hxxps://filebin[.]net/gz9ftbodmbjb5b0v

Analysis

max time kernel
179s
max time network
180s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01-09-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://filebin.net/gz9ftbodmbjb5b0v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 19 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Apex_9.1.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Aurora_Worm_v1_-_Cracked_by_RoN1N.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AsyncRat_Release_Last_Version.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cyber_Ghost_VPN_Checker_by_xRisky.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Dracula_Logger.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Digital_Keylogger_v3.3.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ARES_RAT_V1.2.1.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ATT_Worm_Cracked.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Apofis.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ARCANUS-master.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CobianRAT_v1.0.40.7.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DarkAio_-_All_in_one_Checker_-_20_Modules.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Babylon_RAT.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ardamax_3.0.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Black_Worm_6.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\cybergate_v3.4.2.2_full_private.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\d4ta.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DalethRAT_1.0.tar.gz:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DiamondRAT.tar.gz:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1076	msedge.exe
1076	msedge.exe
3136	msedge.exe
3136	msedge.exe
1624	identity_helper.exe
1624	identity_helper.exe
1652	msedge.exe
1652	msedge.exe
2604	msedge.exe
2604	msedge.exe
3052	msedge.exe
3052	msedge.exe
3860	msedge.exe
3860	msedge.exe
1556	msedge.exe
1556	msedge.exe
2180	msedge.exe
2180	msedge.exe
704	msedge.exe
704	msedge.exe
2336	msedge.exe
2336	msedge.exe
3260	msedge.exe
3260	msedge.exe
3916	msedge.exe
3916	msedge.exe
2908	msedge.exe
2908	msedge.exe
4992	msedge.exe
4992	msedge.exe
3548	msedge.exe
3548	msedge.exe
1056	msedge.exe
1056	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
4388	msedge.exe
4388	msedge.exe
3556	msedge.exe
3556	msedge.exe
696	msedge.exe
696	msedge.exe
4544	msedge.exe
4544	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4972	7zG.exe
Token: 35	4972	7zG.exe
Token: SeSecurityPrivilege	4972	7zG.exe
Token: SeSecurityPrivilege	4972	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3436	1076	msedge.exe	80
PID 1076 wrote to memory of 3436	1076	msedge.exe	80
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 2548	1076	msedge.exe	83
PID 1076 wrote to memory of 1636	1076	msedge.exe	84
PID 1076 wrote to memory of 1636	1076	msedge.exe	84
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85
PID 1076 wrote to memory of 2060	1076	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filebin.net/gz9ftbodmbjb5b0v
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffab2203cb8,0x7ffab2203cc8,0x7ffab2203cd8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6992 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1232 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8116 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1236 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7592 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7604 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10582073004680514562,17104037471855810697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1600

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\*\" -spe -an -ai#7zMap24889:1436:7zEvent106
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
8.9MB

MD5
6f187b31ba9799fc00a2890c9b6f1c0f

SHA1
4ef3f624e674d279db437aff0120050a38cfe645

SHA256
7569fb1f7658153d260738869614a2bc8dbf83434d6e405ae69cbd2dfa7019f2

SHA512
a0c36f676007ba0c764509ad6a0e57a222d16577c71e0d70f5b5eb6e1e3d42e032742a7e4692ed77a573874f9ca01182e234071eadebce40fa168f3059f81e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
2.8MB

MD5
c81879ffb407f44bfdeabb05b53e57db

SHA1
bb238a29ed3f6b0e090ac3d3f62cdc72350d78f3

SHA256
3132ad8ed76c89b8381964ba257fac31ef117c42f7d98ba9a752cc68b5588143

SHA512
32f191f3b51c69688dc1405dfe6c3e5738efea824ef3683c437571b555cd846451ea8f30f3fdf6ad58b0744189a59466b694474db8f103ef9eee0876580c5e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
4.4MB

MD5
9e4bfba90ea03295be35bb4161841a16

SHA1
0ada1d150cefb9dcd6a470f0114569742d629981

SHA256
341dde312d2216fa65daac2bfd848f0289b0e028ecfcc18f6a8aa2c2db0714ad

SHA512
51e6f7f152b7c67e856986ee0948148b5a38bda9a06f3f7b570f0b9075b0b89914e1a59eb4b171f088443ff214c7c9057b5d856b67221986199d314cd1f975ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
5.0MB

MD5
652cf4af1e0c0aa9eeac6cd95afacde8

SHA1
929db9399ba6f3cf35e118ae15b3b4dc6fc1ba5a

SHA256
92cc0815f908c20f6971697fbbb874cd6ac5424e8ceff79bb9e11bbe280a9e0c

SHA512
5e23ce78689fa7161f43e9b4f299fbc7fb6ba58e8e51eba37a89a9cddb8cd4853718b6798bced9aaf9590019443e84ea99bdb7383c02d7fddc6bc50a4eac871a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8aabd42c37b74714b8b83b0f464bcf0f

SHA1
1b757a9209b720ff6e5ddb0b93461687d854c5f0

SHA256
a437c542a8108b60b161d218e0139d84b563b8f2decef3e98e94474ec5f1915f

SHA512
6276c3fd9df042edb6c1db48351571f9b4797476588c8e7104b38da5f4bcb5eb05e33c5ed7cc2830b41e47bc48ce528b734bcad39f3e6ae3fcd06f8684df76d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
83074b00372c596f0c0223269315b6f3

SHA1
ca2fadc886244ee8019d1c8aef031ce7815e8e77

SHA256
5a2dbbbe6411e7e710042496d5b07c249d4d79003d1803994bac4a377f8f3028

SHA512
86233a744e7992ed33adb2c5602eacd8c234835262194234dd4119b8bfb71ea2ac5510c2757fe45dad6918b811dc0c360cc3537adb9bb27a4742aabe417e4223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c67ec49be198d09031ac5c9ceeccedab

SHA1
20b4a30d04b85b4e284b01b7cb2e6fde6bb904e4

SHA256
6e3dea54ea54e30917b0157d4a9816ac17d9b955eaf21733c788f14f77f3255e

SHA512
452aced50e1f0cb14a708b90fdfefcbdf7f5c6a262b2d949e056904455f02918d52b61562c3f308f8340b034855c7b4ba7726d81c9dd4fa249a856cc9add1c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aea533d5c0eb732704afb4727bbda60f

SHA1
931554e1b8c254deef2e6788b13cafc8da9a64af

SHA256
b788497cab00ee24e7bba74b52b55cf7e85dbe83d2fca8cfd63018dd61ff6e4b

SHA512
6cb2e8f21375fefb79ca85efcef6467daee348bdc584cc19dae5e81ca7629b57aff2c31aa1358b12f93e5124e4226c90c24491f764e3327625db59869ce2f39d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3e42a5e8ede77ff258f7a847150c388

SHA1
d4ed1f397fd1fbf7e554d548dbd0190d265dd35a

SHA256
0a616e1e75c0cc262041be1fbf9433daeb8b03974fbbe066b3a5ca63a2c0d3ba

SHA512
293537fe28dd5bf238a75206fdb608f93652e3c0f5570394a364514c9fcd9557b1a230d4cc98002011a10880707be5cea7ba4af45e178e9f22bf78d80921da6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8057a0e945e7e3764454d6d23c3196a4

SHA1
6bd782181ad57106584afdca6b5576ff55953c89

SHA256
708f3ba47d0e4b08467f68763c3a4255ff88e54f8666e81b90ccf6b0e37f95b2

SHA512
468d51b36c7f349ea7b24de3cca4ac3038c0f209c0df7001e785e536a7fc26540be85e6f57b3a3103143fd282f97c78084d09f46ae8a419cd4086d6479a111a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
59a504c1d32d75d4d349c07102a9a06b

SHA1
bcee56e42edd314d1216575b5da18819a3bd892a

SHA256
8b5a25531677cd1849eb33b5a5d224b65bbffe7ae4c6ba4b72fc3b213f2982fd

SHA512
be1d9241beff5db6c51f2147eaf33ff464902bf2d5c8ae4e4243a565afe4190e1c394329c6af82b31812641cfbca90fd400b0a137fc811b68e4076ff24dc23ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
8746c2e3f808dfc589decf832f6b7421

SHA1
a170a8f404226d34475f7e3b802b905764e66e7f

SHA256
ab67e3c2be12953ce19e886a4be6baf27c599f6a47384ccac5d9f2d35c5101a8

SHA512
a339329f1d67def8c2356d3c8f270b1dbb10fa0b1674b856aa3ca5b6bea119287febe1156bddddeb063d9c519de691aa51f22364513de4c396c4df0357af8bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
0f7afe030dabcded596f3ef67416289e

SHA1
4fb0029c920be7427d7b4abc45c3d1d5d2ede69d

SHA256
9ab453fdad43e05752c78baa7ebfb920433d533df10e198ffbc742dc4604e581

SHA512
0b80e5a03f3998e75def8bc4472336e6fc494d2773651e3c8d53df49db8b73c664043f0855de638c37307a7766191f97104e5c9ce405c1b7d7dda49e72230897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c30d.TMP

Filesize
203B

MD5
d4269787ebfc92135cecc3c28cb20eb0

SHA1
834dc0b67b147e0f6d7abe122c9cdf6fba08092d

SHA256
7ae3c231427126dc27317edcdea7d02678c59da21717c2cac4c0e0d3d4db0273

SHA512
f2332b9af7b46cf24dee6ee861fc7990b4abc696a6f8df5f820c5a4b169c69cb8674f8df8afa85c95ffa461d3e781bb558dbe3fba00684448d904973f2d9f03e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc529481-b18d-44c2-8322-d2adb3611a54.tmp

Filesize
370B

MD5
c8c2e6a06045fbb047ad9bd8078a06e7

SHA1
19b23a9df917e5df8c81d9010606c720b973a19a

SHA256
75936388f7334794dfe83c68011228ca59ea1d18564946e711c6ef08fd6d181c

SHA512
c7f1a7a390a8b994752bced22d6e4452a12a428d240de168cd5165c7807d8b2cabbec9bef92d97a0b8299b9257f8aa33a18249e4a45a231b9d2f3e7ff122e6ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78aa9f4d0c6e44682de0515f5f0d2c25

SHA1
5d0a8dd6683228cb9cee60346a35794c76bccbd6

SHA256
a3a2f83beac1820849251c3d783ca1bea6a6e21096a8620ab1ad58286f58eee0

SHA512
46466e4cdf23ed19cb655803f1e505c4d3baadb77a93aa44a303ae8472d1945d150dbe9f3eac779a75e17c7c7552b3304353186130d95aca56de5e3e82babb08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da81ce9e1ff3421fd5209de165183fe6

SHA1
d324528750f84dc3604c212065284567c3b650f9

SHA256
b3969d010a1a5016a707008f5e1f8b0fd2e9f759915071b98ef9ea8bf6c19bce

SHA512
afdee2f719fb06d70a19b085a92e35c990ec97c2d05e32938a13e279823bc18160249eb4fde5243f7f70ea45c9370145b9e35245c4d1c80bc269314d8dd5676f

Download Submit
C:\Users\Admin\Downloads\ATT_Worm_Cracked.tar.gz

Filesize
2.6MB

MD5
a42eb1a7a5a4564e7229f910eaff1014

SHA1
298ed7c6d836f2d8fa08f8194a44c59aab551487

SHA256
ab06abe5d23aa312336c2400be5cffafc28711596754fd11ebc078569bbd444b

SHA512
093b12096714e7bc5e72525f1284e7341c9fe2db0a7c665e429424418b1ffd68d622d75e82675b2e163633c58e0214d25cb12213323a3aad233378dba57f49cd

Download Submit
C:\Users\Admin\Downloads\Apex_9.1.tar.gz

Filesize
2.5MB

MD5
3c2d34ce6affb3e8aa05850b5647b97a

SHA1
821ba81b5df7d9b30afe2df58969b99d9cff6249

SHA256
dd6266442cc4fee9a496b625d378391ae3fff548111adbee20087ca0a706c377

SHA512
2ee81917cf651515b5da1c352d116ae16af8d0b5161d60a722726c947457431e45d24896f8fa09d371f3086ffe5e79af809accf5aa7ddbb3fa328b9e16e63fdb

Download Submit
C:\Users\Admin\Downloads\Apex_9.1.tar.gz:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Ardamax_3.0.tar.gz:Zone.Identifier

Filesize
60B

MD5
0ca2a805250350c14f070197905dfcf3

SHA1
bc242e11d1331adf15b0488fbd19605d62af3748

SHA256
ab18581c5a608e1e733c9656fdc75eff9674a485b176f69edd6d6a86b9b283fd

SHA512
5835ca619efe645b4e4d087c5065f5413e7509566b973343166fcf851636651efe8c47bfc2df3fcd95df6ca70a52ed9806e8d725ad4936a0bde1bd0b9d755a2b

Download Submit
C:\Users\Admin\Downloads\Ardamax_3.0.tar.gz:Zone.Identifier

Filesize
637B

MD5
65cfeb38427d1c6d412709c42b9fa2de

SHA1
8e105d6c663f4afeee8b263dfd1114d76be6ebde

SHA256
e6e3924a1f59c33be03f76a43656a5dafe85f36860e561f4a2fed8a7a6205717

SHA512
05c578fc0b800e3c3a53598f5ec002eef775e824a3253cbbc3e1be7b45c33a2781f54df8f670e04b03bcb842001c112040e42a2f1f740e9bdb84b174f72494d6

Download Submit
C:\Users\Admin\Downloads\Cyber_Ghost_VPN_Checker_by_xRisky.tar.gz:Zone.Identifier

Filesize
659B

MD5
a74f417a37b725b90f8b7272f856171c

SHA1
d19c1cda89770a141b9069f675c9d36d66b34b7b

SHA256
48345bf720402d0801a9874fa6850fb7cb2d7130f24529015d7e485d43aecfbd

SHA512
74f9cdd9d15dc7eb9e0e78f71ee15adf4c3a7e4c6640363216d4ab732b8d0cc125badf69a39f88d11a2edcca0d9d9a49916bc2269c4d6673ecfe30d40899b387

Download Submit
C:\Users\Admin\Downloads\DarkAio_-_All_in_one_Checker_-_20_Modules.tar.gz:Zone.Identifier

Filesize
667B

MD5
41f41afad4fa781c22a294ea87abd37c

SHA1
08d9992df34a7abe79635bb840397033555ca527

SHA256
869abca3ea4e6ed55587df0d5bf331b65898caff5f2832e0f947aa1991fffc79

SHA512
2fadf4a72c1129de6aa1c585cbdeb5c0249669555a4d6672d0235651a7c8b7416742aaab3a5b6635f9735cdaac5ef66ae676e28a92c56cfce6c5b6a6b6dfab7a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 285362.crdownload

Filesize
16.7MB

MD5
3a4e45dc95e3f75fe16073a1fd690a54

SHA1
cc606d36e60f2e484131cdf96bf5264ce1c46144

SHA256
af94e9249ac4d0ba5771ed71639bd41a015ddd34682bb9479127dd5bde8b7b4c

SHA512
8c8be1856b15577227430944f03eddb69b386453bf28b3fc6a1588c6339f08827358ecd1ee03f365b4a92741f3b81f20bc9ae07a395cc9649ae0483faf9d0a10

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 285622.crdownload

Filesize
7.2MB

MD5
ec9aaa7e24a0eae04b467ba434ba89ce

SHA1
b0dba93043bb5388cff1835ef9737db2e002caf9

SHA256
d7162e5a9e4c59efdb91d77ecab7ec6e4d3e8e1cb4742587ebfba4817e10872b

SHA512
44dfeb3a03e3c842872b10fdc56ba35fc54131daf934ecfe727d0486449c8ddf5c1bfadb7e2e352fdb6f6a781b725df9e2e5ee7c09275aaf9adf32686f64d250

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 326466.crdownload

Filesize
3.1MB

MD5
d6d2c976785f2fba9d2299e24ab2c81d

SHA1
a41c5ef1c8103e333850941f8996fd5cdaa485e3

SHA256
6fa6f367a03b0b57c3a31d9f041eb8c6cc67178aa940040e4fdfd2a923764f7f

SHA512
6f86e8ab5fc7a639d33c5b028022e0bf3ffaff480f89853271db8e8fffa749c702b41b1407f020dabcd7f05ccdeb272c64e2cbd8fa86f9bdfff3828f33be229b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 45404.crdownload

Filesize
3.7MB

MD5
31d7098ba89e70ffca98394e3ff17de7

SHA1
4012bd80a27b2c7e2baf67823d5f2cb93a5b2b71

SHA256
ed8715b31b74c355afe231226c41caa4b9bf284fdec531a2ea89b49a8878c235

SHA512
bdda085bf876c3c7657acb164ea5edf3d49bcb76a9606abb62ed1a54c4acf2fcdd2190be3ceeb077d201f6e8727ea688e684aba81aa442eb5a72355178b36335

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 567261.crdownload

Filesize
2.4MB

MD5
8aff035946b7352180d24dcc2cf71726

SHA1
77a6f24764d2cdd23314e1db3864b252b3114074

SHA256
23f7a1ad1e3fa188ee36796de4a7ea13297a21ac4756137e350942cf8fab269c

SHA512
47b8ca870919603c22c7782a1aceb7cfd77509e1a5907447a471900d331f533edec6b5b976b46b0f0c32eb72215299b1691b696cb00953b54de5024d57b50add

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 65888.crdownload

Filesize
3.9MB

MD5
7740300f0beb20c26b04de4fe186aa7a

SHA1
49ce8396e14f610844678c648d7839a041f412f4

SHA256
c8e9c0b80390b61806da535dd4a65bbdda0618c9a3aed03dd0a677ece56d4889

SHA512
634595bc73997f1829f61fdd6d09e92eb360c64cf478472045aed6cc21ac803bc2f6f9e9d18f63d260851a043806c647e7ca2390fa8918ce85adbce234bebbc3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 701390.crdownload

Filesize
7.0MB

MD5
14ad9f24007b367f3ef13dc302d2e0fc

SHA1
587becaf11fc2d75fb827283e2dec01790a3e2e1

SHA256
50264d582240de2c7d76eb8257a4bb27c459c7a17619bca5f36525d7b5ef76fc

SHA512
a7436dc66a7d91db55daa82458baa5b05c4375fe5a5c85476c4efecc48a916201103b0113538ef756f6a06f6e5a3a60b3a50b5f3761b2860e2af0403f951dd30

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 775971.crdownload

Filesize
4.5MB

MD5
515000e2d26c9c291385335e782d1531

SHA1
55231005897f28751405cfa480eb6b05c10f0af3

SHA256
630c66b7d2c1335347106e197c177d4b4c4aa7d957b61e4b4d33eca916dd6717

SHA512
c55b22e3b46b5c06d5f777324b913c86fedd69a719c8e490fa1e9ea95620f5116fcfec09db59f9b904f0a76c30b5876fda22b2ebefab4d63a34b53b46838a6e3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 886571.crdownload

Filesize
3.3MB

MD5
b88abfa864c2245e18699ad435f5d356

SHA1
caf5ff6b6b7d42947393f267158d331e92e65e5b

SHA256
b7fbaad99b3cb3d1c56708e6ed9680af7cfa0fd99cb8d35784ed0ae8f620f3bf

SHA512
ec97b9859b9c3f5be05a807b809adffc28c8d8b558e2937789a31a75f5ac27314c722730f1ee636ee75d6b17ec6cb0fe9ebece1250392c6135da7ebb47cdbf27

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 939356.crdownload

Filesize
5.3MB

MD5
34f3eca316f9fa7211c99567fe4186fb

SHA1
51cf89879801ddfe5af6b89699502236258e08bf

SHA256
3f13d3fba019d8b4257d6acbb04a26ed56ca7eff45177e314c4c5cbb2913cd84

SHA512
54c911dab70a12f54e6a49de0aa90a1187f3942f6d0431c2e0e32231c00ed7a159a28d94b1fa211f737ea728316c45ed87820e99e2c68ec005c752678bd8fd61

Download Submit