chimera | 9859eb9128b962a0d882c7205aa6f5310cf48bab15636a2eb55d81f043644e70

Analysis

max time kernel
1500s
max time network
1499s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-09-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_20240822_150406.jpg
Size

584KB
MD5

5097affc6842d19aa393f03c4138e640
SHA1

b24b8fdd3db9c20eb3687124941b35661ee534c1
SHA256

9859eb9128b962a0d882c7205aa6f5310cf48bab15636a2eb55d81f043644e70
SHA512

6bd73c88cd4b2f7655f073a9e8721b6e448546ab4a41db7eff82f6e001f20bb5d95199fe998625dc381a0420a0052ec026cf963554fc0de69eb30a9e4629c2df
SSDEEP

12288:CjrKKyIuioUKhZ2HezKye7EX3fKlBj0ZURVej8Tu:vyEUKhZ2HezIEX3f0Bwuq

Score

10^/10

chimera darkcomet revengerat guest defense_evasion discovery evasion persistence ransomware rat stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

Chimera
Ransomware which infects local and network files, often distributed via Dropbox links.
ransomware chimera

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

resource	yara_rule
behavioral1/memory/3180-2896-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x000200000002abf4-2428.dat	revengerat

Downloads MZ/PE file

Sets file to hidden 1 TTPs 12 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1632	attrib.exe
2388	attrib.exe
3536	attrib.exe
2660	attrib.exe
2040	attrib.exe
2740	attrib.exe
1912	attrib.exe
3400	attrib.exe
4648	attrib.exe
2652	attrib.exe
4532	attrib.exe
1344	attrib.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\:Zone.Identifier:$DATA	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe

Executes dropped EXE 25 IoCs

pid	Process
488	ChilledWindows.exe
1400	YouAreAnIdiot.exe
2156	YouAreAnIdiot.exe
2600	Blackkomet.exe
3028	winupdate.exe
4456	winupdate.exe
2516	winupdate.exe
3396	YouAreAnIdiot.exe
1764	winupdate.exe
4768	winupdate.exe
1176	RevengeRAT.exe
2784	RevengeRAT.exe
1960	svchost.exe
3180	HawkEye (8).exe
1296	svchost.exe
1036	svchost.exe
3492	svchost.exe
4136	svchost.exe
332	svchost.exe
3472	svchost.exe
4384	svchost.exe
928	svchost.exe
3052	svchost.exe
3808	svchost.exe
4692	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	RegSvcs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs

Web Service

T1102

flow	ioc
374	0.tcp.ngrok.io
31	raw.githubusercontent.com
56	raw.githubusercontent.com
279	0.tcp.ngrok.io
305	0.tcp.ngrok.io
364	0.tcp.ngrok.io
244	0.tcp.ngrok.io
328	0.tcp.ngrok.io
422	0.tcp.ngrok.io
497	0.tcp.ngrok.io
538	0.tcp.ngrok.io
257	0.tcp.ngrok.io
340	0.tcp.ngrok.io
401	0.tcp.ngrok.io
449	0.tcp.ngrok.io
511	0.tcp.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
270	bot.whatismyipaddress.com

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe:Zone.Identifier:$DATA	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe:SmartScreen:$DATA	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe

Suspicious use of SetThreadContext 28 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 2444	1176	RevengeRAT.exe	210
PID 2444 set thread context of 4568	2444	RegSvcs.exe	211
PID 2784 set thread context of 4372	2784	RevengeRAT.exe	214
PID 4372 set thread context of 4512	4372	RegSvcs.exe	215
PID 1960 set thread context of 4996	1960	svchost.exe	293
PID 4996 set thread context of 4260	4996	RegSvcs.exe	294
PID 1296 set thread context of 4516	1296	svchost.exe	337
PID 4516 set thread context of 4160	4516	RegSvcs.exe	338
PID 1036 set thread context of 3192	1036	svchost.exe	341
PID 3192 set thread context of 4852	3192	RegSvcs.exe	342
PID 3492 set thread context of 4080	3492	svchost.exe	345
PID 4080 set thread context of 3128	4080	RegSvcs.exe	346
PID 4136 set thread context of 5036	4136	svchost.exe	349
PID 5036 set thread context of 4092	5036	RegSvcs.exe	350
PID 332 set thread context of 2744	332	svchost.exe	353
PID 2744 set thread context of 2476	2744	RegSvcs.exe	354
PID 3472 set thread context of 3496	3472	svchost.exe	357
PID 3496 set thread context of 4692	3496	RegSvcs.exe	358
PID 4384 set thread context of 4660	4384	svchost.exe	361
PID 4660 set thread context of 224	4660	RegSvcs.exe	362
PID 928 set thread context of 2412	928	svchost.exe	365
PID 2412 set thread context of 1316	2412	RegSvcs.exe	366
PID 3052 set thread context of 4448	3052	svchost.exe	369
PID 4448 set thread context of 4516	4448	RegSvcs.exe	370
PID 3808 set thread context of 4976	3808	svchost.exe	373
PID 4976 set thread context of 2484	4976	RegSvcs.exe	374
PID 4692 set thread context of 3076	4692	svchost.exe	377
PID 3076 set thread context of 3536	3076	RegSvcs.exe	378

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RevengeRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye (8).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Blackkomet.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
236	1400	WerFault.exe	121
2716	2156	WerFault.exe	125
4172	3396	WerFault.exe	183
1080	3712	WerFault.exe	172

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye (8).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2227988167-2813779459-4240799794-1000\{B0F94806-30DF-4208-A387-72B1296FF76B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2227988167-2813779459-4240799794-1000\{E9A226C5-062B-4AE4-A9A0-A56EAF0B05E2}	ChilledWindows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Blackkomet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe

NTFS ADS 28 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RevengeRAT.exe:Zone.Identifier	msedge.exe
File created	C:\svchost\svchost.exe\:Zone.Identifier:$DATA	RegSvcs.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 202342.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\HawkEye (8).exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\svchost.exe\:Zone.Identifier:$DATA	RegSvcs.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 849417.crdownload:SmartScreen	msedge.exe
File created	C:\svchost\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 795665.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 11920.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 902476.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 663154.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 325018.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 368510.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 782900.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 823039.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 25979.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 413693.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 250602.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 144025.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 581167.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 914939.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Blackkomet.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 868119.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 453921.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 820288.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
224	msedge.exe
224	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
1624	msedge.exe
1624	msedge.exe
2476	msedge.exe
2476	msedge.exe
2732	msedge.exe
2732	msedge.exe
5084	msedge.exe
5084	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	488	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	488	ChilledWindows.exe
Token: 33	2184	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2184	AUDIODG.EXE
Token: SeShutdownPrivilege	488	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	488	ChilledWindows.exe
Token: SeShutdownPrivilege	488	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	488	ChilledWindows.exe
Token: SeIncreaseQuotaPrivilege	2600	Blackkomet.exe
Token: SeSecurityPrivilege	2600	Blackkomet.exe
Token: SeTakeOwnershipPrivilege	2600	Blackkomet.exe
Token: SeLoadDriverPrivilege	2600	Blackkomet.exe
Token: SeSystemProfilePrivilege	2600	Blackkomet.exe
Token: SeSystemtimePrivilege	2600	Blackkomet.exe
Token: SeProfSingleProcessPrivilege	2600	Blackkomet.exe
Token: SeIncBasePriorityPrivilege	2600	Blackkomet.exe
Token: SeCreatePagefilePrivilege	2600	Blackkomet.exe
Token: SeBackupPrivilege	2600	Blackkomet.exe
Token: SeRestorePrivilege	2600	Blackkomet.exe
Token: SeShutdownPrivilege	2600	Blackkomet.exe
Token: SeDebugPrivilege	2600	Blackkomet.exe
Token: SeSystemEnvironmentPrivilege	2600	Blackkomet.exe
Token: SeChangeNotifyPrivilege	2600	Blackkomet.exe
Token: SeRemoteShutdownPrivilege	2600	Blackkomet.exe
Token: SeUndockPrivilege	2600	Blackkomet.exe
Token: SeManageVolumePrivilege	2600	Blackkomet.exe
Token: SeImpersonatePrivilege	2600	Blackkomet.exe
Token: SeCreateGlobalPrivilege	2600	Blackkomet.exe
Token: 33	2600	Blackkomet.exe
Token: 34	2600	Blackkomet.exe
Token: 35	2600	Blackkomet.exe
Token: 36	2600	Blackkomet.exe
Token: SeIncreaseQuotaPrivilege	3028	winupdate.exe
Token: SeSecurityPrivilege	3028	winupdate.exe
Token: SeTakeOwnershipPrivilege	3028	winupdate.exe
Token: SeLoadDriverPrivilege	3028	winupdate.exe
Token: SeSystemProfilePrivilege	3028	winupdate.exe
Token: SeSystemtimePrivilege	3028	winupdate.exe
Token: SeProfSingleProcessPrivilege	3028	winupdate.exe
Token: SeIncBasePriorityPrivilege	3028	winupdate.exe
Token: SeCreatePagefilePrivilege	3028	winupdate.exe
Token: SeBackupPrivilege	3028	winupdate.exe
Token: SeRestorePrivilege	3028	winupdate.exe
Token: SeShutdownPrivilege	3028	winupdate.exe
Token: SeDebugPrivilege	3028	winupdate.exe
Token: SeSystemEnvironmentPrivilege	3028	winupdate.exe
Token: SeChangeNotifyPrivilege	3028	winupdate.exe
Token: SeRemoteShutdownPrivilege	3028	winupdate.exe
Token: SeUndockPrivilege	3028	winupdate.exe
Token: SeManageVolumePrivilege	3028	winupdate.exe
Token: SeImpersonatePrivilege	3028	winupdate.exe
Token: SeCreateGlobalPrivilege	3028	winupdate.exe
Token: 33	3028	winupdate.exe
Token: 34	3028	winupdate.exe
Token: 35	3028	winupdate.exe
Token: 36	3028	winupdate.exe
Token: SeIncreaseQuotaPrivilege	4456	winupdate.exe
Token: SeSecurityPrivilege	4456	winupdate.exe
Token: SeTakeOwnershipPrivilege	4456	winupdate.exe
Token: SeLoadDriverPrivilege	4456	winupdate.exe
Token: SeSystemProfilePrivilege	4456	winupdate.exe
Token: SeSystemtimePrivilege	4456	winupdate.exe
Token: SeProfSingleProcessPrivilege	4456	winupdate.exe
Token: SeIncBasePriorityPrivilege	4456	winupdate.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
488	ChilledWindows.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4072	924	msedge.exe	86
PID 924 wrote to memory of 4072	924	msedge.exe	86
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 252	924	msedge.exe	87
PID 924 wrote to memory of 3436	924	msedge.exe	88
PID 924 wrote to memory of 3436	924	msedge.exe	88
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89
PID 924 wrote to memory of 2064	924	msedge.exe	89

Views/modifies file attributes 1 TTPs 12 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4648	attrib.exe
4532	attrib.exe
1344	attrib.exe
2740	attrib.exe
1632	attrib.exe
2388	attrib.exe
3536	attrib.exe
2040	attrib.exe
1912	attrib.exe
3400	attrib.exe
2660	attrib.exe
2652	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20240822_150406.jpg
1⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9598f3cb8,0x7ff9598f3cc8,0x7ff9598f3cd8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1384 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1228
    3⤵
    - Program crash
    PID:236
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 1200
    3⤵
    - Program crash
    PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1380 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1384 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1176
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:2444
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4568
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g7ynqnz1.cmdline"
      4⤵
      PID:4664
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98DA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8743C4C619174BEF9551DA95629C6617.TMP"
        5⤵
        
        PID:3564
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ta3vbz-2.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4708
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9977.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc96C12941ECB4CF9A019C17B2F5876EC.TMP"
        5⤵
        
        PID:4728
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ptwliqkg.cmdline"
      4⤵
      PID:4908
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99E4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc909AD73D2C4F4A31ADF54C370CA4892.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\azg5u5w4.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3080
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A51.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE374341182214C09A0E131B7F7C35171.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zqarrlci.cmdline"
      4⤵
      PID:1208
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AEE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8CD234038E0149A8868E363E52F6F73E.TMP"
        5⤵
        
        PID:4168
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dzgithyy.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3408
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B3C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1040B77FDC6C4BA99957F43BC6BE1E9C.TMP"
        5⤵
        
        PID:5096
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zwcemu1l.cmdline"
      4⤵
      PID:2976
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BA9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc48A82D8D40C14E068149B39035E31D7.TMP"
        5⤵
        
        PID:1632
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yoev9wlw.cmdline"
      4⤵
      PID:2992
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C07.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90F5D63234F741CCB6B720E3E9B1F0A7.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tfm1k0iz.cmdline"
      4⤵
      PID:4468
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C65.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc848A56DC80994532A286E6E0A9B49933.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j5zmbrwc.cmdline"
      4⤵
      PID:3748
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CC2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5C26C2DC20A403496A6BC50D93028CF.TMP"
        5⤵
        
        PID:2040
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ow-gb9yi.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:960
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D30.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB1BF964465954B6C83C19FE62031DDA.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ixqdxjyl.cmdline"
      4⤵
      PID:2512
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D8D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6B1959E92C0E4A978418521D5495C2E1.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1400
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4z-c_5ic.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2516
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DFB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc33AAA4A2F8754F98B9A758FB21DB8F21.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rslfb5xj.cmdline"
      4⤵
      PID:2744
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E68.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEC844D66A26F4A30A7C1F197C7967CB.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mkmwxzkn.cmdline"
      4⤵
      PID:1840
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EC6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE5922E3F1E9A49CCB141D5F646C2F7B7.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l8fkzsf4.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2376
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F33.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA85A995EADC348E29B7F503D273BCDF.TMP"
        5⤵
        
        PID:3856
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lndhshta.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:720
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FB0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB2109152B0ED4D4A9E4AF23D95263A6A.TMP"
        5⤵
        
        PID:4992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ll517z5v.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:404
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FFE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7AD4BC21643D4F4D9119D93C8FA4EF50.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l0sbo6ex.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3000
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA06C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc462F2A99FE4E77AEBBE3F58C44156.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vqds5f8b.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0CA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D5CC66011C849DC84D6AF8754CBFB9.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y_tvpvmz.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA156.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1BEC6C7E44774398956F8EA52E5A1C38.TMP"
        5⤵
        
        PID:4504
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1960
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:4996
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        6⤵
        
        PID:4260
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2620
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t9yuykru.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES636E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc18AD0722E3004BC289BEF624B7DCC8C.TMP"
        7⤵
        
        PID:2080
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5izhchho.cmdline"
        6⤵
        
        PID:2936
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63DB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8E15EFE51A544C609B2FC651C24DEE4A.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_o0vlu4q.cmdline"
        6⤵
        
        PID:4136
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6439.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFE45BF951C5D4B2BBDADF11C8BABC77C.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\joe8de_d.cmdline"
        6⤵
        
        PID:2548
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64B6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1AB47D983856478EAE871BF9294A46F.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2512
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\id5ahl0c.cmdline"
        6⤵
        
        PID:1616
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6514.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44BBB77475A4D3C85B2D71786BE715E.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:456
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rkmt7ld5.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3FB5A55A6CBA4FA097F6A7AF884BDEF.TMP"
        7⤵
        
        PID:3044
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l7ayz9kl.cmdline"
        6⤵
        
        PID:200
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES660E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBB94E7ABDA7A443D94E38318B5C942BF.TMP"
        7⤵
        
        PID:2484
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ehdw7fod.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:240
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES668B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8566EB70CAFB432FAC808A1C27551CA8.TMP"
        7⤵
        
        PID:4468
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j9cgq4gt.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6708.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA85CB9E9621B4AA1915325131FC02EEF.TMP"
        7⤵
        
        PID:540
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ce8w5slb.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1096
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6785.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B9992B386A4A6CBC95E5DC8F6731D5.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2784
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4372
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1656 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8400 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8328 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Users\Admin\Downloads\HawkEye (8).exe
  "C:\Users\Admin\Downloads\HawkEye (8).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13698079431194059160,15767033227646612479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1400 -ip 1400
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2156 -ip 2156
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4184

C:\Users\Admin\Downloads\Blackkomet.exe
"C:\Users\Admin\Downloads\Blackkomet.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2600
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\Downloads\Blackkomet.exe" +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2740
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\Downloads" +s +h
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1632
- C:\Windows\SysWOW64\Windupdt\winupdate.exe
  "C:\Windows\system32\Windupdt\winupdate.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2388
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1912
- - C:\Windows\SysWOW64\Windupdt\winupdate.exe
    "C:\Windows\system32\Windupdt\winupdate.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3400
  - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
      "C:\Windows\system32\Windupdt\winupdate.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2516
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1116
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2040
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2660
    - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1764
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4648
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2652
      - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1344
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4532
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        
        PID:3308
    - - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:108
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\SysWOW64\notepad.exe
    3⤵
    PID:3712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 1308
      4⤵
      Program crash
      PID:1080

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 1212
  2⤵
  - Program crash
  PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3396 -ip 3396
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3712 -ip 3712
1⤵
PID:3288

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1296
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4516
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4160

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1036
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:3192
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3492
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4080
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3128

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4136
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:5036
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:4092

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:332
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2744
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:2476

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3472
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:3496
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:4692

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4384
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4660
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:224

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:928
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2412
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:1316

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3052
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4448
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3808
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4976
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:2484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4692
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:3076
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Scripting

T1064

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost\vcredist2013_x64_000_vcRuntimeMinimum_x64.ico

Filesize
4KB

MD5
28d98fecf9351c6a31c9c37a738f7c15

SHA1
c449dee100d5219a28019537472edc6a42a87db2

SHA256
39445a090b7ce086d5efb4ac35add13672fac9bf40eb481b54fa87302a3f45e0

SHA512
f5c2458348347798304393fdb5c77f4f7ed7245c0d4c7594deb0113262828cb8e210e7b48a4aa7c4d2fe1e31201b4e326cd60a6f9d4e3ba1a7fbef322dde0971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
ed124bdf39bbd5902bd2529a0a4114ea

SHA1
b7dd9d364099ccd4e09fd45f4180d38df6590524

SHA256
48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

SHA512
c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
f3d0a156d6ecb39d1805d60a28c8501d

SHA1
d26dd641e0b9d7c52b19bc9e89b53b291fb1915c

SHA256
e8be4436fcedf9737ea35d21ec0dcc36c30a1f41e02b3d40aa0bfa2be223a4a3

SHA512
076acfd19e4a43538f347ab460aa0b340a2b60d33f8be5f9b0ef939ef4e9f365277c4ff886d62b7edb20a299aacf50976321f9f90baba8ccd97bc5ac24a580bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
540af416cc54fd550dcdd8d00b632572

SHA1
644a9d1dfcf928c1e4ed007cd50c2f480a8b7528

SHA256
e4e53d750c57e4d92ab9de185bb37f5d2cc5c4fcc6a2be97386af78082115cbb

SHA512
7692e046e49fcde9c29c7d6ea06ed4f16216ec9fb7ea621d3cc4493364743c03925e74244785588d1a4bfc2bedd32b41e7e66e244990d4076e781d7f4bbb270f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
43KB

MD5
d9b427d32109a7367b92e57dae471874

SHA1
ce04c8aeb6d89d0961f65b28a6f4a03381fc9c39

SHA256
9b02f8fe6810cacb76fbbcefdb708f590e22b1014dcae2732b43896a7ac060f3

SHA512
dcabc4223745b69039ea6a634b2c5922f0a603e5eeb339f42160adc41c33b74911bb5a3daa169cd01c197aeaca09c5e4a34e759b64f552d15f7a45816105fb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
26KB

MD5
1de4708beee6992745a7c14b7d8580da

SHA1
03bb2b7dd07f1701da7cf19b68dd23a2b298827b

SHA256
ba0ecf05941451756a9acfc7a913e64dd56ddee8f3811c8a9f1cdd0a219ad64b

SHA512
5d21cd342f3f70a7dc4bdd3b100e6677e74a7fec22af3ffc9d048618d1daeb5dc5e3f1511ffaa2fddf2f3e49b31351d7d4613f7f03e21d2b609483ad6aab9c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
37KB

MD5
4446004a15a8f47b59f69e0ff6daf095

SHA1
2fb891f331a4579da782fde0a98708f4004c423b

SHA256
81ab172d1e6c8aadbe47409cbc1b3ac84ae93be69de4f99fb26814cc334279bc

SHA512
06211b4d387ef7ad3f473dca1172165a4b65e10a5182423ed6608354d55cf50c08e6c5439595b93b7b2994ee28dca14c403b59c0bc4cb5a02c35c6c9498f09b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
21KB

MD5
94a66764d0bd4c1d12019dcd9b7d2385

SHA1
922ba4ccf5e626923c1821d2df022a11a12183aa

SHA256
341c78787e5c199fa3d7c423854c597fd51a0fc495b9fd8fed010e15c0442548

SHA512
f27ba03356072970452307d81632c906e4b62c56c76b56dfe5c7f0ea898ac1af6be50f91c29f394a2644040929548d186e0fbcea0106e80d9a6a74035f533412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
37KB

MD5
e35339c6c7ecfb6f905814a86caa7882

SHA1
2380f4be31da11f9730b20b1b209afdb42bf7f24

SHA256
3f2b391ce2229a0fd88b58ecd0e56b1113fbf27271411a28016394eac9df4984

SHA512
3cf03b85d72d40aa516d1be4315684f932437cc93fb332695fe069cd590b43c5e96c6b10208ec566c9db7875246f452b259e17ab567a4075ff484748070b8375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
19KB

MD5
9458c39229e65e93245ad6de284f2dde

SHA1
d5a728dba861ffd24bec6317f105e14cfba4b2ab

SHA256
dd563bbb62335aafae055c08891ba60e191ef343c71546db64a16c5e6c1dde48

SHA512
84c39acc38a17bf73fdec1bb6bd93a0654c5bd54fa4c13ccad2069ff7b759ac2999c7e099348a91a53afdd2cdc3f056a033db3cbd0dc552e6299fffdfba8373f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
16KB

MD5
0bf07f12c1c5dd5952718e58d82c5e71

SHA1
676971edd706766162435f60bac58fbaa233a8b8

SHA256
259a012639a62bbf10b217ce04837da2f775151efc7eb06cf290fd53c2c5ae36

SHA512
9056b0f63e196013ea6fb599d00de7bf8c1476f2e02d74a13cc93f2d2b4c129ab0da2f52a2157fe44443a4fe92df2588423d3c38f4ab38b79e394e109b43e5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
57KB

MD5
0ab3157f814a486195ba86bafc7eac95

SHA1
b5746e35a7ed4b1d781ece016456cac68298c20f

SHA256
f2ca3da125f7020f78c23e0aa60f2c21b66453ece0ba1cdf8ef5cc15345d3757

SHA512
8759fc18a4002f12ae3398f13984ca3e50573bfb7d8daa16cc03d6a8655ee22623eca05549e0a9b721dd13f7e08dc6275b9cefdd96c8250fbabad31e7834b881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
17KB

MD5
1258482388f7b6ada91ecf01351b123b

SHA1
18256e690ade766d59600b2691b97c8d118e3226

SHA256
fa808cf05e8e516ea04fa76aff4c107391880ecdaa90bbaeec4de7252c241170

SHA512
5ab21602e28ead72808d3a4458f2f45397ab0b6e56e7eb6c00efc9335a96bb6a21def505f6fcd328079ded6422b3ed164f40803811de21c5749906d56d72a8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
24KB

MD5
b0ca864f370ce459aefa34bd5d1b433a

SHA1
4917d4e15e1f84e09ce8c59555b11e09bd8533f4

SHA256
c3b6214ef0277a056ac9726ddc1300f1bc05d3b0dc8d4044c710f5d2b8c968e9

SHA512
b99ab657af0471a7fff1b8479e8e70da25f629cd381e32d874f617d258d073ad5e23fb56909e3cf718269105dafa787768fa47ac41208fc1fea9216f1a0969eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
16KB

MD5
8204ba87e201faf988861bfbd5505b94

SHA1
7e1051f5f9c33b95b265ffc2f8799fb3375c9cee

SHA256
12027957b89023392cc2bd4f79aa51e4d6f4ba99c91a9112cce58d384ac313be

SHA512
b848530ef8a546631ff7aaba065db429eac0682baa455e2c9f8381164af9e4b37d793cdecb9fc5e75b047dcf27440c761d979ae26cbd045e3de0034861eb33b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
137KB

MD5
531b54313c7e37aa9373ae02902938fc

SHA1
2f4216dba4074d48eda6f2ec432c6b36d53d131f

SHA256
ffa166b04c3e8ce908968d4029f32f26cf1d5adc49ae843d6992b8d3049af94b

SHA512
8fe11e78c01959370174c384d5cfad2a22ba1abf981deb74b8bcf5fc070250c80d75f6740e2455aada3037bfdef0ec4cd8558d4de5c5bf55a330e642f53956d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
27KB

MD5
b415242bad29f4207572cc643f76bc27

SHA1
c20102c8938e7609d45252ca3f03dcacdb0dcbfe

SHA256
70b39212bd6c41e5e8bbbc89940362ae45c07fe332f58aae38e94830e993826f

SHA512
5e229f989c8ec038adf995fd65d1ab5e54484d9a99c8db9c179ba481d2bbfa1e6a01c96a296f812a5d8333aabdcac9354b0f225903dc5ced18c5948924a90f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
23KB

MD5
13c9fa26d781d5bfb4192b4d255dcfb8

SHA1
8d8c1fc8a9835aaafc017cd0ee2e41369ad3be8c

SHA256
d8f57272a95e48e67cefce9eeba43853e2cbd593b3fa7ff84624950e1238f8c3

SHA512
55229d8fd4f23f2ae243d30e7b6844f776e33402b1d00a9651539ea9d1ee014dd2f6096396ff4cb8c8674774463121876e6bc0dd68bccf172f19b9916c5b4b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
41KB

MD5
ded2cd460ff22008f666083b9ba6b240

SHA1
eb3819ad9d171461071a0a4e7ba66d094109dac0

SHA256
b6b4518584527c9d6bc6549c708761ecfbfc55a1ab49b91ee5a2eca80de34168

SHA512
579b153c32ef22055b115ea9a7317c105733824684ec5c95a61b467fb29786e5357ce421868a581bb516bb47b43926fc2859a2bfc4d1146f07ac4fde88d75b72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053

Filesize
232KB

MD5
60fabd1a2509b59831876d5e2aa71a6b

SHA1
8b91f3c4f721cb04cc4974fc91056f397ae78faa

SHA256
1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

SHA512
3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0

Filesize
2KB

MD5
7cd2236acf35b86157e773d9f06dc027

SHA1
bc93129d058a7ada1bb95d92cfac927cd1d6ee7f

SHA256
6adb30d34d9057b7cbb1cbcd14f984dc56ab0e28d6eb8b9d58b1428e9ac1e058

SHA512
b9757a06c13386e7b2880dccf7a341e1c55073ad0dc737a6fd7e9da9717bc70b48b86d6c80a970ce7bde95231a077a65769e4d0de9ad7b594b111a77927466f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
193f5e9ae1c33b8074deada5f538df29

SHA1
7f101f816551a3112f00cc74be5bf1c67af59190

SHA256
2af7073ba05ce499f455a7c7e3ebed982b489fa8e8884fbd8fb646486c48f2eb

SHA512
1c7d21eff43c8b18f945c30f29c8d18bf4d4894b170f87bcec8deae79072695a7f461620f462aa6f3802a38f3852a358f30ccef077ca8da9a43c7dd0f5150266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ca8aea2e993703a_0

Filesize
6KB

MD5
666168700852306b55a67cf9fb0175fc

SHA1
f2b707e696db5b4c147295e7a390d786fd703d8f

SHA256
568462ca7b60f1e24eab5d301e036a9af7d3087de88912e1b078766baae07669

SHA512
531ad2574994e56ee911f141f5a59ebff9d9c98d326bb5cd16ef50132d823df42841cdcdf94d7ea0c771bfd01998b97944b7a9515f26d14c6555542ba57869bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f02c4494b1a18ff_0

Filesize
2KB

MD5
7c7d08a327176132ffeb3266133f3e2d

SHA1
ee8bebc1703c837212be753c571fc1ab1682bc36

SHA256
2007a2cc9f0faaf0d892dc2159b50464bc1a4894d0f509a1bb658c65b2402598

SHA512
4384ab75bef4b95c6f4a9e1810b27cd8725a88a039ea1292f23db21273762d12bda41ae3209b5dd0d6b2f951ae0c8052b9c64839e9d4c5dbba2ddc3f87523e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d0c04f9998369cd_0

Filesize
3KB

MD5
d04e2ac260eb6af376278fe6b07595b5

SHA1
fb970bad6cfaf786c9bafe59675e1f0889fe45b1

SHA256
5d34a2dcf7f839acfbc2ed2d50ae5b592e57a271373d591a35eb295a38c30e42

SHA512
232208f101c814cde4ec4214b0f27382e4709e155f45af8484b32c054741ecf96731106e21758c30096c0fa70eb58570fd4dc6c79688105c89e3a99da46583dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa20c296787a3f88_0

Filesize
2KB

MD5
bd0a3131ae7f51196470d0968288b341

SHA1
617c2ce55f23cdd602eb0531cf40b966c01fc9bf

SHA256
a3521cd406fff70fa67c197456cc7a38d2cf702d5b809bf1ff2cb81891818c55

SHA512
f4f5769103e3c184553d353961ee109ec4fbf7d5c69dad4789a66f6d5b6c54101e704bc447cd0239d1ec491155ace3a17b87fb71aa99afaf58b09c556ad74d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4545010b9c4b344_0

Filesize
7KB

MD5
08207575c04f6216f191d0a2a48ec137

SHA1
f41275e991f5ebc7c518069fbe823480837232ab

SHA256
03e896e3a5dee2335e7adcbd9a052f51f979aad369ad29eae14a08822f7cd691

SHA512
9ef3049d09a26ac846b7e120fbe8e3dcb44171674effe7650d6a65038206ed6c6aa2f8e14a5fdfc94b8424e27d8a1d2fc8d11b0ade22d6f6bf360b91be69b697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d00019f29c31fea5_0

Filesize
2KB

MD5
6b2a81e28a3bfe265ab0754997667337

SHA1
222de2480522199d01a9f5caa5107f9bb601658a

SHA256
e0965a1c65c978e6fd68276b00e31b74876ea480933d8772beeb39301daea358

SHA512
b2000a9931b5674694ed5713f9d7c2ec6f865185007838997bfa7f2cc2702507c2b2926c138f8a08ee34fa137d07cb2c89b927e7f517f41bfde5440710f7d651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daca09b4eb185a45_0

Filesize
7KB

MD5
1a91c49459764ef3506eabb2f779a2b3

SHA1
3a96dfec4d6358ed5e1d8efe2b11379747269339

SHA256
281af1cc645bb92980f5e691b4b3ab9cc88b25674b8855ca40a980f12243eea8

SHA512
b19952ced9f913f963adacbbc8a0857abc4cf798a2dc1c4fd0ca0e249d139d3dc35bb75749ec1521396ab33e5a591cf9d5ca6f62b073ed00530bbca7361614f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e504183595893c5c_0

Filesize
4KB

MD5
0bdfa6476881502c86452ae0c0798c40

SHA1
1b8a177e4169419b9fbdb7e3005b0fd5cbfa4cf9

SHA256
fff8df6ce8bc5b32102d33f603bf7937d68cc54869105804adc16bcb9ca612b7

SHA512
28823f175c6db6b7e19c3a570aaa31559c53e9f8bec2f17e45a5e5b278afe65faa7429c1630518bac71a10fa152b4f31ba612ec6cdc6ad2dba63a02c6331a9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
3eba82da8cc03f9d3431d2768dd029df

SHA1
dfda52144c8f88888a4ecded7dff3628d980f3c1

SHA256
3f34c354b425d62a6d99084011bb6c84534087f09bdf46f012c675c392264662

SHA512
de07ceed2eb7aeee7c6f99c75a2f97d39641ad5a63459d017b338eb1630338939e8fd6bb5fdbedda2f2d5718b21b5c3c6c3087f2d6f9622dbfe29555fc1e3d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edb3b6840a8ddc0a_0

Filesize
7KB

MD5
c8c2789dba3cf13b0e55cbef04c8b12f

SHA1
bc94670dcb8f0aa23d04f2a58a34238e02b4cdc5

SHA256
dfdb8a296f9919d98dfa78831ae421e0029ec986ce362edbc77377d7daf4cf7f

SHA512
fb9ee1512c2d0a292490b366a017abefec95da623258ea2cf1cad7a85e582581b2e9236cb35e7120127a430241a80ef8270fdc192a4ff36c02669c7a9f9a7955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2092a2b8a95e6633c38345cf65a7c49e

SHA1
0963f61a2971bbf0cdb1378409abf95f766113bc

SHA256
4b19ec6617ef577680f8e848faf6e5c911d8578063dbf52a7b139f081eb3d4ac

SHA512
abb91c5879d7af6483ae9414d418039cf80da3c6649e599254d50786c4150178916093182419460684d8471298c467f57c986ac28b6a0c4143767efef1e987bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
edced6615de8491ed27f55dfb83843e3

SHA1
e930250b68ed434b50e4ac045838f52f35a1492e

SHA256
0027ab4ebdbeb227cf388cdc37adee28df1f063f79054367f0700284fa9ecfb9

SHA512
472218b38b00c060e59d8d2381a3b21cb5fa73134ee84215baeb1aa2e08f03b5903cb0c8a3ad3062ea22b8e6fd65f062d49d48cd910b28f35c7c775fd637bb6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
69046ec4e3fe220a734b48df07f35245

SHA1
88325986923a546150d0627c7fa99d07b9844483

SHA256
8a8999e240ec659aa0903487cb732088a34807061c0562f56087662373cc4263

SHA512
60d6d0de91e8589f8b1f736161e1772b78e1a46e916b7f1cbe1c6b75502f1b96bff4e35e2c3fcf92638d90eea56774f6129e893c0e6f740650a5c17bff6cf3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
d870a7138ef6b0d73f00ff9e69b1c67d

SHA1
8524e0f4bb461c3bd6d87841f0f78a4e782bbaad

SHA256
78e285adc367517c1850e354989ed2d8916a90096b7bd0b7194b4447b7344d35

SHA512
0a602ea8c497da4ec9fb3acc5bf6e86c7c5bd33f66b825c21363fb61d1a3e9a6d355108b0a0f39e0f7a5cd40dc0ac0d4925c0288bdd4323351683680d2b1d577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
c6906ba8a10f394b4abb45f505d1231e

SHA1
0b159f0bceb2ca1315918f3574d8722ee877ffa3

SHA256
dffb52813edfd0969a625bd1f4b8554ebabf0fe10dd086e10f1b3224325227a0

SHA512
ff2b816bb9bdf1d0c9ebec3e780f60d3e2b59c0697691963c0b40b5746b5f3bfd28b96b23c5e71a14e09a6451f01c3edd92956f639c72727b495ed6aef1e41d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
dc7181f18b7fc5d991877d8243fd9ec7

SHA1
0e06cf4e38d06785a4ac419041967088d38aefcf

SHA256
0aa6175e039013eb244124c037dbabfca4855e742e730f655d63bb331af8f350

SHA512
60a9c4abbfc5d874a667c26ef14e61c8d5896b3b2cff5bc604f24151431606b1d611b71808c483cb4a04a1366d99ea953b5b5c38787d6d34a86e3f19ffda83e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cc801328541c37d42f48784ecc0bff52

SHA1
bedf28a01b0cff070fb73daa06beda8150ffba3c

SHA256
deb165c3c62d1dc35224bf2300e2a4e75bb95584dda1d51bef816b96fd4a5eba

SHA512
24603689ef3cf53593e12af58301e662854bab9ff051a8fbc4568b11b674c84a03ecfe92c64da2c7d5d01302c85c81e276ae4b1b12b98fa3869e75e1decc2353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3b50cadcf1d69f62c3405919877c8edf

SHA1
741491c02ba4af4e8d3411519a3228f114458541

SHA256
9e72e56346b7401f4096dd4bf3343906a4b542c7a5bbcf2116febd6ef8d83b1c

SHA512
623c541263fca90409eb0d65d1339c9b23026c7f52fbc877996ab70f8d7df94f9eded3919b8c524ed5e378f1471bcbc65b014b16ef8fc272615e94c6a3f5d49b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f255105e7c58f567ddecb09e680536fd

SHA1
6b96c89aa024acc0e8c855893c8cd65a30f28509

SHA256
416ec667c429b31514a9483f20fe4cd341849c70d906acb51b1404ee20b5a627

SHA512
d2120c6826c9758d7a4707920ec183c0c83368e8b69066fb5d2923028fc79939a19cf50b11a7e8aec228709d52584ca512e970dc991799353e4ec0731ea50596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4be4c3cf370f8deee3de30b90f8144d2

SHA1
080c5837b5213f286a64d9b3d2f903a947479a62

SHA256
294422ff76a7e53ca1cf32b66fb944af41a28d5b90cc8b810da39b85690cf874

SHA512
b75390855e16471ff810289bcb5afe9acbf74c67f62d084bf25caef4aef8b2f00e48b5206888d09cdaf5d72a39ec3c41ebccb3a3af737d97830b3085e8f7741f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aea900786c6aa33ec7cb385558cd4de5

SHA1
a90e787e59c23628d50f7801dc0f62f79564e644

SHA256
0da248a099fb54ef46ae2ff0307680e7e176ded6bc7f421422210caffd176a4c

SHA512
8aba83fdd865f0e58ad57a58a6042f514b6f9cf97b71e0bca5c495224aab14101db0b8da70754bf74d07ab934305d46aaf61a768b39c1db05654875303031e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f7052054ade37d9ce4908f391c97afdb

SHA1
0999494b4b7c946028b63ad8ea7dcc96191591fb

SHA256
cda329e47dc86be64fed031b6c180bafaa9d2cb316af5abec5ea14a00a5d4516

SHA512
77a5f8e037b02089b88645479d6e00f506498ac4b1ef6b7d96712acee91490a0e311ddd21ce4791d8f6dae3855c627173dd3b11f323545dcc83bef71ac0f4e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5f15cb9a5287aa18443ed7716dfab563

SHA1
b964fb4f6aee0d019f3ca95c30e0972bb082a550

SHA256
bfc5ff583dd57e8beaee9ad153c8b5bc9808c6ee2432519bb7b971cf983a6ca8

SHA512
8b2d2bcbbfd14d3ef55da0c8f5a01c8112a79430ce7df60163fe56381d09a38eb3df311b5e2b7e8ebf8ca5a5ec88eb52391a61f9f132663b0ffeb4bf392dd9cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b4d7691ef00f3ff37857d55625a8a6a

SHA1
0397f010c4076c668ca0108e8766298798cf5639

SHA256
5325c9581d1b5ab1e472ab6de2c53b8f98772138151f6f492b5ead2c7c3be86e

SHA512
0ff9c6bde221b82ef089adadcaa1c33f3167c1a415be978da06cea90d275aacccc6726f104e2a8efaa14d8d4897db5db9d9adaf82c57013a9c0960e7abd0517e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d5e1261f3b3a673b6d78a93868bfe213

SHA1
721d98dd037c605c52afcbea33fd0ba5d24b346d

SHA256
af28c381eb5d8a186d391f3d7b84f9cd12a08cd88887b1f13648cb5c0fa20fdc

SHA512
98ed94fa5fd9bc91d86d352c99d9b1114aec94b5ea02292513466087a6a10c6ee326b1710831ab3a9033c4d38975310839f9d43c04c138e829db4c85f0aaea36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3260bf42f2a85dd2b87d9d386442e172

SHA1
cdeead5d0dab762a0a9a2db8eaeec1be1d94a332

SHA256
67addf718665d59bf55ccc7d32c9f84315a935576ca98d43994eecb6826db723

SHA512
c49172dfe6a5a44fe1cf899c356027ecce3583c29f8c06991d40f793dd2b753b2655fb479b10d4b826c9c4a77910250febad1298d57e6e99145a37e2d2900a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39f9e2e3848c567189daf2bfb8d4577c

SHA1
2132148c11dbc28e094e39b5d9c87d683778c83c

SHA256
d0aff0ca78b745612d3e047b7946b773fc5f919beb9c9a1a4ae1fba5dc80523e

SHA512
c29fe910071d667e4d73765f78dba1e580c1dde21d093f027f241493d5591f13618ace06c0b64918669dddb2934cbe49913506ee1a77bdb8629023c4f9d33351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae3f5576438272896eeec39d35609ddc

SHA1
4d095fe22c7aa797ba899a750960087e916e3024

SHA256
0c434ae47dbbafd12c1dec8c4d859fe131e236861bcb0199bb346633aad5550e

SHA512
2eedac62c1eb2267849890042e78099a70bd045e770a9a170b456e9790f601cf77012a1a7e884f78f57afb7611b7ad7f258c001ac7bde318d1360878ab894a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68a214a4d2c4de244d99c5d5195a68fa

SHA1
c10381f574b11b4489b4e70806eeaf61306ad3d4

SHA256
f3b18c5a6bd5e4bba7e8af7cde71165307387d15780ec97068aeb30a2b4ccc54

SHA512
661ad3e3cd814236566655606574ae863b286d0b32e6761bb1675e871c788e330bbc275eeb0534d1dc9248b6c44279ce06f579b110c0e271be90b1080203cf98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
839016260d924af8f658724176b53cb7

SHA1
474f82f10bc154a96e410769e3f99ab802716c65

SHA256
36cd6eeaa03d814667786a7acf482816b271a5e1691414de76541496aafb2bc8

SHA512
32fc524ac331aeca8a8aa589173482c3d7ee08140a2acd3fef3ab43af6ff72557bc1713002f72a6256fef81ed94502d64adecfddb237bf32abd443d368c4075a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
253beabe7a60da103d4139a0260fd3fc

SHA1
cd87c285c6b12db3e55e0311c3e21ea94da1787e

SHA256
dd85a56ad2a310e15d1fcfcf5b06278045a6436d54eab6000d4e46a9b265ef11

SHA512
98efebb3bc0696752fd769c6a95e06a5e3510f3432ff0e8a78aa0645e827930b66a1b48aef6fb35ca2a9bc43e4099314410972906be4019027015ee421d8b8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2b8fdff08a12f3ed742f27b3caf7818f

SHA1
661c61b04aa0385348d8d1148eb3451a5ef3e57d

SHA256
ebf079825851ea2080a8b8acaf61f97d7129cb72658a38913114e36ab3301340

SHA512
b2e5fdbd9f91a3aab44519c555cde867ec8dc9656592f36ceb4fd90338ea26e2d021abb3fbb8ef517273198684659c45d0a75530b472bc8b0b89320461542992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0bf5d0d6f2a2a8f97286efcedeeca174

SHA1
f91e26f8dd717fc6fd5bce0c4815376f037bd7a4

SHA256
ace4bdd9b6de9a6b29ce816c18af087b1afcbdab10d4a6e7ea568c01a9647967

SHA512
f32f21de1bee468471a48f210316824e0142d7e20985510163fe961561808f62f0cddde033d78a51df68af3f6a72ce4c2d42ceab9fb8482511c16b45c05c18c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
6eabdbc51f11d5c66bc63a5b07520347

SHA1
67ab8d7abeb828a096159ff36a03490274894d77

SHA256
88653d34fd65f4cbe47acb73476b24413136bb087e25c332ab89940896dfd718

SHA512
4a0650627301b2b8f3b3c457c750aaa62d2664f2d1c036fd57c3db9127b50f344c6d913c6e606e6c417e1551f5cb8801d615ff23b942130645fab169c725b156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e479f46f27ac3d4240034c4d1037995

SHA1
c690950214b959d4e0271e436ee5d1b515896872

SHA256
0f8fb297d0764057150831b832938daf2a1d2b3221aaec06cd9526136b898fed

SHA512
8e4aadec3d555f9d5b14d4dfc46c2b8a6e444e2a8cbce820e7aa4af526f2a50baf1d5519461bc2198a5abebefefaf121ccf4e8bfca5e3aff32f3807dc8e0895b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1389d3ac9c6c2fe5431f6488f733b8e

SHA1
d7c38e9bf250193057b6a513e42491251b704c89

SHA256
d3c737905fe8173d8011a0c9b95667314cb5a9e62438a1b168664272c15b4f19

SHA512
d84d5f05746b0242aac24630df33689d56482de9990a8b3255315d6bf083945663b25e93d7579cfc76a11c4ae4bf741453e2f45b97e1e7b5819a68cfdd618a0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
54db00e7979828f73ea00702faeb2017

SHA1
2e104d6afdacebb7ac722d388728fb12a42ec622

SHA256
7eb639336fd9b976b1d25c9ae63fc99d4e18c7eea2f23a651266cfb952f4212b

SHA512
5607423801fe0a6f29423de700de5d967a530cb6b5a41eba87417a44d6bf65908310a9ab6c2bcc3ce2fe2c84bae807e007c190c5e9d73f10d46fa52ffa9b3fa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
189eabe18556e3e2c6fbf4e7fcf2f6e3

SHA1
8e6ca0da2b284ba7797b0a24c5a9b39983a917a7

SHA256
40995165dc5dcbb4ef1bf3243239a4df028cd4e1a60437e2f5bfb94189de4225

SHA512
4030c2e74625bdc405ba8143c9d36790d2f94ce693c8c35954054ab83f11e6dcb2549ce693ae3aa653d9711d579c14b52930318076ccd0ad99a085b93402ace8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
898ef5da62bd9cbc56185933482004b6

SHA1
5e297436097e76d0c4d94d411258bd188f81e4f8

SHA256
bca0b090d929b669bfbd30001b26981630a66da372b50ab4fddad46f075e5333

SHA512
f8fead9b9bd08984ebd08ac176bd177f9d21a5b60ce391b4b67be82c65a7326d28ec944c0b5193b69a6d0193c3d48abb77accb73e2a48cdee69194522297dd3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dee49ba21c55127d1b1bd63e2a4d22b5

SHA1
6ee5486793f4a1e1c078ae7c39a2316a160cb464

SHA256
cc5cc5cde96f8a4bf4172389207ddc487409039f3ffb19b331db64323515dc43

SHA512
e45053c76033f533c79aeb470099f1a0581018561de4a4c848ef781bd059d0a432d5b8203e137b4422c01da2431e76e3df018f0982bf19cb8395ebe268129224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
741356343192e3d3ebf772c0a56c092e

SHA1
421ab0e96994bf0895f2ff91dd54ed55ac2ba894

SHA256
8e6477586dc499bff316aa4e58ef274610b2059917d65b89efbbbceefd33937c

SHA512
2c9e1773a21fdb742ce5443da6848dda0e9366773f7301693611132572968ce1dcb2b955efc59be385a522867d532d80758d1433e5d78a8672893f34acc4f604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
186ebaf5e755811958e0de025ad43c4d

SHA1
0a2a83d500f78d1c349fc3d998c6d2287ed1f617

SHA256
7425fc0d157c13ec79b17ee6703a2a93c0a2f14883fe724e750d0a74b4319883

SHA512
a23f4442443d4241a6608a1dbab5963a6754ea3606fac64f81a31a689cd51ec9183aaf7a7d39286abe36da7444006df9f01d298e8fd79c6137db2c14e55c63ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c6bc04fa19dab54ce13f1ed36fdd0f9

SHA1
93f06ff941759f98a606acb9efae8490eccfffbe

SHA256
eb57c1bbc5ab866e6c965c246b60f158e2f820fc9f267c91c35d72cb56f18333

SHA512
721fdf4581fa6182d60473d8a830381f568364e1f641d7bdbbc2cd93d6156352ba1a02f46e5f8a879c217650b7e7672481a4131b4e304b3b76fe46aef5111025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
564f990b879991fa7927e75fa51c200b

SHA1
e63f0ce233832d7989bc7b904736635d005ea236

SHA256
9dcf84759751fed4d30bbe0c80334cf01b275eefc128807c624ec7b41b3b57a0

SHA512
5b7b646f03fff397918fa889de73b99d7ed0f7c1cfecfd4dbe2dd103cd876f408af63f06d6aa7be93e626dedf324c9de6a6738d6cb36ad1d6283806a05c46dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
858756cb2937149b38d65a94d3518e35

SHA1
bc8061813cd12677f0d66e27e55d8183e07230e1

SHA256
dca1d93c05ac780e5aacf371b9167a55ea99f593cf6ce462515f4bdc01c3bb15

SHA512
24f2b98f3412c1f980845019ed07e52fadbb0769d049e7038b94816c48388a2af3d8af4d5e99a3ce20ff47d6f688d497bd11a760c1e4cfcd45dad416b64b1c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ea150c930e035ce4c02782c865558a29

SHA1
1bf892198d8ce90353153ce7e7bf3f48998b30fa

SHA256
ee429eddd9ef42e4b075952a70f65db6b3a7714022c30d909d19a2f4d9dc9e79

SHA512
bab618f83b3a912cc970063ae5bee3632462a7577e78cd84cfc8edd8fe13a334d70c92aa0a39226e3096615bf26de411963b4a2d87c71ec771849f61561c8f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
82614e8e60261754b0fb8683a2b7e290

SHA1
adfb4d57e63467633c041228bda8f38764a697bc

SHA256
1dae60d96e9a2af98caabffa508814449b48ae016f637f67b2c0097e0b71e7b4

SHA512
a32656a2e938f2b8e7a44d35bfc7823aea12434f18934eac666c7846c721581ad09127cf1d8aa7fa5ce57af659d9b7d50c5b5303558aade584f89163626f4bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
26eea36028b6c6ca724c7a4b81f979f3

SHA1
d2529209f47a4f6fc1be792f026680c0cfef3633

SHA256
7c816163ae5408b51803179e2bc4748a59d132b02daee5a3d37984e3d4b3ae1c

SHA512
5f2f5f35cd25e82c84e17f23109e4b4d75baa38686a3d34c14eca4909f6ebc74b1546d9bfb9f466b7c8f5f6ae7170f96a2c1c28af3fd41508a30cb5f7a306c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb466071c0645de8e25a2f2e0fd27c95

SHA1
ad4e460a384bc4f5bc77dbd8f2b17e7e8587672c

SHA256
2cfc0001d7104ee2c6eb0d62ca5c1108dad6d7bf09310bac5ff09cd655207ea3

SHA512
7fbdbc7949aab5fcc97a23feb88c1c24721eb20fb4d5d7d8516669d4a7a6d24c552af9de9c33362fdd7df4a6d55df8cb86dc3da30413b8fe8ffece105d5d484c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1256c39c0ca514108e021807228d6117

SHA1
7c5c4c4e102cea496363729c780551ed80f6d108

SHA256
52a57eff5b1a7085287b4eef2c23464ff04f6cb10785363711bb74b74a3e7ad8

SHA512
2af37254c8838fc5270481245f2be567ae8126195f74406254633eb59a236812ef6224e966c588f70d94f79f87bc31d417e4ddf7d7acf6e7c835726bc82d61c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
938d8b3d8b1f53ef43fcee5e3e21ebf1

SHA1
fd699e0ce9ab9585826b1483f8fd9c022ac4418b

SHA256
f8d8e81fe660ef9d234394f3a1aa564e8adec32a52c23257677b2402431c4a90

SHA512
4a7f48e1882090f98668e567029331b8e32c945324a22dd5a69ac0c9d0da8834f2fdf67bea984d427b25e1bd45bb130fc87a156d398fb9e002e82c956bbf4b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1bf64427df634afed93ab4c515bb8fad

SHA1
d975cb7706c2925a468faa8a38b90e14600518f2

SHA256
194f114a7d2f80c8c716fb43d4cd70ebf5dc39c8630869c8364d9ba5ec92d92e

SHA512
f2bf9549e8e036ce735ebea431d966bf8cf6007a8919a7be05256b7fb4e794368f24f03a326e9c2f330bf3c82ba2b0e359a151fef3cddfa88633d6cb151fc4aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5212bade8b64a7ef167613d5c4756309

SHA1
da4f3f007190b3a8b0630dc8ff94a015e876feb3

SHA256
5b2898402ca9a7e2ecab6c88f6001d3498e45c6a66ffbbc377377d39a63df523

SHA512
fecba29cea69b025036ba0b4c28732260eed94163205bafb651689b683fe1768a31d06af4565bd6e910466cae40600fedbaf1856831e27fe5a489095ea6de42d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2696f7d4f85f979554487fe77e34f84d

SHA1
3aa806e50414a2831291fdebde2de71a3dbce84b

SHA256
d6436db3965f7a048a55874d14aa137938438544496c4861f08559caf0e3d4af

SHA512
e725b88c28cc569db2ec6db3e532374649e2a168cc171956df17d2769b89eae97e0a2acf9e81f55b0061c8e4d12d4b19ae8abd6cbc78284051338f069704fa89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c49d43c397768cb2de986f475f5e0686

SHA1
751cce1bfb3ed188f990ee4ff1136ad4c497ddd0

SHA256
cf01ae302a3a91015c9c72a1ef920d83808444f1b5480344370125928e6cdda8

SHA512
1934fc04cbb6b6f493ea6130aff04ca0eb3a41629a0a9e7217e68a3d9ac2da6a4bef6911347f70d4f5723f0cf68388ce619970347f558ce3915ecab62e1e2db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0fd61df952f974f99f91a833a933c497

SHA1
c7f78b68c3d728623a08d25d07f4e6738bfeffaf

SHA256
133baef3ed0edb4db7f527ff8c94bef85ed5814513730f353a4f3ea4474487aa

SHA512
64ab95ab6c2077b25e720eabc4f3b61747da0683ff75cbe71f3f79678e179ca6ed6fa3c11d8b789b03cd34c7720a5f4288beac6572eb9b0d7a7b76525ae22bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2db4bb2f1194ba57b450d4147129560b

SHA1
f84c18b8aa7d098abeabe2dde68fe0853f726066

SHA256
f0b76a54ad60dc944c7a61a704d63cefec1887334c1c3ae9d8defc51287a4c05

SHA512
762afd254e7a9851f8460b5bbdef6d6fbf433ba6fb6534f1970d04ff93e56d2708574bb4c6640283997c8c08d282df47cae1a27166357700de113ae9a3e1a54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f359a41f9bf6082be3c7bdb6ca0d0f64

SHA1
1c788d70ac64f62e681860141e25067362a75eac

SHA256
39d352aa8b1246d8cf218afdd5b8db802260f66174c2085cac21d6a998b204cd

SHA512
756277ba16398e067f1b736ff988442ba72c056d8fc6d8a6e008626854760847d2f4a98f2b40d89c368e8afe5177607f8631b023838d3381c525bd638ae2b293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58af08.TMP

Filesize
1KB

MD5
765053052a4404d6403c5e60d7bdc9b4

SHA1
24dcf1f6bc7e2672c215aa898c598cb621ef7df1

SHA256
74ec2a36298222c51364e14f3debb1d04b87c2fa68d108898d676df65086d492

SHA512
d92142a31e8a9efb125a48f0ad95b309f7f51e93d6248e2a220c27353d330b7d7a37bbd141b2912a0408220259e163bbc95eecfa88c629802ed1346aa365b631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c85c9cbf85d758222a0beaee0a5ecfbd

SHA1
54d30b2dda0257250d58430f1d0f9e77923fdaa5

SHA256
d42a78802700a5a3473a9a49c53824ab16562ccaf2355daaf3a875e47c9790dd

SHA512
60a56cfe18c43f60ddd5969465206d83dbef4ef8005667395f5856062fb3eaa125290770bda2947144225652b9c136b9fde1ed3ec1e7fda7f89b287465c4f314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b77eaa975af0837bc22112f3863f17fd

SHA1
f2230b7e068db2a5fa11037da586fab4e60a3937

SHA256
14d3f24b5e160dcbc2a101b6321dda43e12b5ffb480a2a3179b4db5eec3f2622

SHA512
2998ab214bb2eaea4db7eb1122c4069a8e5acd2d3001d141796bee872fc56e141cdcbf615ded68b69c62f44dba4c52d03505ddf3fb29a4020810e915ca0022dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd2a63f3112bb0da21f984c495e578be

SHA1
37f7212ab95c89794a4d136bfa4a3ab3bff7f45b

SHA256
3f09c3a3f4d17c06351639848883d653c6a55536e73876c4832a3a99169bb448

SHA512
ccc2b8855b8376a3a77ed2e8a413cdf0ac1393b759d2a0acf56bd2e1392ed97330239d87090e2db7db3f8052a63c420c9d642e9be6f746d8424ce316e19aad9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0af2b6f86e45b44a2ad88249155c3316

SHA1
cf1c7a3ace1525b6aa9ee9d765826de098d876ff

SHA256
232196e016a0e77144ab9ce8c65e8bb5584ac02f6df187a5a86d2200461b99f4

SHA512
15fc19f6a9fec5f8b47c7d22b49ad820d63e8a6cf514fae3175535fa4fd9249ce329cbb3da3317b5aa3d22c8c4ac8175c57d5569a37a35188cb46e3bfaf84042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1adf2b32cae5d4367abc1a5dec9e93f

SHA1
9a8e1740c589bcc67a936a21549ab63c9115f479

SHA256
fc22c2ebddeb45b5329d10ba2a42a12001eeed1384a78f6d90a2ba58a27aa8a0

SHA512
2280388bb8e699e6bd7af093cebe8a553bfeb2ccf315c46555c314ec63937d3af50e5ece37d64bce66f824ea014e35bd97e0b685256ebf4ef8ca6ed382770025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d32418855233a9166c3ba5c16ef549f

SHA1
710819b9dd54b6efed23d2ef110e9804f3c0a6fa

SHA256
98f5d4c403a7ef5ff988af4d54fd6ee741ce3d6aa619c26d03b38a7c6e3dae94

SHA512
871169bd8030e5c8b4f2402dc1f9c82268f33bd30f9fdc28796f7040c8f862cc8bb33d6c5b2c2ae6f504c44977b16e139c69b22e8e82f8db6529b61d75d13181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3ea6974644b6e0df915f08ef7a4528cc

SHA1
6d861369f686f5c1ed90d11c5785724edc3a4990

SHA256
d3e93c07ba6ffe491483b3597fdf1aeb6a6de84eab6ca837ae0582e826e8a543

SHA512
f7aa39b39bb0e9dea3b99fb9ae91acbed174873ba1e6b1678a6b0ed41ed72a5b8d2eaf0c31486be5181aba41dd1c1a8d4825104e07636ebddbede1bace614179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab79fc78d3f0f4233b4fbdbb2c4d447a

SHA1
1e666ae17b5bd57948c0f8a4ebc51ac7235412cf

SHA256
0a9797860fb44804c55b7acbc7cf55714540360ee9baff08ca52a178bb7c3d4f

SHA512
83c8b462eb845af41318cbafd7b075a598bd31c3c5fc0e2ffec567814fee6843a8bebd518dc2a552ca91aa82f09e28bc492c3eb8c6cb1aa6fe0d5be98f84ee40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c11a6da7fb9369024fa1126c8e474c9b

SHA1
a21c34cab66659868e240d7f2ed940e4ceb1ba46

SHA256
797cdc2a2d68f2ba0b734653569e3254ec0f36832c759daec11cf0771e8d0708

SHA512
b18cc493d8bfd7a939d0a16cc452fc7c9812fdbbb9dbaf6cb60f01f8c0ae86acccfc7e0b4d9db77bbe48cb0d5fd090e6d72e442560ce72678703eac3bf0b1985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6a5844e1794e9b4d2139ced653c035d

SHA1
58988091f539a401654b3188753c7ca322051549

SHA256
6e4fa23b8eb61cd3f661abcdcdb9499b7613cb8c14459ba7b268bb76dfc13f88

SHA512
67f513184074e36d867f5f17143b090b72d1aa36c7645dba9d0f31ec0e3efeaeca6f294466d3f38e5e486af1e5e158f98d77eb11475b97e15bd48e9d48845dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1cb1433e2f4578e7e1959849c3f762e5

SHA1
bb0da0a979731792ced2d8d131e0642cc3f07b7a

SHA256
fd28bd05dd01a5ca470798751296bbae9472ab652e239a6e7ba88fe721cc38a4

SHA512
6428e161c01f16e46076f58e4d7bf6b204910aff0335bd570941640ef1f0e44b85971d89eeafb4fb047143597e4d78f15a22ab16f814b5f61e97f65c827983fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8bf7e86c4c77ac9de2ec0cf2afb43b43

SHA1
a36640b2a1b42a14bd22590d0cf0e3db5ed66ff9

SHA256
09aabdfe040555dfd4161339ba6a6b527816b5de4a27bb1a39f2c92f85b005b4

SHA512
65f4523b8019d06ddf49b5c956dc93a07b4f26f81a5c8e402ac1a8dbeea060bdcd4155e6d4107d2615140bd2021d478f8646fb7328bf3cbfb3f4ef78d59c3154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
768KB

MD5
69178db3b5a76894c31ea44e7cd21585

SHA1
5d0db87b0cd8f1fa57b32d86a207754a41d62076

SHA256
1a33c4cdcb155252849f3ad8f412c75fa6aed557410fa39a7591541274b8de7c

SHA512
e61ab55a6b9becd0b695a4a7bfc8cf89477a4c1cee01a6cddbe1f2a60e7834c7dce2c6468828da1963df990152e9a02d52a975b25c183a516d8e8569437975ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt

Filesize
88B

MD5
afcdb79d339b5b838d1540bf0d93bfa6

SHA1
4864a2453754e2516850e0431de8cade3e096e43

SHA256
3628cee0bef5a5dd39f2057b69fbf2206c4c4a320ea2b1ef687510d7aa648d95

SHA512
38e7e92f913822cc023e220035ada6944ffbc427023687938fe5cbb7a486abad94808239f63577c195afb520fe1a1a1b14e1050c0c03c7d324ddbf7cffdc304c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1AB47D983856478EAE871BF9294A46F.TMP

Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc44BBB77475A4D3C85B2D71786BE715E.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc8566EB70CAFB432FAC808A1C27551CA8.TMP

Filesize
644B

MD5
dac60af34e6b37e2ce48ac2551aee4e7

SHA1
968c21d77c1f80b3e962d928c35893dbc8f12c09

SHA256
2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

SHA512
1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

Download Submit
C:\Users\Admin\Downloads\961c3628-90fa-46b1-a44c-3ef4550218ab.tmp

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 11920.crdownload

Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 453921.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 902476.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\b87ca7c0-81ff-4160-9f55-a8dfecc79098.tmp

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/488-576-0x000000001C460000-0x000000001C468000-memory.dmp

Filesize
32KB

Download
memory/488-578-0x000000001CAE0000-0x000000001CAEE000-memory.dmp

Filesize
56KB

Download
memory/488-577-0x00000000220B0000-0x00000000220E8000-memory.dmp

Filesize
224KB

Download
memory/488-562-0x0000000000AF0000-0x0000000000F54000-memory.dmp

Filesize
4.4MB

Download
memory/1116-2357-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1176-2497-0x000000001CB50000-0x000000001CBB2000-memory.dmp

Filesize
392KB

Download
memory/1176-2496-0x000000001C9E0000-0x000000001CA86000-memory.dmp

Filesize
664KB

Download
memory/1176-2495-0x000000001C510000-0x000000001C9DE000-memory.dmp

Filesize
4.8MB

Download
memory/1400-741-0x0000000000CC0000-0x0000000000D32000-memory.dmp

Filesize
456KB

Download
memory/1400-742-0x00000000057A0000-0x000000000583C000-memory.dmp

Filesize
624KB

Download
memory/1400-746-0x00000000059E0000-0x0000000005A36000-memory.dmp

Filesize
344KB

Download
memory/1400-745-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/1400-744-0x0000000005940000-0x00000000059D2000-memory.dmp

Filesize
584KB

Download
memory/1400-743-0x0000000005E50000-0x00000000063F6000-memory.dmp

Filesize
5.6MB

Download
memory/1764-2369-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2444-2499-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2516-2368-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2600-2353-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3028-2355-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3180-2896-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3712-2902-0x0000000002F50000-0x0000000002F6A000-memory.dmp

Filesize
104KB

Download
memory/3712-2904-0x0000000002F50000-0x0000000002F6A000-memory.dmp

Filesize
104KB

Download
memory/3712-2354-0x0000000001350000-0x0000000001351000-memory.dmp

Filesize
4KB

Download
memory/3712-2900-0x0000000001600000-0x0000000001616000-memory.dmp

Filesize
88KB

Download
memory/4456-2356-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4568-2500-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4768-2372-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download