SHA1
0eb956ddfccbc969f048cbd496d1c8b7470e84ea

SHA256
0de9b1654c748b6f15f3cc1510de672985266a3a637d1a2935f1c65b577463a4

SHA512
9053897b4e70cde9fc3ecc784619b0483548792f17d1b05de1529775c5dd5ba9924faa0ec31af79497684f36cda57c5c2f36882f4d8d462627dbc3b206549bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
55f1502f64d553dd1a4a45619d7273dc

SHA1
3f3bfb1ccf29ab73989e5e1324bba248e49efd23

SHA256
cf07bf8b2d418fa5b4ee450e3c023333ee4e15c26f102db4aa7a0a84d097a7f6

SHA512
f5a1e4ed739e4d18c5f15ff1ac2f9a106bf22a000540047b35cac05322adace49f85d33977aad7fef68c5edd72693aac152e02e20a01aa1d467f21762bd5f836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
60a92b07f3f536a1a399ef60329cfc96

SHA1
9336e2d22ad001d78e81cae9a47a472bf4d4b38e

SHA256
8c98bf69ce69ab7ea4e24c4175886acbbea5aefe15ea773ea5fc4df3fc1f175b

SHA512
6005b746bde61b672109e0da87064d99f1aec73cbb2e9a7cc0a1e20215d0744fd5b0fd99d4c88724a74a121ba1cd10425494f45d7d62f667711c1ef6b737d454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
16bccdefddb58d167fb254e48baffa0f

SHA1
452d38b9e1b542571b95a765af6a68031c875f04

SHA256
703a011d2a2fb62b029b0587dbe229ab32bef8b2c5f425db1e3ad3df6135952c

SHA512
357abaf574ed430ce78845e539f60729920d464ede9ed80c02e47f89b9e9e47654115163679c3df2dbd9330729eb779e8b23b2ab09b622ae6db085aaafc83c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d65e36d657d4b0e430db2148c5bb85fb

SHA1
a1892e49a842f408c9a073dca1f827b46f466427

SHA256
bccb6eaa624625b83c90264b8df79d6759ba173c5613b747cd99933692680727

SHA512
6308fb2c29753504f2cbb09b306cf9d9b5c98a94842303fd7052079afe27df089e197f4c479d0856e699464b5f2aab978288e46ecf41fffb2eb7b3afcbec8b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e80b5b41fe794fbd8c944c0474822388

SHA1
c6b7ee1b458a9e3439ec6b9e5af28e2a5db16b06

SHA256
5f54c4911fade355913a0a07443648bc474a122b51128c9227a8c0bb2011bdc3

SHA512
71c415ce705041c8871e527d6f56174350934eeac2cb7e808a6fb2aace78ffd7d5f63baebdd600378875e3aabf5f01dedf119985c38eff72941b7a13b688e7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
98ef8dfb1db2c6e1898b8ea9bdbb2e6f

SHA1
8e2fa2e39490ff99ee2c3626a6703ef8db5104e3

SHA256
d67122e6ea384e627fb8cac0855e2237fc69ddad3c5d2646fb4ce5d2fd6c353c

SHA512
d8fd5a436bb04ff3e3ad3e59f29d4eac1ba2753cf8bba45e7976a074261983d7253041ee6500dd3f682ff28efa2357c4ceaf9dce4cbdba3bf9c5da78bf130477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
837db94a6463adc3ac07cdd4a4f3b3ac

SHA1
4f8231fb72f092f906f5100208611d0337e70fee

SHA256
7ab8b72e81323de26df27bf403945248047eeec470341db939a7c2796f65e03d

SHA512
d4b037f300b3e630195f73481b690d7bf697a102741152bfd30e3d1821b6c8af43eb0b38f8e82f1bacb4257cd74957c2b04b50bbc449e6e0e22e2c8e08a21dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c8885739febaada234d1fd9014cc4a2c

SHA1
7728d5068728c50b7bfaa4a98b64f1b7bc0b9999

SHA256
e57bd8d795beff6e2ec223e191537b58d11eebad771ca9b9b9880f9348ea09d2

SHA512
3e7f29c0450571a0b9c72bfa441fb31c1b3134d788b17652e5c7c28e43fe44e8078b307620bae8a1b46e3b44dd5d75f8d21ec147e80c1a408b4b7b225a234a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5a0812f9c6b87066589a0a4e8a216698

SHA1
0fd38bb1e89cfd315e3b105898330249511c538a

SHA256
606669ab65c59e60ed543b1945b3f425a3105840717d4496d9d5edefb9833316

SHA512
a47d4b42b27426fc03ec250c44abf38a7a5cf1e431bfca77b4750ae0951c6d49bbd455f713fc77068bae1bc22d5a6fd4abbe8577d2cc8f97d9fa8770e360f69c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
17a647909a0ded6abb13b8061ef8019a

SHA1
d00aca5b756b49a15f793b25a4738c793031145d

SHA256
21326d9c71e0db8eb566a0b04e0aca0fab658b0be5decb5d425b17363e1034bd

SHA512
13c32eef8fdbf306c0779fa8658c530bf7f8f201369900b5ec09fbd6f859dbfa09f9294b2fd1fd4f4516963681ec1ba7637d7e95a5becabe9607d800965c20ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
176aa2d1941b5728981c2881b7052d71

SHA1
6ae382ddd8c46017e67b9b5ce0795053806b67d1

SHA256
e58628f64f32af79ec8679f5a64f168a7333c22b49b11fcfa94370fd786832ce

SHA512
c0305547833af5fccab05781c85c542ce24601db20b5c48d7b58c3a7b0754ff323c64ab427083d23be25232dcefca8fc7ac8cd24a582041ab2823aa2dc46e1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2785db358edfe12c2297165df27bfcb2

SHA1
6364e43c0ef7caa659c69aa2398d4df26a120c25

SHA256
96ad17cfb10d42ed556c465c7bbc73cd609744a98b93e043ccc08469ac79d6fc

SHA512
3d11e46a92c7fa7e6287bcff429d0653e3f400ccfd413b37d81db8eb69a649cf489bf7fd8d0cff23cb001b2da7b6c88bcbc232ab355fd4b364d028a579676e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
486de52b2391ad5179f384797e4db5d2

SHA1
03451a98465f1698f4b6b40a05efa45b8055d9b1

SHA256
e19ed5771a091798ab1c4c9c27fe708de3d7418c86ce60f196b1420debb17b1a

SHA512
08897e809ac212061e6640e8e0ee39c07bea081573c7ed21f3babe591df2240bdda325814cfbd2ee1dd9c3b921f4d75a091bc4c4358483c4fdd2547d71818614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
db96d555d48d5e42ff4361519ab580a1

SHA1
602db3847d347d8f571f64bf1b62a202acae448d

SHA256
a764c408e170008cae65fd47a2ba6891fcb31d1ff7217a4b1cd89fa992e08519

SHA512
fbf55ecdd12ea7387125035eb4e22eba762f67251ccc7e01bff57536650cd89b4f38ecc671713b777546fc7caaa5e82e2d4125553299d4bbd93e0efb9bafe0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
aea404ca77fc38faab71330176dbc409

SHA1
15fe31b969b9ba827b8dcb8512d66f526fd49e0a

SHA256
d1545d40a7e3431f05ccb854c79a3abfcd76a34c3afe1227e2d0cf92c2bd7df5

SHA512
22eadb45706720a72aad3dce280e5c20cb034c959f217a8aefc0696768cc16d2a1e1835dc994096a47c258fa41db0081ce5ef7a4ba1aeb2e3f020672e1f45821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
52b321603415466462ff53f7f08f1cd3

SHA1
6778f63d19fe3796b23d71644ab8f8a3a0e7c27b

SHA256
3715e6677fe848fe50e967757e3ea19b1a12e30266572a30ffb661eeb299e737

SHA512
a199425f60288baea1502a57130a04bca76c108fb35de16a88fea34af8e453db0b8980788cabbd2436df20c9d62d43817efd7cacb2c0eb154b8ee076de56da25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53b0eb0dd2d887115e3f336ba3d8c146

SHA1
027117960ced8e5a710143dbd69d09234bc2ffc2

SHA256
a60af278e3d34f9e09bb35789b82d3d4209ebe933973db19d0a55490400d6112

SHA512
6befe8785f46e57eaa78217c4f0a0c83b27c61b9cbd7d8bfa1f320426ff4836a1a8aa8c9b475daa1abca48223f6c174722c9b0895ed5ab7d76b363dfbfe8656b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
025b79325947ff87baa4f16fb8ba3ebf

SHA1
db7f24e9ff1ad2d0f368c7204da1147bc2bd1474

SHA256
1c8fef70fb6302e0222026b636a7af7d66e1831db7acc5d5c57a207864b5c2fa

SHA512
1a7b2049ee00fe840a34155eebd4470375827b2590b7fe8e0be17837632288c9fdd7c6fd51f131b9462cdf8e9b605f0afe01f3945a2a0c27a389d927c03e67cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b48e9cf64b538cb5ad8cf5fb7da835d0

SHA1
2896ea0f6e1e6e7fbe122b2489daf52d2969fd5d

SHA256
e0a5b8dc2987c1baa58740bedbbdd00b8eb26572e3a96a37997e080733367761

SHA512
0a3efa20c92cb500daaca9047b4980ec27b64e2e9541481e4c9fe61a4ae0e226261004ff7a372b1ee301b898eca5646bac86671a82a40b7269b73d7c6315665d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
33aae50f1910fa336d1ea317c2a0a54d

SHA1
fba5371a3ffd3f54fc581bcb6b1db8ca9a85087e

SHA256
0730e3b275ad9745de35e91e15e6cef95792ccedd8ef1c5c0cfdbb07e1b14856

SHA512
fb279e1ae0c687568d29aba0e62cfc9381d72b88bb356add328d6e50551031f36ca42a9bfaeec79abf7dc2a0fe71d567931108aa4e0f716ef435d01d38fa838d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f43573d941665b241778ce9db4e51ce8

SHA1
51fd61bfe3a9bc3f471232467407388650c68f44

SHA256
b62fb47ee516acc5eee71c5b671be34fb0045a2aa13ecb9fbada0747d97710ef

SHA512
61c031cb9f3782dbdce248d50f8dc01d9e977a03f34c3553bc0b680ee6c267ce2c35bd7275e8ed16a1b99563c7e645ddeef136bf05b7211f68006985b5972831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b55ec.TMP

Filesize
1KB

MD5
1e1e1da3f3f167aba7cec9c8e1a031c8

SHA1
c5ce2cf7f7ed8401313c41de79b037abd40bf200

SHA256
4aa282386ecf6aa65e50ba22f8b56324cd00348e832aea9411309fe60309aea0

SHA512
3b3bdda49246f7990a1e531487ac2d9a72184ac48f2a4ad79253d27a5a5143a276774d2634fd21105879b86b1829db5eea3562b65e25a9d24afb750f87b6d744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e531f266-abea-4638-84e4-96786cdc776e.tmp

Filesize
2KB

MD5
9dc72cd5d7f70b1cedf9c9229b733af6

SHA1
9807f100db6c3e294d39cac2db7cab117c413a1f

SHA256
be08faea6e3e4f1657946d99e469bb5deb881c08084794e0b277217fbafaef61

SHA512
7984bb247a44abaf4b0462d07faec7ca968eafbb1c27a955b8ee9bff43ddbf99670b16214fa1f8c70328bb4c981348d654dca8ffe4c668ede85b611f71034bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d99eced26370144c7801cf2b070cc3f

SHA1
2d41bc7a9f37d548e1a8e29a560ef5a04c39c81b

SHA256
022ac01696510ce585d16340185d821a9a421f27f4cefa90ac0242402539ade3

SHA512
9a5b1724ca4f2a5027b183e48dbf2ae58d1a2d9e7a0c42d678c3f53fa341e05a83cb09dcaf25f862297d0d986c185fe805cbef3abb28711577001f2dec26bcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e5c223491d5763401be2c39f6c6d1c4c

SHA1
42127e888551edba98d3344b6aba2ece6e308234

SHA256
0813b83eb30cbd9e9cb4ec07b4583f3a90f336262e67dd427ddad8378bd4c7d6

SHA512
3ad18b4cadf44d1735f21d31b4f5e3eb7c7cd7833d387ba34a9d6739085809f6c92c2442894cb6ea30a7be6b7d07f7bc9083137e7e84e2d7a84cd691ba5ffe09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4769f9c48cef25119a1832fdb6e18a7c

SHA1
d2f5e9576e50990fcc68d10c6bc545b22eed4dad

SHA256
27abc87def51665ff325873b1a36c219328d32c70ac8e855a510ac0e6f44bd2f

SHA512
3d8816c5c2ed468a900a4cc3cadb3728ef5c2444f60dc908537010d4ed9f58ddcd24fd76401fcd53bead6421b83fc17668043cc4f9c8c0268ac403f15bc5cdf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1b6ad096f7ca824b235d65db6cffc91

SHA1
a0399a8087aaa5850f23ac3dd02bfca432a2930d

SHA256
ba1462fbdfa52b198e6359e29a490606498e71dd48eb1da2607413515e92dd8b

SHA512
be84e0bf569eca4ffeb25a377f39767dce7fcf0c53fa16fc2985e28a18c69393e40b0a0c28e87a1609015c3211c5b2d6243fc3be10bd38bb36ac8eb6bf1edc7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
252a4f2bc2e3ac0726148519e5d10b16

SHA1
79bfe73e99db0a12d0beadcaf2e30c84474eef5b

SHA256
a9d735276c73c3605ec4c63a2ebd7622540c1aff0f2478e49b2366b7f8cf47c0

SHA512
b59ae9a73313d77e910d72c92cf47093290cc224a82d9f6475cc16ee671507dcd80f39702a94d2d77abdd169602fc31fdd8510b71f30655b098de97d6cafc351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae071671019add96d4325ba295928d22

SHA1
a7f63f9cd0581361a4f604a8169817fe9b630fb8

SHA256
6bf12029b4732833dc83be247b74fce36ae5a036946322bc7ebc06cc8651e27f

SHA512
18ef2c21e1e76c1ea68256cf27d23759a3159b65fba2c7bbd8d74591ff7798edbe58cf3dfa997f73c096655cf30b68d6db172c24a89c1bbf5f551c0af7e999c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
182e6eabada321b305a3f4deddb15878

SHA1
6ba29bc68aad54adb1897004fc154e8749fe7630

SHA256
7b7f208275c6f325bc6d6565142028ca51d5c56e0b6d636b1fc17a402954caae

SHA512
888e7a945682de59ee648c0b743b34025a83d9c1ab5e5f11807097719cf592fe5ef77c6dbabe30a5bc5ffe763cf88e7261aee29067567ff29d68505345b21487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fb96f3373361ce61e70590a4402f699

SHA1
55c6f9f0b561d9eaf1229b314a6a063135cee80b

SHA256
6cc58e7c0b5c87d11d01e6d01b6d92eb095f3c7cf051ed320f0e9b9aac9bfc2a

SHA512
1e65f759f6f0215d252101f19bce987dff07f9d20e493d57081e835ce44be1c090167ab760196576285452be0f176cfa0af5cc82bc855870bc4619a9690acfbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd64bc490428170133299f0fa5387101

SHA1
a5923c05c661b54786d8cf17918c8302946f39a8

SHA256
8ba6a3c27b80158d9978345b058eeab6f2c83e52eb87e29bfb98785bdfc77926

SHA512
983f19efd3269a5000bdc93aba55f5b59be919081eb3b6be4f65bfbe1c9b68e0450990fcc1c7fb8b415529a5aec885f350eb3ef916b4c19ec980d8ac5f03875a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c6d3f7f52372c4ecd0282b790d28eeb8

SHA1
31e638b2da9a7f57244a3a035ab7305cb0b9da6d

SHA256
3ad044cf6d8a2f5a7f7973473c12a661b226916699812d6863da0fa1b3d1b28e

SHA512
cc240f462eba17370d2077fb9c01d0596f464a50b61834e36117c25025923d697b6ee8f33aeb048b294390a3362b9b2923de2526ea8a8e07d14a6be182fdc431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
6e098e39f45a409454cc480684ee7a18

SHA1
b5ff95575e1bf4a3531b6a4373ce2b5db4eca9d7

SHA256
16d53184a1346d11efd5552491d4fdf61d1160a35ebed3232282f92713f8685c

SHA512
860a9d34b9575606ce51a978e8d5d6ee55b001c0396c34addbf42ddb5c0954a8223976beaf94c4e540fb6442fee452060f08433692bb5751e7dad98a674e9148

Download Submit
C:\Users\Admin\AppData\Local\Temp\05z0t5y3.0.vb

Filesize
373B

MD5
7d0d85a69a8fba72e1185ca194515983

SHA1
8bd465fb970b785aa87d7edfa11dbff92c1b4af6

SHA256
9f78b435099106c2c3486c5db352f7d126b3532c1b4e8fe34ef8931c7b8968d5

SHA512
e5ef339dc329dbba2ab06678a9e504aa594d2f21ade45e49bccd83a44a76dc657f5f44dcf368f4d112bb3b01af2e577a487c6078751943770e90780fad202989

Download Submit
C:\Users\Admin\AppData\Local\Temp\05z0t5y3.cmdline

Filesize
261B

MD5
745611612de6b63ac95f0b91e7aba81f

SHA1
227d50da47e1144570f857467a436aaadf9bca4b

SHA256
3b60436aad2957e385a2bcced7768053088ee16c29562d6e155259633d5cac81

SHA512
02b5b08f8cc36ac0fe7e58c2d1833d7d8c50372d5e88b72016678f1fe3465d39f5d2e885ce85788d8bc8984ceb1023512213381475fcfb5026bd43bb62a6f6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5lgx21s2.0.vb

Filesize
355B

MD5
6e4e3d5b787235312c1ab5e76bb0ac1d

SHA1
8e2a217780d163865e3c02c7e52c10884d54acb6

SHA256
aec61d3fe3554246ea43bd9b993617dd6013ad0d1bc93d52ac0a77410996e706

SHA512
b2b69516073f374a6554483f5688dcdb5c95888374fb628f11a42902b15794f5fa792cf4794eae3109f79a7454b41b9be78296c034dd881c26437f081b4eaea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5lgx21s2.cmdline

Filesize
224B

MD5
d48df0ce0e715e8ebf2eab2fc27f7b28

SHA1
85c5d4ea4c28373b6f92732542f2041602fb1211

SHA256
d5e6ce8df29e40b7ea1a0040050c5c91b641e2ba8418eeef11e99c07d8845946

SHA512
bc0a7f1332f10a79c9ecd7a7b7bf16e47163c3cb08dcf658074283b030c8a57c8a1a56013829c3d1a6f7c53a82f9178a9250cf97f6c83907f105371542a2b944

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFA07.tmp

Filesize
5KB

MD5
fd1c217999ad59d40f62126b9cbcf526

SHA1
aca3f9b8a0c21543519fe263120bcac8aaaa2ce9

SHA256
2494c8ec5254c06760c1a36f06ac63359e476c54b74f42affe44449a8cc6c44b

SHA512
b134bd72a08fa6a3f48ab7f6431c9a305c8e11641604cd4205be969d80d67e03159c2274e3539ccf8dab98bf1c994cb2acf903f1757304631e6c72fe0781d6e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFAC3.tmp

Filesize
5KB

MD5
7cf3bf0ae67b740bb79b01f4c793d3c1

SHA1
9b42c7d49cd484fc4517311dd3dd62305effed26

SHA256
97712384b49f535c256ce94bb0d2f63e8d6c31d8e1fbfa667e2ca4cfe87c1faf

SHA512
68d4a0e2e4df790cd328f43902046b3d653046e601bae15f6450f5752df4e20bac4fee8661e0206d2178b9cc61d90828d0f14b6260b92b057a709586c84bd54d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFB4F.tmp

Filesize
5KB

MD5
f05c04acd171db2084c096be31d3bdf1

SHA1
fa2d4b6db75936e58590ca82d5b74c79dbd8499a

SHA256
2d5074ec7dd35e7ce0c382cbfac50d086fc3cf8932e2bbb8403ec566d9f26211

SHA512
2d1c1632f68a053b8c7c1cfd50585f98dba87aab1b2fed8968c0d66ef867ef3784cebafbd69d8980f9da3f121d314c5fe2891c9540b036c6ed1a1a63605a9354

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFBDC.tmp

Filesize
5KB

MD5
c4c16dda146238bc0d6c82b60b2fb9e5

SHA1
1eb112507fb0b4eefc0d7b5410024468519823a2

SHA256
7385c9c7f5cd39f2f627894d68cb6cd0a4d2e1af4bc0158aafcb0d7fce6dc40a

SHA512
70249459ffb5ad911ccb86f7af5c486a5d7e533d1311a3698ae59bef8b5ddf7a9a6830693544748b8b22b5853d6652d403d475d16bd2ed41ed0644880157260b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFC59.tmp

Filesize
5KB

MD5
8dec1ce846875d72c6d47731f03ea0af

SHA1
4765bee4bb1296bd8c7aba3f88dd0255adab70c7

SHA256
c8a04e42010efbf6020c16215b71c8a288885fdb90fd64faa0ec9d5922dd5418

SHA512
e8b280136070bc21edb386d19913c40f20fa28a7412eb169436cb18595db4c080ac9593a55c3d9decfe856b4d7d3bb9536177cc6d4a84f05cd397fa6435b945d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFD05.tmp

Filesize
5KB

MD5
3f3854927ada121a84f38f0dfe63f0a6

SHA1
ca06b7905e470791e9bf7bb6a9cfce5534a88302

SHA256
65957891e6f37785e2b6c33e66469e7a4119b96adc2183b7062ae065b0551107

SHA512
e7dd70a7e4d41d9aef38e37c33adabac54e8fdef8b99c68f4b334399d3cfad47b6d10729493fb293aacadadd46dc04f146003fce7327e0bc6f86a3951dc18bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpwaqokg.0.vb

Filesize
376B

MD5
7a8e43324d0d14c80d818be37719450f

SHA1
d138761c6b166675a769e5ebfec973435a58b0f4

SHA256
733f757dc634e79bdc948df6eff73581f4f69dd38a8f9fafae1a628180bf8909

SHA512
7a84dbe0f6eebdc77fd14dd514ed83fb9f4b9a53b2db57d6d07c5ff45c421eac15fdc5e71c3bc9b5b5b7c39341d8e3157a481d9dacefe9faff092478a0cea715

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpwaqokg.cmdline

Filesize
267B

MD5
907de00fb871e2972deddf70d4f3e5e9

SHA1
7c1dacc4415a4b69b3901ba1caf5ef8feed179f4

SHA256
37b94e1767a8634dd472678da93873a941830312cd00763dbeb3241775fcbb64

SHA512
37f04ba523638752beca0dd39319fb2b15c21c8d5eee7e6a7e7c9c333fc1c1ab1c2e765076bb529fdab2781632b5d1df74aaa312af2ee19e9db3cdbce3bf7130

Download Submit
C:\Users\Admin\AppData\Local\Temp\e9em0fiw.0.vb

Filesize
369B

MD5
83f6067bca9ba771f1e1b22f3ad09be3

SHA1
f9144948829a08e507b26084b1d1b83acef1baca

SHA256
098cd6d0243a78a14ce3b52628b309b3a6ac6176e185baf6173e8083182d2231

SHA512
b93883c7018fdd015b2ef2e0f4f15184f2954c522fd818e4d8680c06063e018c6c2c7ae9d738b462268b0a4a0fe3e8418db49942105534361429aa431fb9db19

Download Submit
C:\Users\Admin\AppData\Local\Temp\e9em0fiw.cmdline

Filesize
253B

MD5
296108d2869e1a13ec7fad333479fa8e

SHA1
561092d2d5855f37774b5d8341ec8a2bae4b8817

SHA256
dcf72b4b84deaa720101b1fc81fb7ec3a48b200fcb2cfd55a21c01985dd64e4c

SHA512
2299dd086a3f443d4ec2c7220ca5d0956ed06a4adc7832ebadc3febd60f8d3ba224eba62b5991e9ad1d1ea5abbcb3aff0cc7d97549059e420d8d62fc86b18899

Download Submit
C:\Users\Admin\AppData\Local\Temp\ioqf4x0k.0.vb

Filesize
355B

MD5
acd609faf5d65b35619397dc8a3bc721

SHA1
ba681e91613d275de4b51317a83e19de2dbf1399

SHA256
4cfd86d51d0133dda53ba74f67ffe1833b4c0e9aae57afe2405f181fc602f518

SHA512
400ffd60ce7201d65e685734cea47a96abca58ca2babda8654b1d25f82d2766ca862a34f46c827249a4dc191d48f56005a9f242765d7becdda1344b8741a9d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ioqf4x0k.cmdline

Filesize
224B

MD5
19aba1457098a429435d96ca3e8b94dc

SHA1
cbac4c98ba641768e786d5a75d20bb0554410d66

SHA256
645d73398e4813bc5775e43800fbcf405956802541da734566dd1462704f5064

SHA512
aada2fa4fa6cdf2549b4f26907860e3d20fc28529da1c4ae3f45dadf11370661f73e9bf4a508d9ef934c9f3a5b8de1ae80164af262ba92c556517e1a62bd47cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfzd4tp6.0.vb

Filesize
373B

MD5
197e7c770644a06b96c5d42ef659a965

SHA1
d02ffdfa2e12beff7c2c135a205bbe8164f8f4bc

SHA256
786a6fe1496a869b84e9d314cd9ca00d68a1b6b217553eff1e94c93aa6bc3552

SHA512
7848cdc1d0ec0ca3ec35e341954c5ca1a01e32e92f800409e894fd2141a9304a963ada6a1095a27cc8d05417cd9c9f8c97aed3e97b64819db5dd35898acac3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfzd4tp6.cmdline

Filesize
261B

MD5
ceb9d4ac2fe1cc5cc07d803791698d10

SHA1
301d8a3ee6db4382fb416635eeac05300ac8f5ca

SHA256
08d053a4fa688009936b32e1b05a81722ade45afd295ef21b72182fc49f123df

SHA512
9343aab62b52a8144cb745293ad2e396e47cd359a544d7b99fe5101c874dcaa149ccefe09b114cf4a0362bfbe0485f6ede427bc0b80e785fdd3acf601d73770b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt

Filesize
39B

MD5
502984a8e7a0925ac8f79ef407382140

SHA1
0e047aa443d2101eb33ac4742720cb528d9d9dba

SHA256
d25b36f2f4f5ec765a39b82f9084a9bde7eb53ac12a001e7f02df9397b83446c

SHA512
6c721b4ae08538c7ec29979da81bc433c59d6d781e0ce68174e2d0ca1abf4dbc1c353510ce65639697380ccd637b9315662d1f686fea634b7e52621590bfef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc471EC9589E9041DA938235B8C96A291.TMP

Filesize
5KB

MD5
2f97904377030e246bb29672a31d9284

SHA1
b6d7146677a932a0bd1f666c7a1f98f5483ce1f9

SHA256
7e033003d0713f544de1f18b88b1f5a7a284a13083eb89e7ce1fe817c9bb159f

SHA512
ddf2c3a3ec60bed63e9f70a4a5969b1647b1061c6ff59d3b863771c8185904d3937d1f8227f0e87572329060300096a481d61e8dc3207df6fe0568da37289f54

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc4B5FE0CD4834A4AA2B8AC25E27AD6D.TMP

Filesize
5KB

MD5
d01de1982af437cbba3924f404c7b440

SHA1
ccbd4d8726966ec77be4dbe1271f7445d4f9b0ce

SHA256
518d9922618db6eea409cee46b85252f0d060b45c2f896cb82eeca22eb715598

SHA512
a219cd3df17bcf16cb57bdeea804e206a60be50084e2cb99d6d5e77d88957d79535d110b34735a4b549d3fcae528cdff8bfa5286582028ef22e8b4d60e146878

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc577095179CB4E3F89238E21B43426E1.TMP

Filesize
5KB

MD5
d56475192804e49bf9410d1a5cbd6c69

SHA1
215ecb60dc9a38d5307acb8641fa0adc52fea96c

SHA256
235e01afd8b5ad0f05911689146c2a0def9b73082998ac02fd8459682f409eee

SHA512
03338d75dd54d3920627bd4cb842c8c3fefad3c8130e1eeb0fa73b6c31b536b3d917e84578828219b4ffd2e93e1775c163b69d74708e4a8894dd437db5e22e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc82544E8F6EEE4DFCA8EA41323ED37DC.TMP

Filesize
5KB

MD5
5fb831248c686023c8b35fa6aa5f199c

SHA1
39760507c72d11c33351b306e40decaad7eb2757

SHA256
d062acbeea69acb031b014cff19bed988cf9df34c230ee23d494457461b41908

SHA512
2244f84bff19e1f43a245569d03712ab62a9655bc6f3eb4ae78ca3472ddfc6ad7950dc76d10cdc1c7b2235a9045582554c200e93c3cd34c18e494ed60dd3b3ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc8CAACB8FE1984209A5B4AB13BE6FC6A.TMP

Filesize
5KB

MD5
249d49f34404bfbe7ed958880be39f61

SHA1
51ec83fb9190df984bf73f2c5cd1edc0edf1882a

SHA256
fcb5a4d24f24fbeaf4dc9d8e29f2701b2bb71411acb13c4fa67fe7025892912b

SHA512
082f47f59b9184dd6c88f64214e10b82656a09c5a5cf3f0eccbf7935505db473eeb9a395cb5b59ec5009e731f2aa1891670c94ff6315a0b2d4fcc0392cff0e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcA337FD03A05D421688F422743463513.TMP

Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB962F834D0CC46ADBD3810B3527E210.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcCFB7D68EBD324713A3816F68378EFD6F.TMP

Filesize
5KB

MD5
abeaa4a5b438ffa58d07d9459e5c1d6c

SHA1
69631de7891162dd4840112a251f6531feae7509

SHA256
ce174412cb2889bbf162b7ebe4476da5a9c928ba5b13111d338753ccc4c0f5fd

SHA512
c9cae8bcc14661e993d97a3c7b658310a8b9c19044817589f92eab66f1bcfcecb3468b0de8b45cd68e218c23cd9c60aeef1d391af36ec03afab5c8b86d7937d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcE3012802D13D496E85394AA4C824461.TMP

Filesize
644B

MD5
dac60af34e6b37e2ce48ac2551aee4e7

SHA1
968c21d77c1f80b3e962d928c35893dbc8f12c09

SHA256
2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

SHA512
1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

Download Submit
C:\Users\Admin\AppData\Local\Temp\zipw1abo.0.vb

Filesize
369B

MD5
e4a08a8771d09ebc9b6f8c2579f79e49

SHA1
e9fcba487e1a511f4a3650ab5581911b5e88395d

SHA256
ef4c31d167a9ab650ace2442feeec1bf247e7c9813b86fbea973d2642fac1fb6

SHA512
48135e0de7b1a95d254ae351ccac0cb39c0d9a46c294507e4bf2b582c780c1b537487161396dd69584c23455950f88512e9931dbff4287c1072938e812a34dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zipw1abo.cmdline

Filesize
253B

MD5
1b70f2300732563c194ffb9394b39574

SHA1
b5d221629e773d993e1fa2eca8508b2f777f54aa

SHA256
c82fff507994c663b060fa3c51164685cf732dd277c7c7853c6606e11c84ce59

SHA512
ee6b081ccfab01368c42cdaa2ed74b95fbd3b47e9305f02f7e239112171280140d62b7b394cfb55e7f69984cf52ccae1d0441086e27f9bd8f4062c9de24e15a3

Download Submit
C:\Users\Admin\Downloads\Blaster.A.exe

Filesize
6KB

MD5
5ae700c1dffb00cef492844a4db6cd69

SHA1
bed8e439f28a1a0d3876366cbd76a43cdccf60fa

SHA256
258f82166d20c68497a66d82349fc81899fde8fe8c1cc66e59f739a9ea2c95a9

SHA512
2cc1ec68df94edc561dd08c4e3e498f925907955b6e54a877b8bc1fb0dd48a6276f41e44756ed286404f6a54f55edb03f8765b21e88a32fd4ca1eb0c6b422980

Download Submit
C:\Users\Admin\Downloads\Blaster.E.exe

Filesize
6KB

MD5
8676210e6246948201aa014db471de90

SHA1
86b30d1a8b7515dcab6c8d2781b85c6983709dbf

SHA256
2e481059b9bc9686c676d69a80202eed5022c9a53ecd8cac215e70c601dd7fdc

SHA512
5130e6ea6c5e1924af7d630a7b1c6e614b1482edcad3117a8dc56371269260b97793a7ccdbf3249054815b7c3b9c364b30e73e0f8e4cc230502b01d0d2f70bda

Download Submit
C:\Users\Admin\Downloads\Happy99.exe

Filesize
9KB

MD5
02dd0eaa9649a11e55fa5467fa4b8ef8

SHA1
a4a945192cb730634168f79b6e4cd298dbe3d168

SHA256
4ebe3e1af5e147c580ecce052fe7d7d0219d5e5a2f5e6d8a7f7291735923db18

SHA512
3bf69de674737ca15d6ff7ce73396194f3631dc4b8d32cc570adeeacdc210acee50fd64c97172ce7cc77f166c681d2ccd55955b3aca9188813b7ff6f49280441

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 132963.crdownload

Filesize
72KB

MD5
da9dba70de70dc43d6535f2975cec68d

SHA1
f8deb4673dff2a825932d24451cc0a385328b7a4

SHA256
29ceeb3d763d307a0dd7068fa1b2009f2b0d85ca6d2aa5867b12c595ba96762a

SHA512
48bbacb953f0ffbe498767593599285ea27205a21f6ec810437952b0e8d4007a71693d34c8fc803950a5454738bea3b0bafa9ff08cd752bf57e14fedf4efb518

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 172535.crdownload

Filesize
5.0MB

MD5
c52f20a854efb013a0a1248fd84aaa95

SHA1
8a2cfe220eebde096c17266f1ba597a1065211ab

SHA256
cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30

SHA512
07b057d4830d3e2d17c7400d56f969c614a8bae4ba1a13603bb53decd1890ddcfbaad452c59cc88e474e2fd3abd62031bf399c2d7cf6dc69405dc8afcea55b9a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 688646.crdownload

Filesize
205KB

MD5
0e10993050e5ed199e90f7372259e44b

SHA1
2e7a515c81926ef8a3e1e533c2f58f57fdbfade7

SHA256
8f533a5adb18c8e02779636e9d7dbb4a6cf13e4f60ee435b9afc3504b308d68a

SHA512
d98b5c7a2d307451866a11bae8b3c7524d968c03e40bf1daa5110b8650c9edbf6b64cfed1052574ebd723e73b4c614358b3bc6442d1a21134c157971989f4d1d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 748009.crdownload

Filesize
373KB

MD5
30cdab5cf1d607ee7b34f44ab38e9190

SHA1
d4823f90d14eba0801653e8c970f47d54f655d36

SHA256
1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

SHA512
b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 754449.crdownload

Filesize
3KB

MD5
6f5767ec5a9cc6f7d195dde3c3939120

SHA1
4605a2d0aae8fa5ec0b72973bea928762cc6d002

SHA256
59fe169797953f2046b283235fe80158ebf02ba586eabfea306402fba8473dae

SHA512
c0fbba6ecaef82d04157c5fcf458817bf11ce29cdaf3af6cac56724efcf4305565c6e665cdcf2106c675ba0574c60606be81d9baafe804fc7d2d3a50fed0baf6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 89688.crdownload

Filesize
32KB

MD5
70f549ae7fafc425a4c5447293f04fdb

SHA1
af4b0ed0e0212aced62d40b24ad6861dbfd67b61

SHA256
96425ae53a5517b9f47e30f6b41fdc883831039e1faba02fe28b2d5f3efcdc29

SHA512
3f83e9e6d5bc080fb5c797617078aff9bc66efcd2ffac091a97255911c64995a2d83b5e93296f7a57ff3713d92952b30a06fc38cd574c5fe58f008593040b7f0

Download Submit
C:\Users\Admin\Downloads\metrofax.doc

Filesize
221KB

MD5
28e855032f83adbd2d8499af6d2d0e22

SHA1
6b590325e2e465d9762fa5d1877846667268558a

SHA256
b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e

SHA512
e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34

Download Submit
F:\svchost\svchost.exe:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
memory/1124-1138-0x000000001C130000-0x000000001C192000-memory.dmp

Filesize
392KB

Download
memory/1124-1137-0x000000001B5D0000-0x000000001B676000-memory.dmp

Filesize
664KB

Download
memory/1124-1135-0x000000001BBF0000-0x000000001C0BE000-memory.dmp

Filesize
4.8MB

Download
memory/2556-2101-0x0000000001650000-0x0000000001658000-memory.dmp

Filesize
32KB

Download
memory/2556-2100-0x000000001E010000-0x000000001E0AC000-memory.dmp

Filesize
624KB

Download
memory/2556-2099-0x000000001DA60000-0x000000001DF6E000-memory.dmp

Filesize
5.1MB

Download
memory/2556-2012-0x000000001BC10000-0x000000001C03E000-memory.dmp

Filesize
4.2MB

Download
memory/2976-2228-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-2226-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2233-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2193-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2414-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2246-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2262-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2369-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2245-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-2272-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3864-1140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3864-2204-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4028-2230-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4344-2372-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4680-2368-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2235-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2412-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2250-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-1899-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-1913-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2261-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2147-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-1959-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2111-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2120-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2203-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2299-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2002-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4680-2180-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4980-2225-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2263-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2370-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2300-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2234-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2251-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2247-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2416-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5044-2200-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5052-1141-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download