Overview

overview

10

Static

static

1

asd.rar

windows11-21h2-x64

10

Analysis

  • max time kernel
    269s
  • max time network
    267s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-11-2024 03:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    asd.rar

  • Size

    32KB

  • MD5

    426b0bd3bf8883843f516d4c921deb24

  • SHA1

    d9316f56202eb500fe4a34b1d7c3683b16edc5e6

  • SHA256

    27bab8020d0e62c51725515958b394e32822498c9f1dd68e98d4ff24a895827b

  • SHA512

    0675fc0253737faf5677d49f36fb50f529e3268afa53e0a3b97eb0dd6201ba846af5ccca5ba1f565e867a99b30b26303e57c6a49a405168b4a2dad03b949264e

  • SSDEEP

    768:iUzE1KAb3u5dI6iJCZwXbiMFXLQJz8pvwgojRBSEmDe:5Q1Bu5wJC9o4vRoEmDe

Score
10/10
asyncratstormkittydefaultcollectiondiscoveryevasionpersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.24:11061

Mutex

asdadw

Attributes
  • delay

    1

  • install

    false

  • install_file

    asdawdasd

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Async RAT payload 1 IoCs
    rat
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 18 IoCs
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\asd.rar"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3796
    • C:\Users\Admin\AppData\Local\Temp\7zO4DE5D1B7\asd.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO4DE5D1B7\asd.exe"
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1708
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Windows\system32\systeminfo.exe
          systeminfo
          4⤵
          • Gathers system information
          PID:4760
        • C:\Windows\system32\HOSTNAME.EXE
          hostname
          4⤵
            PID:4288
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic logicaldisk get caption,description,providername
            4⤵
            • Collects information from the system
            • Suspicious use of AdjustPrivilegeToken
            PID:3856
          • C:\Windows\system32\net.exe
            net user
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4312
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 user
              5⤵
                PID:1016
            • C:\Windows\system32\query.exe
              query user
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1432
              • C:\Windows\system32\quser.exe
                "C:\Windows\system32\quser.exe"
                5⤵
                  PID:2488
              • C:\Windows\system32\net.exe
                net localgroup
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3012
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 localgroup
                  5⤵
                    PID:3544
                • C:\Windows\system32\net.exe
                  net localgroup administrators
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4588
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 localgroup administrators
                    5⤵
                      PID:1164
                  • C:\Windows\system32\net.exe
                    net user guest
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2680
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 user guest
                      5⤵
                        PID:2784
                    • C:\Windows\system32\net.exe
                      net user administrator
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4024
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user administrator
                        5⤵
                          PID:1828
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic startup get caption,command
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:236
                      • C:\Windows\system32\tasklist.exe
                        tasklist /svc
                        4⤵
                        • Enumerates processes with tasklist
                        PID:2284
                      • C:\Windows\system32\ipconfig.exe
                        ipconfig /all
                        4⤵
                        • Gathers network information
                        PID:1060
                      • C:\Windows\system32\ROUTE.EXE
                        route print
                        4⤵
                          PID:4496
                        • C:\Windows\system32\ARP.EXE
                          arp -a
                          4⤵
                          • Network Service Discovery
                          PID:1648
                        • C:\Windows\system32\NETSTAT.EXE
                          netstat -ano
                          4⤵
                          • System Network Connections Discovery
                          • Gathers network information
                          PID:1820
                        • C:\Windows\system32\sc.exe
                          sc query type= service state= all
                          4⤵
                          • Launches sc.exe
                          PID:1868
                        • C:\Windows\system32\netsh.exe
                          netsh firewall show state
                          4⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:1428
                        • C:\Windows\system32\netsh.exe
                          netsh firewall show config
                          4⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:4844
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                        3⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2424
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          4⤵
                            PID:2936
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profile
                            4⤵
                            • Event Triggered Execution: Netsh Helper DLL
                            • System Network Configuration Discovery: Wi-Fi Discovery
                            PID:2384
                          • C:\Windows\system32\findstr.exe
                            findstr All
                            4⤵
                              PID:4740
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4296
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              4⤵
                                PID:5112
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show networks mode=bssid
                                4⤵
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:536
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe"
                              3⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:1712
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 147.185.221.24 4448 HVNC_MUTEX
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1704
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                              3⤵
                              • System Network Configuration Discovery: Wi-Fi Discovery
                              PID:5236
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                4⤵
                                  PID:4076
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profile
                                  4⤵
                                  • Event Triggered Execution: Netsh Helper DLL
                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                  PID:1636
                                • C:\Windows\system32\findstr.exe
                                  findstr All
                                  4⤵
                                    PID:5828
                                • C:\Windows\SYSTEM32\cmd.exe
                                  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                  3⤵
                                    PID:1056
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      4⤵
                                        PID:5396
                                      • C:\Windows\system32\netsh.exe
                                        netsh wlan show networks mode=bssid
                                        4⤵
                                        • Event Triggered Execution: Netsh Helper DLL
                                        PID:4476
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pornhub.com/
                                      3⤵
                                        PID:6196
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ff8ba793cb8,0x7ff8ba793cc8,0x7ff8ba793cd8
                                          4⤵
                                            PID:6280
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DEAFD97\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DEAFD97\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3636
                                      • C:\Windows\notepad.exe
                                        "C:\Windows\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\7zO4DEC3BF7\asd.exe"
                                        2⤵
                                        • Opens file in notepad (likely ransom note)
                                        PID:1448
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DE7E6F7\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DE7E6F7\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4564
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DEC9E38\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DEC9E38\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:392
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DE3CD78\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DE3CD78\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:1256
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DE1DC0A\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DE1DC0A\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:5588
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DE7020A\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DE7020A\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:2140
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DEA100A\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DEA100A\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:5228
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DEF460A\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DEF460A\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:3180
                                      • C:\Users\Admin\AppData\Local\Temp\7zO4DE5B70A\asd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zO4DE5B70A\asd.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:4556
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      PID:716
                                    • C:\Windows\system32\BackgroundTransferHost.exe
                                      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                      1⤵
                                      • Modifies registry class
                                      PID:3756
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                      1⤵
                                        PID:848
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ba793cb8,0x7ff8ba793cc8,0x7ff8ba793cd8
                                          2⤵
                                            PID:3816
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7312414471161652829,17404999287976470,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
                                            2⤵
                                              PID:4656
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,7312414471161652829,17404999287976470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:960
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                            1⤵
                                            • Enumerates system info in registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:4276
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ba793cb8,0x7ff8ba793cc8,0x7ff8ba793cd8
                                              2⤵
                                                PID:780
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
                                                2⤵
                                                  PID:2292
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2192
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
                                                  2⤵
                                                    PID:4644
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                                                    2⤵
                                                      PID:852
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                                                      2⤵
                                                        PID:244
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
                                                        2⤵
                                                          PID:5256
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
                                                          2⤵
                                                            PID:5264
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                                                            2⤵
                                                              PID:5272
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
                                                              2⤵
                                                                PID:5396
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
                                                                2⤵
                                                                  PID:5576
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
                                                                  2⤵
                                                                    PID:5696
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                                                                    2⤵
                                                                      PID:5764
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
                                                                      2⤵
                                                                        PID:2360
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
                                                                        2⤵
                                                                          PID:4784
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
                                                                          2⤵
                                                                            PID:1432
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:1
                                                                            2⤵
                                                                              PID:4412
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
                                                                              2⤵
                                                                                PID:1684
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
                                                                                2⤵
                                                                                  PID:5080
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5064
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                                                                                    2⤵
                                                                                      PID:3780
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
                                                                                      2⤵
                                                                                      • NTFS ADS
                                                                                      PID:1648
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
                                                                                      2⤵
                                                                                        PID:5928
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3032
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
                                                                                          2⤵
                                                                                            PID:3936
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:1
                                                                                            2⤵
                                                                                              PID:4356
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                                                                                              2⤵
                                                                                                PID:3364
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5808
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6980 /prefetch:2
                                                                                                  2⤵
                                                                                                    PID:5788
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5900
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:536
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:1496
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4444
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:2484
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:6352
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:760
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:6812
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:6420
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1504 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:2256
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13687789950103381970,1455975033404279976,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:6972
                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:3804
                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:5164
                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:380
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                              1⤵
                                                                                                                                PID:1420
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
                                                                                                                                1⤵
                                                                                                                                  PID:3180

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Reconnaissance

                                                                                                                                Resource Development

                                                                                                                                Initial Access

                                                                                                                                Execution

                                                                                                                                Command and Scripting Interpreter

                                                                                                                                1
                                                                                                                                T1059

                                                                                                                                Persistence

                                                                                                                                Account Manipulation

                                                                                                                                1
                                                                                                                                T1098

                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                1
                                                                                                                                T1547

                                                                                                                                Active Setup

                                                                                                                                1
                                                                                                                                T1547.014

                                                                                                                                Create or Modify System Process

                                                                                                                                1
                                                                                                                                T1543

                                                                                                                                Windows Service

                                                                                                                                1
                                                                                                                                T1543.003

                                                                                                                                Event Triggered Execution

                                                                                                                                1
                                                                                                                                T1546

                                                                                                                                Netsh Helper DLL

                                                                                                                                1
                                                                                                                                T1546.007

                                                                                                                                Privilege Escalation

                                                                                                                                Account Manipulation

                                                                                                                                1
                                                                                                                                T1098

                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                1
                                                                                                                                T1547

                                                                                                                                Active Setup

                                                                                                                                1
                                                                                                                                T1547.014

                                                                                                                                Create or Modify System Process

                                                                                                                                1
                                                                                                                                T1543

                                                                                                                                Windows Service

                                                                                                                                1
                                                                                                                                T1543.003

                                                                                                                                Event Triggered Execution

                                                                                                                                1
                                                                                                                                T1546

                                                                                                                                Netsh Helper DLL

                                                                                                                                1
                                                                                                                                T1546.007

                                                                                                                                Defense Evasion

                                                                                                                                Impair Defenses

                                                                                                                                1
                                                                                                                                T1562

                                                                                                                                Disable or Modify System Firewall

                                                                                                                                1
                                                                                                                                T1562.004

                                                                                                                                Modify Registry

                                                                                                                                1
                                                                                                                                T1112

                                                                                                                                Credential Access

                                                                                                                                Credentials from Password Stores

                                                                                                                                1
                                                                                                                                T1555

                                                                                                                                Credentials from Web Browsers

                                                                                                                                1
                                                                                                                                T1555.003

                                                                                                                                Unsecured Credentials

                                                                                                                                1
                                                                                                                                T1552

                                                                                                                                Credentials In Files

                                                                                                                                1
                                                                                                                                T1552.001

                                                                                                                                Discovery

                                                                                                                                Browser Information Discovery

                                                                                                                                1
                                                                                                                                T1217

                                                                                                                                Network Service Discovery

                                                                                                                                1
                                                                                                                                T1046

                                                                                                                                Peripheral Device Discovery

                                                                                                                                2
                                                                                                                                T1120

                                                                                                                                Permission Groups Discovery

                                                                                                                                1
                                                                                                                                T1069

                                                                                                                                Local Groups

                                                                                                                                1
                                                                                                                                T1069.001

                                                                                                                                Process Discovery

                                                                                                                                1
                                                                                                                                T1057

                                                                                                                                Query Registry

                                                                                                                                6
                                                                                                                                T1012

                                                                                                                                System Information Discovery

                                                                                                                                7
                                                                                                                                T1082

                                                                                                                                System Location Discovery

                                                                                                                                1
                                                                                                                                T1614

                                                                                                                                System Language Discovery

                                                                                                                                1
                                                                                                                                T1614.001

                                                                                                                                System Network Configuration Discovery

                                                                                                                                1
                                                                                                                                T1016

                                                                                                                                Wi-Fi Discovery

                                                                                                                                1
                                                                                                                                T1016.002

                                                                                                                                System Network Connections Discovery

                                                                                                                                1
                                                                                                                                T1049

                                                                                                                                Lateral Movement

                                                                                                                                Collection

                                                                                                                                Data from Local System

                                                                                                                                2
                                                                                                                                T1005

                                                                                                                                Email Collection

                                                                                                                                1
                                                                                                                                T1114

                                                                                                                                Command and Control

                                                                                                                                Web Service

                                                                                                                                1
                                                                                                                                T1102

                                                                                                                                Exfiltration

                                                                                                                                Impact

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\asd.exe.log
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  b4e91d2e5f40d5e2586a86cf3bb4df24

                                                                                                                                  SHA1

                                                                                                                                  31920b3a41aa4400d4a0230a7622848789b38672

                                                                                                                                  SHA256

                                                                                                                                  5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

                                                                                                                                  SHA512

                                                                                                                                  968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  Filesize

                                                                                                                                  152B

                                                                                                                                  MD5

                                                                                                                                  cb557349d7af9d6754aed39b4ace5bee

                                                                                                                                  SHA1

                                                                                                                                  04de2ac30defbb36508a41872ddb475effe2d793

                                                                                                                                  SHA256

                                                                                                                                  cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

                                                                                                                                  SHA512

                                                                                                                                  f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                  Filesize

                                                                                                                                  152B

                                                                                                                                  MD5

                                                                                                                                  aad1d98ca9748cc4c31aa3b5abfe0fed

                                                                                                                                  SHA1

                                                                                                                                  32e8d4d9447b13bc00ec3eb15a88c55c29489495

                                                                                                                                  SHA256

                                                                                                                                  2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

                                                                                                                                  SHA512

                                                                                                                                  150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07716107-fbdd-4777-9e83-6de429954a52.tmp
                                                                                                                                  Filesize

                                                                                                                                  872B

                                                                                                                                  MD5

                                                                                                                                  b0b60c473b8dd42754763d9781ca89b3

                                                                                                                                  SHA1

                                                                                                                                  0836b5ee971d0403e5b26099ae0cca87c83620b3

                                                                                                                                  SHA256

                                                                                                                                  ad04257f1e33379988791281567c15b2cc665413fcf1546c681deb665b7e3df5

                                                                                                                                  SHA512

                                                                                                                                  87a5f1e357c768888fa12c2da2fcdce23aa2015ba9bb33131f24b7e61954a1209ada5275128d8dbd7ae9675140367b23eefaee50ebfef3e8b9312565f5ace89f

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d90a6b9-95c5-4eaa-8e48-12bec3832fe1.tmp
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  d55241caf07d72cb65b50afd7452a14e

                                                                                                                                  SHA1

                                                                                                                                  34d48fd5810da28d2837a24888f1ce41e6d0cbb9

                                                                                                                                  SHA256

                                                                                                                                  225e4c81e00176dddaa1428bdafec17cde942814cb43571fac80564e26ea3cb5

                                                                                                                                  SHA512

                                                                                                                                  ffbcfacdd1fe89e1507fb72f180f897f2bda9df08988cf98c129f2b7e5cf9a1d0d2093ff186762dae2002f2e6e53e8b079e3e283f702ba0f38a69dcef95d4d6d

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                                  Filesize

                                                                                                                                  47KB

                                                                                                                                  MD5

                                                                                                                                  0d89f546ebdd5c3eaa275ff1f898174a

                                                                                                                                  SHA1

                                                                                                                                  339ab928a1a5699b3b0c74087baa3ea08ecd59f5

                                                                                                                                  SHA256

                                                                                                                                  939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

                                                                                                                                  SHA512

                                                                                                                                  26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                                                  Filesize

                                                                                                                                  62KB

                                                                                                                                  MD5

                                                                                                                                  c813a1b87f1651d642cdcad5fca7a7d8

                                                                                                                                  SHA1

                                                                                                                                  0e6628997674a7dfbeb321b59a6e829d0c2f4478

                                                                                                                                  SHA256

                                                                                                                                  df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

                                                                                                                                  SHA512

                                                                                                                                  af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                                  Filesize

                                                                                                                                  67KB

                                                                                                                                  MD5

                                                                                                                                  b275fa8d2d2d768231289d114f48e35f

                                                                                                                                  SHA1

                                                                                                                                  bb96003ff86bd9dedbd2976b1916d87ac6402073

                                                                                                                                  SHA256

                                                                                                                                  1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

                                                                                                                                  SHA512

                                                                                                                                  d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                                                  Filesize

                                                                                                                                  19KB

                                                                                                                                  MD5

                                                                                                                                  2e86a72f4e82614cd4842950d2e0a716

                                                                                                                                  SHA1

                                                                                                                                  d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                                                  SHA256

                                                                                                                                  c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                                                  SHA512

                                                                                                                                  7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                  Filesize

                                                                                                                                  63KB

                                                                                                                                  MD5

                                                                                                                                  226541550a51911c375216f718493f65

                                                                                                                                  SHA1

                                                                                                                                  f6e608468401f9384cabdef45ca19e2afacc84bd

                                                                                                                                  SHA256

                                                                                                                                  caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                                                                                                                  SHA512

                                                                                                                                  2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                  Filesize

                                                                                                                                  3KB

                                                                                                                                  MD5

                                                                                                                                  9df244c950207b94b445244ecff53c35

                                                                                                                                  SHA1

                                                                                                                                  9f286fd540b37621846a458240f1ba81282f90a8

                                                                                                                                  SHA256

                                                                                                                                  46c17aea099ae688614471a0dcd4365e6453ded73a24432279358afbcf8c763c

                                                                                                                                  SHA512

                                                                                                                                  88520a10dadabf152b4d7e12373f4170a8133d7eca8be6786edf04e367ebe63fbb2458791938a51cb0c746cf233f88f9325f1fdb18a7ca3ffc8afcdf1a1c89fc

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  MD5

                                                                                                                                  9f5a3b1d0cb2d2a590558ce627f26dca

                                                                                                                                  SHA1

                                                                                                                                  a129289e511f09753ad17aec55ab97e87fd13def

                                                                                                                                  SHA256

                                                                                                                                  0cf3a823fef3d6b4de96cfde01379c86e9ba97c141886a17690456cebbb61680

                                                                                                                                  SHA512

                                                                                                                                  443f3344f78a16da8f186b1ed0fa2e568de7abc94c9b2e6c07fee90bf8e9bca7cb8412f3a6a232f79adf8a34c5788e0c030c9f563ca45913fb6941350329369f

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                  Filesize

                                                                                                                                  3KB

                                                                                                                                  MD5

                                                                                                                                  bf1ef4591c44c25d4c7a60fa2723eb7f

                                                                                                                                  SHA1

                                                                                                                                  50de1679a34b5408815712e43674a7f43e77e063

                                                                                                                                  SHA256

                                                                                                                                  068d24ad70f0298ce35876fe84937e0954a15a66eec546cb4a230b0bed7824b4

                                                                                                                                  SHA512

                                                                                                                                  e2fd4b896d5c3eedb3b59988461de06f6ed770e84ca9c8b94519cff051500d3698eec9ef7d876c2714c8ac9bda81a5d3c8c783a4d28565ca4c01d55c9d7e33e2

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  6ddfc07701c875904b2e7bcf8a542a59

                                                                                                                                  SHA1

                                                                                                                                  9f2f5e69834ae4beb9ebaae3c8153033829112c4

                                                                                                                                  SHA256

                                                                                                                                  0ff00379ed503d50095c996bd1414f9b400009acd48e1373616c4e508d3e709c

                                                                                                                                  SHA512

                                                                                                                                  263d4a3b5894cd70a502942ce49790d88382f38b248e587fbceddfb5c8ba63dbf7e24f50fe322a06cec65f2f409fc6469b0c0fcba17828739b59255d6e5be042

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                  Filesize

                                                                                                                                  5KB

                                                                                                                                  MD5

                                                                                                                                  610404e2049c0b162673a69c4956f3b4

                                                                                                                                  SHA1

                                                                                                                                  f5faf8679691a0daf28dc01d46818e702382888a

                                                                                                                                  SHA256

                                                                                                                                  998a73765942bf84e17f3b140748da155e9069448cc845258ba65e48852d1a6a

                                                                                                                                  SHA512

                                                                                                                                  0f1a5280840ca83b37a3f551f2e74babbc6f79cbd54d91ca3f3c1ae1ab3c4ec5e227ca1a93d7642ab8e92ffb19e9ad78d375d68f3105584390ac8edcb14bfa6d

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  6KB

                                                                                                                                  MD5

                                                                                                                                  7c65a38526ac10190feec1fd63a5f8b9

                                                                                                                                  SHA1

                                                                                                                                  8571b2958a0eb749863fbe73a3f18b363680f4c6

                                                                                                                                  SHA256

                                                                                                                                  a2e386d07314ea4c38d5c0865f8bb76a7136b40a4e25fef1c723025f151ed126

                                                                                                                                  SHA512

                                                                                                                                  7a80048ea2ac2875fd92d076ee9563eb18225b4ae0e63e781eb050330f24dd41b6db3123f33ad3f30a2e93d0bbc4f0812222425b271de11e52792e8a73e5511f

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  6KB

                                                                                                                                  MD5

                                                                                                                                  de1db8c4356a127c9b05ae175cdd3c73

                                                                                                                                  SHA1

                                                                                                                                  d1ece8d8cbf7f4073ef0ecf61364fb73fdc1b2d9

                                                                                                                                  SHA256

                                                                                                                                  61aa72dd7370a6540ce16430fdbfdd4cdd6bb047e7fb09b5775048068bc4747e

                                                                                                                                  SHA512

                                                                                                                                  1e3532d206858e7569da143125aaa99a63fc308d3abf0246901334386001e7fe6ee029f54418a2698df0a4c964578b1183f19c9383251cdb09adcc74ec75be83

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  6KB

                                                                                                                                  MD5

                                                                                                                                  610d2f2d4144e6d1465716919148b7bd

                                                                                                                                  SHA1

                                                                                                                                  f49fb4f24d9700bc983edda239b9b0b2f68068e9

                                                                                                                                  SHA256

                                                                                                                                  cb565ab08aec255ea28a90e4ad44bf8c5dce9d15b1763e89070e0a1cabe669a3

                                                                                                                                  SHA512

                                                                                                                                  b7eeaa18d1d1c4e5d60284bb2fa9847621283581b9985d4e52ddd0baafea95ab83fddcc69e04b8ed2e59a82e651e19f4eae119c90e22c4e5e60c77d47cbbd6ea

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  6KB

                                                                                                                                  MD5

                                                                                                                                  0fb223ef37af5485a40231d754bdda59

                                                                                                                                  SHA1

                                                                                                                                  3bf3bf2ea45e0e8352c44606cb240dcf66fa31a9

                                                                                                                                  SHA256

                                                                                                                                  1fb665463e0d0c8ed344bd62924fc62362a653dd7f059b158b12cc69c3d08eb1

                                                                                                                                  SHA512

                                                                                                                                  c9fd33d1ebf3e8fe8628d3a5ed1b9f3e426d1afc688b616c54a4ee938ea8d412a865b6df534a3a2f8ad34f71862f6685700296007a15155e70360154b7a6b421

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  6KB

                                                                                                                                  MD5

                                                                                                                                  3ab249b48093162fa30489516349586c

                                                                                                                                  SHA1

                                                                                                                                  ab66882afdff3b88940fe297509199502486c482

                                                                                                                                  SHA256

                                                                                                                                  c5f5c9b58e27c03b8b1d4886c30620327b0af7758329b19b3b302f92cd77d961

                                                                                                                                  SHA512

                                                                                                                                  260d6fdb126231a1d34d533eaeeb82219152b9f51ddaa6ece77e80ee44af39961ab4e0d446bd1a5ae814d8531b2a67ba17cdf3b84c88a7c7199c3a2ab168d9ca

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  7KB

                                                                                                                                  MD5

                                                                                                                                  9b418393966046b9eb6a69b7f50ff85a

                                                                                                                                  SHA1

                                                                                                                                  69af8c1a82a6e2415b2cc759fbf8c9d866ca6bf2

                                                                                                                                  SHA256

                                                                                                                                  7e3e6bad3889a32c8d072b120d1c9950f61ae32518d1d93b26b49621e2b0936b

                                                                                                                                  SHA512

                                                                                                                                  a0829738a6b56a8c65259af41295b8b38caff1eb2ed3df9961aac14abe888e045eac1cf1dd1cd0ae2998e5b6c1b25c9667b368445b131bb613a6c32f3efff3cd

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  9KB

                                                                                                                                  MD5

                                                                                                                                  54c42dd1a4d1daa72b4d978e78e140a4

                                                                                                                                  SHA1

                                                                                                                                  639833ebc2f0edefe782f00dc07eb42b82ff657c

                                                                                                                                  SHA256

                                                                                                                                  58d0b93dee5209e7097b23ab8d681d622a2c93d674f59aef4d06f264a378fc36

                                                                                                                                  SHA512

                                                                                                                                  1f45f59b294e1f3e694f398c35970d157458e209206fd2178d27dbd986d027f8937ec6b36ba7c8615bd29bff47be4c65c72d35980d654539f41be043afabd9d2

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  6KB

                                                                                                                                  MD5

                                                                                                                                  d67e2d46aa3ac1bfb12ddc61b2728165

                                                                                                                                  SHA1

                                                                                                                                  45071b5ed6b8eed981b9c7de2350711a0d74ce1c

                                                                                                                                  SHA256

                                                                                                                                  53a21931eae1cee1145ca31680a1e69aec0da16823a6d7d8b352f7712917539f

                                                                                                                                  SHA512

                                                                                                                                  1a16d319d9a52d626e2d810ec5c47ca202a9650af83f457cbc74b41aadffbe38d4edd742322a0ecdf60839e04c3c5c7143b5b7a4c8fce2b82d62b64afb2bb009

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  5KB

                                                                                                                                  MD5

                                                                                                                                  759b7b9a43fdfee35bd6f2c6e5ee49a2

                                                                                                                                  SHA1

                                                                                                                                  3cbba8d78fc7125ff06914d90d1e5cab2f69ab63

                                                                                                                                  SHA256

                                                                                                                                  3d898a89adc6f8d7d45322de9fcb2bc75d4273681e30d711465c9ee4632b3215

                                                                                                                                  SHA512

                                                                                                                                  005bb045dca76d8f85f584a1fa1114ea7d979935fc07caa4b9b2472b3489e4bb7afef509791a62d1e34df3d7b0f6a980a785074847b882e9300a08221ae35b02

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                  Filesize

                                                                                                                                  9KB

                                                                                                                                  MD5

                                                                                                                                  e9f08ef5b9d1d6809223a7e4948d3c6d

                                                                                                                                  SHA1

                                                                                                                                  5dbc36ac395f19fb4bc6027784476727258e1155

                                                                                                                                  SHA256

                                                                                                                                  c3424711b38b641962494624e419a7050a9348c6a68cbcb5e32765186a2ad382

                                                                                                                                  SHA512

                                                                                                                                  29581225ac35274d837b9aeb6996664d0fa7df2e8d5274fdeb5417a338d78468c0c2d7a137080408571d0558579329b2197068ebf85c2ad3c06f98e668b27167

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                  Filesize

                                                                                                                                  72B

                                                                                                                                  MD5

                                                                                                                                  648263a9e691dea39ec6d85e481a2287

                                                                                                                                  SHA1

                                                                                                                                  bf3e67cb83a39fea3bee39be0dbbef9028564094

                                                                                                                                  SHA256

                                                                                                                                  5be02133d1e287c7c6b9c6063cd54893e9624c7a136f69dbbd5ba91e835e23a7

                                                                                                                                  SHA512

                                                                                                                                  977a76aae33961cfcb2c7c0e5cd565f7c09c9bf67e4df2739e7d6bfce9a9248664147c10c9f9261d665080feaf9f2af3a1c01ea4343abd50592ae3f818683ada

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                  Filesize

                                                                                                                                  120B

                                                                                                                                  MD5

                                                                                                                                  9357c8fc88189181dd30e1739bd8a833

                                                                                                                                  SHA1

                                                                                                                                  8addc10af697b1f467e38a2f77b25db0772d334e

                                                                                                                                  SHA256

                                                                                                                                  0442463c8d67f40b0c961f904cbecbc1fd4904be1a8f14243ef22a5c2e138c63

                                                                                                                                  SHA512

                                                                                                                                  603caad114319dcc48a00857e9a9e4d17aab23d6295e34700b4c954fa4d2feacf9623a77a5615e737b1d2adde32a3fc06a99eb6faf2d8f69a1de0d1bca676eee

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a9694.TMP
                                                                                                                                  Filesize

                                                                                                                                  48B

                                                                                                                                  MD5

                                                                                                                                  fd653c3156e8773250f32f534b91a6b7

                                                                                                                                  SHA1

                                                                                                                                  3b98b67e902531934371b6df6442fb2a4128b346

                                                                                                                                  SHA256

                                                                                                                                  955ad5fbf980373a49f23bebfddbaddd6f897ec98c41aa23ac165430de008f57

                                                                                                                                  SHA512

                                                                                                                                  5d442c5ce4089e939d2a2cca2093fadfadc4c3579cf811ee737c608572d764c4f2fa2ad8456b740e02c7e9eb88f91b3a02faebd3633dcf130da44ab37e000ef9

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  172fe98ccf5dd2bf19918e9befaa0fc4

                                                                                                                                  SHA1

                                                                                                                                  31776ee9a4b1cb29cb3aa53928e12b2e6b3222a2

                                                                                                                                  SHA256

                                                                                                                                  c2b36191d9193af10b6dd4c054d4aae7f732eb3e337b659c3ef32ecbd4107a35

                                                                                                                                  SHA512

                                                                                                                                  5d5f564bbb69b16e3936f2d7a3d5b661363fe7c3091086a663454780382877ec6051c0fb480d392217991e8c204cede4ca6ed4a8ecc18e4fcfe90e9255d880c4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  ac50916aee4fa4bc68d988a5da883d09

                                                                                                                                  SHA1

                                                                                                                                  16aa207a12238dd7dd8e6f1f02b7b20d0cac137e

                                                                                                                                  SHA256

                                                                                                                                  42ecb211cee0a0de0baab95fa1c800acd6b2ee128bc3695af41f2b0102fdd12a

                                                                                                                                  SHA512

                                                                                                                                  16cb0cddb0a97193e7f1ed24b98c62e1c24c16e5b03149b28c5282e7f74fa2b25f99ad4dc8d03c5cb3a22f37709c71e765a092569d15a600998d76e383229e68

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  3e2c17f95a71b7642f6e25748558a6f8

                                                                                                                                  SHA1

                                                                                                                                  3042bd3baef18794fc29014cf8443b3e9ad2decb

                                                                                                                                  SHA256

                                                                                                                                  1d0dde8e9293578f2f459eb48f97342341cf52d94e952afb4d13a23061a63a79

                                                                                                                                  SHA512

                                                                                                                                  e423b1bc7ef4f81c29972462d27c2ef4666b08b90143602ce451b155b6d7c491f04a2fdd90a2c6d6676f9ef865263ab38e5c91e05b1e457009be7c09293a6071

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  51f4a60d40d77f5ff6cbdaec4641fc74

                                                                                                                                  SHA1

                                                                                                                                  2f8515c90561e559a533b8c2482cf968b3cc6384

                                                                                                                                  SHA256

                                                                                                                                  c32c97ddd726578d08795e33bebf2173ad0beb7572445b87c63c95376540f2b0

                                                                                                                                  SHA512

                                                                                                                                  5137911a83fba0ab12300ea9c0ea35da01704c69c5b14b532d15a4060fb8fbbdc446bab2e7cae79b72531f6f5ecf5d0c939338743ce9ec187d9cbcd041269a21

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  266b74a61d6e82b4db5b5874ced3c859

                                                                                                                                  SHA1

                                                                                                                                  9968ef94a800601ba0bafba2e322ca490f6e0fa1

                                                                                                                                  SHA256

                                                                                                                                  ac3af9b48855a4a82530a7274b01a2258181909bed4813ceaa3ab8ece8fc9220

                                                                                                                                  SHA512

                                                                                                                                  1475f34034788a325eeb65cc690ff909d6ca2f0349b2edffd05af494e333b83485bd7a30511d6210036711853d55a4af6a121baadc3037a199b0bec1e5f705c4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  e7595b39009c327068bb6318db7cbf71

                                                                                                                                  SHA1

                                                                                                                                  2d8636542bf726c89b646d48c4c5f28a7de7b5fc

                                                                                                                                  SHA256

                                                                                                                                  5041f69c8ac75561c366f7a4658d8a8906f6a293d1cefb65c7cf3473443dab0c

                                                                                                                                  SHA512

                                                                                                                                  29c39019751ad93a574d5b694264b527c2306f5281a6937d91febdcd115c4562e45e26704c6905373133f738b1f971780aed51f3642a5cb0c5023567a1aca550

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  c584dfaab20e97a8d24bb545e5d930fa

                                                                                                                                  SHA1

                                                                                                                                  e7ce5087ece8fad446e72dcfeb55d125d4048545

                                                                                                                                  SHA256

                                                                                                                                  a9be0792a0ec56945e197bd0564c52ec4108718cd0afd3f57e114147b2e3c6db

                                                                                                                                  SHA512

                                                                                                                                  c6ef206fa4bf64e1e241c9558a375a17ecf933ddfa848538402631cc216df6aa35b124488c907fd19caa4fcf3b1e49e41161de4e233585c095f77e7333ff649a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  22827e311b88a0b2a84c67dbc8a79094

                                                                                                                                  SHA1

                                                                                                                                  8618a9d1baa8223636fd8168d96ae1728996eeb2

                                                                                                                                  SHA256

                                                                                                                                  4061fa4ea354e80c26f5c4d66abe7f3f760073b44a9abf6f4f615ed1170559e8

                                                                                                                                  SHA512

                                                                                                                                  7993428a559a0a96d3c935c3722b21672e97b05cb1e14206c346708a2a5cb378a26206641c4a3dbd249a5762629d9150dbf3179189220866d3ecd09d87259623

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591449.TMP
                                                                                                                                  Filesize

                                                                                                                                  536B

                                                                                                                                  MD5

                                                                                                                                  02c36521be24ccd92eeef58223f22853

                                                                                                                                  SHA1

                                                                                                                                  35a08bbb1bfc9d0bd7ccaa3e971bee21a8bda96b

                                                                                                                                  SHA256

                                                                                                                                  02c5d950a49bc180ea5871691ba9715a79d798a339e201b00342326e2782613b

                                                                                                                                  SHA512

                                                                                                                                  3c2406efb2bd47480e422db7712c5a7d2fce0382de6200380da0fc46ab0acbb804f55ef4fbec8f9b019abb42378cc7b50004f402fd0e4b7d2b640f1cb098bd16

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                  Filesize

                                                                                                                                  16B

                                                                                                                                  MD5

                                                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                                                  SHA1

                                                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                  SHA256

                                                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                  SHA512

                                                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                  Filesize

                                                                                                                                  16B

                                                                                                                                  MD5

                                                                                                                                  206702161f94c5cd39fadd03f4014d98

                                                                                                                                  SHA1

                                                                                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                  SHA256

                                                                                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                  SHA512

                                                                                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  MD5

                                                                                                                                  2199ac88728855852f0833565bc7a6a3

                                                                                                                                  SHA1

                                                                                                                                  c6408e9608b05246ab125137b6fd6316a1b2a219

                                                                                                                                  SHA256

                                                                                                                                  9886280b8802b6629fb8affba52cd9d4c4973575e3067797fb4a156e318c2295

                                                                                                                                  SHA512

                                                                                                                                  ab89db948f9ff5b71c36ae328d1a9ec08f6daf8f11fe7b7df532fe928cbb9c8435457a8699f057b3ce00dada72c95692dba6ab48b3364539a595b97156a36aac

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  Filesize

                                                                                                                                  10KB

                                                                                                                                  MD5

                                                                                                                                  453c5cf41274ddb4a3149623f9c8544b

                                                                                                                                  SHA1

                                                                                                                                  56cc3a69d9edaea87c8076892d313b4fd2b30050

                                                                                                                                  SHA256

                                                                                                                                  7a0faa1363ba38850e772074251826703b8200e011ff8f2237f3625c4f76fcf7

                                                                                                                                  SHA512

                                                                                                                                  a249adc52b10b17e7c27a86d61700b027e5c4a7f2622f345dc9e9e3c8c59d2e83c6ffddfb41a31076019150e1996af742cd9d0ac2f3694e2421d269aa249d9c4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  Filesize

                                                                                                                                  10KB

                                                                                                                                  MD5

                                                                                                                                  2bc7f4efdfb2b504fcae7bd8e89812b2

                                                                                                                                  SHA1

                                                                                                                                  9744323dfefcfb86a40783119a31d8917da195ec

                                                                                                                                  SHA256

                                                                                                                                  5b3371e0bd7f8981e91cf6fb0bb90c5f1c5978a2ce10da2bc90a8a10e76d6ae7

                                                                                                                                  SHA512

                                                                                                                                  1677a5d68e8d2d910c46b1f9f49e39828d47444b4259eede9773bc860769a401b86f76d7420ca30d8d25a59523baa68531e7efb2f45650a8affc4aa85292f2fe

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                  Filesize

                                                                                                                                  10KB

                                                                                                                                  MD5

                                                                                                                                  bb7d62b0cb01188aee73651d27b20f7d

                                                                                                                                  SHA1

                                                                                                                                  d52d541a2a9e7a4b7242ff6f371103b90614f9d1

                                                                                                                                  SHA256

                                                                                                                                  2b8789e9755b3f663c2acfc159a2c138ad0bda7b4b0057ee99f24ce4ec780b46

                                                                                                                                  SHA512

                                                                                                                                  edba8dd02af99dd7a72e7301f87fea2510003777f10a85cd71999605cfde36e088beba92544ea7cb11aa1705eaac132dc366bee193a6e3c90f7c5a88e737c858

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\8d625fb0-ce81-4051-89d5-a0726397d0d5.down_data
                                                                                                                                  Filesize

                                                                                                                                  555KB

                                                                                                                                  MD5

                                                                                                                                  5683c0028832cae4ef93ca39c8ac5029

                                                                                                                                  SHA1

                                                                                                                                  248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                                                                                                                  SHA256

                                                                                                                                  855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                                                                                                                  SHA512

                                                                                                                                  aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zO4DE5D1B7\asd.exe
                                                                                                                                  Filesize

                                                                                                                                  74KB

                                                                                                                                  MD5

                                                                                                                                  7bfd1845ffd7585cea13a9aaa6668fbd

                                                                                                                                  SHA1

                                                                                                                                  e045e3cb0da37e1f22991d4f0127e063a6c5aefa

                                                                                                                                  SHA256

                                                                                                                                  348f0695671ef99885979ad51820ec18bd3e8ed09fb3ff5ceb591dc102e8293b

                                                                                                                                  SHA512

                                                                                                                                  9eaf8ad24524d18f2c6bc13bf41d85a4c0eb8705d9840d88501570f23cacccb870364d945293d2f1eff7f49aabee625f3f04286abac4e91995d516f841177f43

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp566.tmp.dat
                                                                                                                                  Filesize

                                                                                                                                  114KB

                                                                                                                                  MD5

                                                                                                                                  9c2aff15e8621453f4e0816211285ea4

                                                                                                                                  SHA1

                                                                                                                                  528523d2aaa3d8e34a7403135f392b6f46b27e8d

                                                                                                                                  SHA256

                                                                                                                                  8ca103b28c1ecfd5080f6412883cc69b6e86edf3b5dd7ef75924746bb75424da

                                                                                                                                  SHA512

                                                                                                                                  770117d15d333a499bce01f6b7d9097ce1c779edac0a341701fa00bf266bee17f80e336e1538a74d9dd28c13628d3d39bdd08deb42cf08662b881b7a0526142d

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp579.tmp.dat
                                                                                                                                  Filesize

                                                                                                                                  160KB

                                                                                                                                  MD5

                                                                                                                                  f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                  SHA1

                                                                                                                                  85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                  SHA256

                                                                                                                                  e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                  SHA512

                                                                                                                                  1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpB1A0.tmp.dat
                                                                                                                                  Filesize

                                                                                                                                  40KB

                                                                                                                                  MD5

                                                                                                                                  a182561a527f929489bf4b8f74f65cd7

                                                                                                                                  SHA1

                                                                                                                                  8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                  SHA256

                                                                                                                                  42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                  SHA512

                                                                                                                                  9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\Directories\Desktop.txt
                                                                                                                                  Filesize

                                                                                                                                  566B

                                                                                                                                  MD5

                                                                                                                                  62c90f7fda0ce69ca26b3399a4035017

                                                                                                                                  SHA1

                                                                                                                                  0cd6c1e515665f612960367b519ce44ef5997847

                                                                                                                                  SHA256

                                                                                                                                  7fb6b48b3385cac8de41de173583eab8991b7c6d9da50356cc9213212fbab72e

                                                                                                                                  SHA512

                                                                                                                                  c16f2e477aa423f6c70857ba0182ca70f50fa6bc0a1771115b058728db8e0a934c64fabe4f25254276619b69cbb0b2ef7856bbd29d2b39983f278ffc301d301a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\Directories\Documents.txt
                                                                                                                                  Filesize

                                                                                                                                  902B

                                                                                                                                  MD5

                                                                                                                                  e40818fc5d55b29df61edcd600b0ae8b

                                                                                                                                  SHA1

                                                                                                                                  331b16ceb344dfe0c903cb337b6ddaccf2eb3e3f

                                                                                                                                  SHA256

                                                                                                                                  66c6d05210297060e3295458c4e0b926c42e06e51c22de2a8a15f29c6a301268

                                                                                                                                  SHA512

                                                                                                                                  8bca2183a676354ba743634b53aa533d14c6a7bbe3a73ba3cdac62b695406f198bc8735d552bb3648d8a21c4251ea88b331b3a0e78e43fe4bd6c8fac69fab2a9

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\Directories\OneDrive.txt
                                                                                                                                  Filesize

                                                                                                                                  25B

                                                                                                                                  MD5

                                                                                                                                  966247eb3ee749e21597d73c4176bd52

                                                                                                                                  SHA1

                                                                                                                                  1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                                                                                                                                  SHA256

                                                                                                                                  8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                                                                                                                                  SHA512

                                                                                                                                  bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\Directories\Pictures.txt
                                                                                                                                  Filesize

                                                                                                                                  582B

                                                                                                                                  MD5

                                                                                                                                  598dcfb1c6ec46eda9341a5ccc9da362

                                                                                                                                  SHA1

                                                                                                                                  7a47156e86e61979bc3c151ace71ab0afa3c26af

                                                                                                                                  SHA256

                                                                                                                                  8445290e6480e587cddf8f04bad08f01efc25c11f89a324e2dd6cf973e3bc3dc

                                                                                                                                  SHA512

                                                                                                                                  3480590bc0ba68c38ff3e1ffbe30a4b6f7c75dee78e29f499132069e9715403b874a8ef99e0512e9f1be3a91fc24a64d1c798f7f3cf8c68fbea5fae39cb97b3c

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\Directories\Startup.txt
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  68c93da4981d591704cea7b71cebfb97

                                                                                                                                  SHA1

                                                                                                                                  fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                                                                                                                                  SHA256

                                                                                                                                  889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                                                                                                                                  SHA512

                                                                                                                                  63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\Directories\Videos.txt
                                                                                                                                  Filesize

                                                                                                                                  23B

                                                                                                                                  MD5

                                                                                                                                  1fddbf1169b6c75898b86e7e24bc7c1f

                                                                                                                                  SHA1

                                                                                                                                  d2091060cb5191ff70eb99c0088c182e80c20f8c

                                                                                                                                  SHA256

                                                                                                                                  a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                                                                                                                                  SHA512

                                                                                                                                  20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\System\Process.txt
                                                                                                                                  Filesize

                                                                                                                                  891B

                                                                                                                                  MD5

                                                                                                                                  2c8d73b60d2714ba75807c0d181fe957

                                                                                                                                  SHA1

                                                                                                                                  6e918526ac7344a69a3ea9c6db8b68ee9ad1e80f

                                                                                                                                  SHA256

                                                                                                                                  a0fb54396189db766112c3f12902cda3551b386109c4f71198cd45962ffcebdf

                                                                                                                                  SHA512

                                                                                                                                  60687530eeb5fbaa23024eb639843fb135e6880548b258726b7b885029d971fd7db892ae51e26baa4c016de7eadcbc24c5d2930811178000c1ab62c479fd162f

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\System\Process.txt
                                                                                                                                  Filesize

                                                                                                                                  3KB

                                                                                                                                  MD5

                                                                                                                                  5c103651e1cb70c88a4aeb520e13af58

                                                                                                                                  SHA1

                                                                                                                                  3a8f938eea7afdd1592a275e19b112263d82ad4c

                                                                                                                                  SHA256

                                                                                                                                  1319109b175a3358614ad0670e0389fed2f38b42a3e214211ffcad05c05cae6c

                                                                                                                                  SHA512

                                                                                                                                  e4ce3f0bbb9e328a2a9cbe30e170accb93ad5bb6f862d30959008fef22e8cb8bf654e19f4ffa8d090fbd2e88b1c91df329964e47225f04affbcbc7141c551a43

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\System\Process.txt
                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  MD5

                                                                                                                                  782d28721f9ad979f3be6aacab072704

                                                                                                                                  SHA1

                                                                                                                                  79e488f07a5602f834b938a999da874cace66cfb

                                                                                                                                  SHA256

                                                                                                                                  0b35793705ce6a2357456bccd235437e0cb56fa18b8de7481f8a6b0d670cc70d

                                                                                                                                  SHA512

                                                                                                                                  8064c19cb3e283b357e1526107e8eb775d638ca553d731a535dcc8ea4144549782f1521c4ac2e259a95400a29a6357ee07aa23ea370b8ffe19a90ca56ae97741

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\System\Process.txt
                                                                                                                                  Filesize

                                                                                                                                  613B

                                                                                                                                  MD5

                                                                                                                                  194ae4e7b36af128f1cf193fd60c91f7

                                                                                                                                  SHA1

                                                                                                                                  edc3e6139cbe7d709a6d4d35ff8f9a76bb3e5ed2

                                                                                                                                  SHA256

                                                                                                                                  dd53866727138c48a1b5e7fc2127e65a947347f0e0d2b2aee3e015303cdecdcf

                                                                                                                                  SHA512

                                                                                                                                  a32c85f02ab590e2e627d0da765fccf048a2ffd52158d5317e5635d47c6d9f6e7f6d67943f40721faef34cb07d8325524ea5bc095aabb594a7c5be552effd726

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\System\Process.txt
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  d03c4da6a6449fd0d1b34928265c8cac

                                                                                                                                  SHA1

                                                                                                                                  22e1564e3851f0805861e99fa35ef1e90b3d45a2

                                                                                                                                  SHA256

                                                                                                                                  710bf7a59c03fce3c34d52f2d31ed2c751970f3709634e16f1b2d239068504f1

                                                                                                                                  SHA512

                                                                                                                                  124977f11f2791abbfc1038316141cc2797633ca450b6c82526c804264307f6e7cb7b47b4220c8187d7f08005dff511cbab04cf87694ba8eabc6837698a5a6b6

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\System\Process.txt
                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  MD5

                                                                                                                                  763418c1ddb0f158beaa731bf924c1b7

                                                                                                                                  SHA1

                                                                                                                                  bcc8e0b4d03f2e4b6811fe59aeef2ff197958850

                                                                                                                                  SHA256

                                                                                                                                  15cab4238fbd64fa8c6db4c273dd74f410f6d0a31b77f7294c69d9caa2cd2edb

                                                                                                                                  SHA512

                                                                                                                                  0c0e03a78dfbaa4817eaad23b8886a1e273f796c06a54bfb0ffbdbf416410b2b193d883345bc297bf6710eacc3c1902d6f8ca03d9154a1082613838b1d9d2117

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\Admin@TYEBXLJN_en-US\System\ProductKey.txt
                                                                                                                                  Filesize

                                                                                                                                  29B

                                                                                                                                  MD5

                                                                                                                                  71eb5479298c7afc6d126fa04d2a9bde

                                                                                                                                  SHA1

                                                                                                                                  a9b3d5505cf9f84bb6c2be2acece53cb40075113

                                                                                                                                  SHA256

                                                                                                                                  f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                                                                                                                                  SHA512

                                                                                                                                  7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\c1802342081e87599e32efec843d3e00\msgid.dat
                                                                                                                                  Filesize

                                                                                                                                  1B

                                                                                                                                  MD5

                                                                                                                                  cfcd208495d565ef66e7dff9f98764da

                                                                                                                                  SHA1

                                                                                                                                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                                                                  SHA256

                                                                                                                                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                                                                  SHA512

                                                                                                                                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                  Filesize

                                                                                                                                  10KB

                                                                                                                                  MD5

                                                                                                                                  a1ce736ad89229417351575fdb2c270e

                                                                                                                                  SHA1

                                                                                                                                  1695cfee188ea17d01a3782c2d99c1dbb1e2c02d

                                                                                                                                  SHA256

                                                                                                                                  90bb636cbfff840e0e678250bd499e74d5c81084b95cb0b7c85603a90fd4f45c

                                                                                                                                  SHA512

                                                                                                                                  807cbf0b1977f908dbc3c1b5bd314704ad8bff97f23bd32d705abaf2344f3e1f89100346546fcfbe300f78a4155185785a0781317e88a9df9ddf1f8243078929

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                  Filesize

                                                                                                                                  10KB

                                                                                                                                  MD5

                                                                                                                                  437c3cd46df3d50ceb4d27855b4c6074

                                                                                                                                  SHA1

                                                                                                                                  c700e0067d42001ae824c83d01e7090f56d72fba

                                                                                                                                  SHA256

                                                                                                                                  2a5adc8fdcc03edf961779c10944e3afbc0779531a101f3c0ffc904914d7052a

                                                                                                                                  SHA512

                                                                                                                                  7912239e6939bdf97ed2202f00c6a4c9308bc1c3cc12c859aa17b3413a4da7c5ce84ce7636536b9b777cd80dd259872e6d891458321bd3a434ea16fe7a618fd4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                                                                                                                                  Filesize

                                                                                                                                  8B

                                                                                                                                  MD5

                                                                                                                                  cf759e4c5f14fe3eec41b87ed756cea8

                                                                                                                                  SHA1

                                                                                                                                  c27c796bb3c2fac929359563676f4ba1ffada1f5

                                                                                                                                  SHA256

                                                                                                                                  c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                                                                                                                                  SHA512

                                                                                                                                  c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 648825.crdownload
                                                                                                                                  Filesize

                                                                                                                                  9.3MB

                                                                                                                                  MD5

                                                                                                                                  e5f4821da50868c15781dc665d0a563a

                                                                                                                                  SHA1

                                                                                                                                  9c6428e092b51a59a3404559003cb6c86351da7d

                                                                                                                                  SHA256

                                                                                                                                  972a6784c9e0a1592adbcfe7c500f1b87322b91e79030ac689451fe30cae5e06

                                                                                                                                  SHA512

                                                                                                                                  e315c6f399619b61d79fd4dd4e3d1a4a61e714f8883fb483fea4b2cbe10f2651c2a0946de75136fb287cfef93e7f33777711a8752adb90c874bb8d0f221ec6c0

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Downloads\dnSpy-master.zip:Zone.Identifier
                                                                                                                                  Filesize

                                                                                                                                  26B

                                                                                                                                  MD5

                                                                                                                                  fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                                  SHA1

                                                                                                                                  d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                                  SHA256

                                                                                                                                  eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                                  SHA512

                                                                                                                                  aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                                  Download Submit

                                                                                                                                • memory/1704-220-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/1704-221-0x00000000058A0000-0x0000000005932000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  584KB

                                                                                                                                  Download

                                                                                                                                • memory/1704-222-0x0000000005940000-0x00000000059DC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  624KB

                                                                                                                                  Download

                                                                                                                                • memory/1704-253-0x0000000006360000-0x0000000006906000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.6MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-93-0x0000000002320000-0x000000000232C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  48KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-36-0x00007FF8C0A10000-0x00007FF8C14D2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-95-0x000000001CA60000-0x000000001CB94000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.2MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-54-0x000000001ADA0000-0x000000001ADBE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-1282-0x000000001B7F0000-0x000000001B800000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-96-0x0000000002330000-0x000000000233A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  40KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-97-0x000000001ADC0000-0x000000001ADCC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  48KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-219-0x000000001C050000-0x000000001C070000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-53-0x000000001C640000-0x000000001C762000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-52-0x000000001C1C0000-0x000000001C236000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  472KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-38-0x00007FF8C0A10000-0x00007FF8C14D2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-94-0x000000001C070000-0x000000001C092000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-33-0x00007FF8C0A13000-0x00007FF8C0A15000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-1475-0x000000001CF90000-0x000000001D143000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-1487-0x000000001B800000-0x000000001B80E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  56KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-1582-0x000000001CF90000-0x000000001D143000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-224-0x000000001CB90000-0x000000001CC0A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  488KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-16-0x00007FF8C0A10000-0x00007FF8C14D2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-1618-0x000000001CF90000-0x000000001D143000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-15-0x00007FF8C0A10000-0x00007FF8C14D2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-13-0x0000000000110000-0x0000000000128000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  96KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-268-0x000000001CC10000-0x000000001CC94000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  528KB

                                                                                                                                  Download

                                                                                                                                • memory/1708-269-0x000000001CF90000-0x000000001D143000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1708-12-0x00007FF8C0A13000-0x00007FF8C0A15000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download