crimsonrat | hxxps://www[.]crunchyroll[.]com/?irclickid=WRLV%3ApS8%3AxyNRGTwq-2h10eUUkCS%3AeQsEXZI2c0&utm_source=impact&utm_medium=affiliate&utm_campaign=1943907&irgwc=1

Analysis

max time kernel
673s
max time network
676s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-01-2025 03:09

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://www.crunchyroll.com/?irclickid=WRLV%3ApS8%3AxyNRGTwq-2h10eUUkCS%3AeQsEXZI2c0&utm_source=impact&utm_medium=affiliate&utm_campaign=1943907&irgwc=1

Score

10^/10

crimsonrat metasploit njrat backdoor bootkit defense_evasion discovery evasion macro macro_on_action persistence phishing privilege_escalation rat trojan upx

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://149.129.72.37:23456/SNpK

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP09; NP09; MAAU)

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001700000002ae5e-3246.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Njrat family
njrat

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4556	2348	rundll32.exe	239
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2752	2348	rundll32.exe	239

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
304	4556	rundll32.exe
307	2752	rundll32.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4392	netsh.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x0019000000025cc7-3306.dat	office_macro_on_action

A potential corporate email address has been identified in the URL: web-vitals@3
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe\:SmartScreen:$DATA	NJRat (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe\:Zone.Identifier:$DATA	NJRat (1).exe

Executes dropped EXE 30 IoCs

pid	Process
2184	YouAreAnIdiot (1).exe
4860	YouAreAnIdiot (1).exe
4556	YouAreAnIdiot (1).exe
2328	YouAreAnIdiot.exe
1964	YouAreAnIdiot.exe
3796	YouAreAnIdiot.exe
1048	YouAreAnIdiot.exe
3856	YouAreAnIdiot.exe
4900	YouAreAnIdiot (2).exe
3324	YouAreAnIdiot (2).exe
3136	NJRat (1).exe
1380	CrimsonRAT.exe
2688	dlrarhsiva.exe
1120	CrimsonRAT.exe
5084	dlrarhsiva.exe
1132	CrimsonRAT.exe
1684	dlrarhsiva.exe
1728	NJRat (1).exe
1380	YouAreAnIdiot (2).exe
6072	BlueScreen.exe
3288	BlueScreen.exe
5012	BlueScreen.exe
328	ArcticBomb.exe
6104	MEMZ.exe
5276	MEMZ.exe
3976	MEMZ.exe
4380	MEMZ.exe
5792	MEMZ.exe
5680	MEMZ.exe
3860	MEMZ.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\NJRat (1).exe\" .."	NJRat (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\NJRat (1).exe\" .."	NJRat (1).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
297	raw.githubusercontent.com
298	raw.githubusercontent.com
148	raw.githubusercontent.com
150	raw.githubusercontent.com
257	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api64.ipify.org
26	api64.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002400000002aec3-4206.dat	upx
behavioral1/memory/6072-4222-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/6072-4226-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/3288-4247-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/3288-4258-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/files/0x002100000002ae5f-4298.dat	upx
behavioral1/memory/328-4326-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 9 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NJRat (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BlueScreen.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{247EA3A1-BCE7-4CEE-A0F7-3240D5C00EDB}\8tr.exe:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1844	2184	WerFault.exe	134
3292	4860	WerFault.exe	140
3044	4556	WerFault.exe	145
396	2328	WerFault.exe	150
4824	1964	WerFault.exe	154
4244	3796	WerFault.exe	157
3632	1048	WerFault.exe	160
4800	3856	WerFault.exe	163
1664	4900	WerFault.exe	172
2976	3324	WerFault.exe	175
1896	1380	WerFault.exe	261

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArcticBomb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJRat (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJRat (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133804341338870346"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	msedge.exe

NTFS ADS 24 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 344275.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BlueScreen.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 149679.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\Desktop\LÑ≡▌╠b╤∩t╡gGçbªé¿3Z─2ΦExlⁿw┬âS7├D86║!⌡Jå±¢gqú(Ω≈k╙å»█îà╪╕¡3K+aB)ooεeòy¼╫S▌ï╙Öÿ[╠≡╜å6.£╟¥S╞┼:$G4╣ⁿσ>v╫ç«ÇMΣÜ∩_päΦ8┐uH═█YìúαCƒ▀£v╞▓»ƒ«»Ç╧Γê╕╓f╔ƒ3KÇ<o╜p2╞∙	cmd.exe
File created	C:\Users\Admin\Desktop\LÑ≡▌╠b╤∩t╡gGçbªé¿3Z─2ΦExlⁿw┬âS7├D86║!⌡Jå±¢gqú(Ω≈k╙å»█îà╪╕¡3K+aB)ooεeòy¼╫S▌ï╙Öÿ[╠≡╜å6.£╟¥S╞┼:$G4╣ⁿσ>v╫ç«ÇMΣÜ∩_päΦ8┐uH═█YìúαCƒ▀£v╞▓»ƒ«»Ç╧Γê╕╓f╔ƒ3KÇ<o╜p2╞∙	cmd.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 937146.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 651234.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 829754.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 458468.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CobaltStrike.doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 740040.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NJRat (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\index.html:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 951529.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\Desktop\LÑ≡▌╠b╤∩t╡gGçbªé¿3Z─2ΦExlⁿw┬âS7├D86║!⌡Jå±¢gqú(Ω≈k╙å»█îà╪╕¡3K+aB)ooεeòy¼╫S▌ï╙Öÿ[╠≡╜å6.£╟¥S╞┼:$G4╣ⁿσ>v╫ç«ÇMΣÜ∩_päΦ8┐uH═█YìúαCƒ▀£v╞▓»ƒ«»Ç╧Γê╕╓f╔ƒ3KÇ<o╜p2╞∙	cmd.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 29722.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{247EA3A1-BCE7-4CEE-A0F7-3240D5C00EDB}\8tr.exe:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 7 IoCs

pid	Process
1916	vlc.exe
2348	WINWORD.EXE
2348	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4316	WINWORD.EXE
5312	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
4484	msedge.exe
4484	msedge.exe
3116	msedge.exe
3116	msedge.exe
1548	identity_helper.exe
1548	identity_helper.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
1852	msedge.exe
1852	msedge.exe
788	msedge.exe
788	msedge.exe
2348	msedge.exe
2348	msedge.exe
4084	msedge.exe
4084	msedge.exe
1664	chrome.exe
1664	chrome.exe
3460	msedge.exe
3460	msedge.exe
4732	msedge.exe
4732	msedge.exe
2084	msedge.exe
2084	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
1444	msedge.exe
1444	msedge.exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe
3136	NJRat (1).exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1916	vlc.exe
3136	NJRat (1).exe
4732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeShutdownPrivilege	1664	chrome.exe
Token: SeCreatePagefilePrivilege	1664	chrome.exe
Token: SeDebugPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: SeDebugPrivilege	1728	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe
Token: 33	3136	NJRat (1).exe
Token: SeIncBasePriorityPrivilege	3136	NJRat (1).exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
1916	vlc.exe
1916	vlc.exe
1916	vlc.exe
1916	vlc.exe
1916	vlc.exe
1916	vlc.exe
1916	vlc.exe
1916	vlc.exe
1916	vlc.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
1664	chrome.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
1916	vlc.exe
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
2348	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4316	WINWORD.EXE
4316	WINWORD.EXE
4316	WINWORD.EXE
4316	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
4960	WINWORD.EXE
5312	WINWORD.EXE
5312	WINWORD.EXE
5312	WINWORD.EXE
6104	MEMZ.exe
5276	MEMZ.exe
3976	MEMZ.exe
4380	MEMZ.exe
5792	MEMZ.exe
5680	MEMZ.exe
3860	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3712	4484	msedge.exe	78
PID 4484 wrote to memory of 3712	4484	msedge.exe	78
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3168	4484	msedge.exe	79
PID 4484 wrote to memory of 3092	4484	msedge.exe	80
PID 4484 wrote to memory of 3092	4484	msedge.exe	80
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81
PID 4484 wrote to memory of 3616	4484	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.crunchyroll.com/?irclickid=WRLV%3ApS8%3AxyNRGTwq-2h10eUUkCS%3AeQsEXZI2c0&utm_source=impact&utm_medium=affiliate&utm_campaign=1943907&irgwc=1
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff089f3cb8,0x7fff089f3cc8,0x7fff089f3cd8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7720 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 1228
    3⤵
    - Program crash
    PID:1844
- C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 1200
    3⤵
    - Program crash
    PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:788
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 1228
    3⤵
    - Program crash
    PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,4467962700282140793,14483128383964473678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7752 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1228
    3⤵
    - Program crash
    PID:1664
- C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1200
    3⤵
    - Program crash
    PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E0
1⤵
PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2184 -ip 2184
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4860 -ip 4860
1⤵
PID:4300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1520

C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe
"C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1204
  2⤵
  - Program crash
  PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4556 -ip 4556
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2328 -ip 2328
1⤵
PID:4472

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1200
  2⤵
  - Program crash
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1964 -ip 1964
1⤵
PID:464

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1212
  2⤵
  - Program crash
  PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3796 -ip 3796
1⤵
PID:3576

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 1200
  2⤵
  - Program crash
  PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1048 -ip 1048
1⤵
PID:4468

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1204
  2⤵
  - Program crash
  PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3856 -ip 3856
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4900 -ip 4900
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3324 -ip 3324
1⤵
PID:648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResizeSwitch.bat" "
1⤵
- NTFS ADS
PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResizeSwitch.bat" "
1⤵
- NTFS ADS
PID:3156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResizeSwitch.bat" "
1⤵
- NTFS ADS
PID:4656

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SetExpand.3gp2"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff053ecc40,0x7fff053ecc4c,0x7fff053ecc58
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1768,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1848 /prefetch:3
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3540,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4692,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4924,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4956,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5044,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4976,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5352,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5196,i,2234022755876773514,8058049625910480401,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:616

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff089f3cb8,0x7fff089f3cc8,0x7fff089f3cd8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Users\Admin\Downloads\NJRat (1).exe
  "C:\Users\Admin\Downloads\NJRat (1).exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\Downloads\NJRat (1).exe" "NJRat (1).exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1680 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2348
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    3⤵
    - Process spawned unexpected child process
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:4556
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    3⤵
    - Process spawned unexpected child process
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:2752
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike.doc" /o ""
  2⤵
  PID:4748
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike.doc" /o ""
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1684 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4688
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Executes dropped EXE
  PID:1380
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6032 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2560
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4960
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1120
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  PID:3032
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  PID:5876
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  PID:5172
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  PID:5260
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  PID:5332
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc" /o ""
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6060
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2052
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6052
- C:\Users\Admin\Downloads\ArcticBomb.exe
  "C:\Users\Admin\Downloads\ArcticBomb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2052 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,16525521357012567560,15734852371024383019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1524
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6104
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5276
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3976
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4380
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5792
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5680
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3860
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Executes dropped EXE
PID:1120
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:5084

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Executes dropped EXE
PID:1132
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:1684

C:\Users\Admin\Downloads\NJRat (1).exe
"C:\Users\Admin\Downloads\NJRat (1).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe
"C:\Users\Admin\Downloads\YouAreAnIdiot (2).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 1200
  2⤵
  - Program crash
  PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1380 -ip 1380
1⤵
PID:4628

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5312

C:\Users\Admin\Downloads\BlueScreen.exe
"C:\Users\Admin\Downloads\BlueScreen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
e84d44d1895b88ca9c7cac86c1208ce1

SHA1
519594ae2669638b7db09addb4d2ee44dd3e2fc5

SHA256
46e65ed6ffc112c7e8294fa45fb4dbfc8b785347fd3d2c8f31809cd7ecb115fa

SHA512
9cfecec8ce191a9a8e84875ab1f02d166fb7e5a7cf4be5ea7995ecbd2e01d2a374135778eaef43342b62030fd9f581bd605b2796552f78e7b0af25de440086b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
802704a719df2506de884a97ee30cbd4

SHA1
08ad4227e979be2bd915fa76df7496ac10986c43

SHA256
8b92324b6c5001a6ad199c425c4e3b42dced6754acd5dbd1637787a56d141f44

SHA512
193631a757b58abd5e0c19579ad5b5d12f1db08b2bb7db42246a536649d3452f9fceb6059796aef7ddd6d0c7900079334ba4f0ab1db2486bd873610fc03b401b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e47918e3c36e44b749abd1e8accc7fee

SHA1
ca8f44d0d3278574358d656132c9cf5f338d83e6

SHA256
fdcac214bdc5004be7b1b17b40d0639875ec6d77a57f236411214ca3a2e4a8b9

SHA512
fafa74f2f0c975a2446299cc53d6256079a800413c19dfe89b2c186058311d69de47d30c35ccc071bd20f5d2f2c24e0760c74120b273de5542ddd7867f01aab2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3210ff125fc9af0c51ccb1b759890573

SHA1
32058cebc5738dd07831e2511dd18bc8c18fb9c8

SHA256
1ad13e44395b3bcc9f1b73b7af7d354d019158c8d951d91b3187a94cd03ebba9

SHA512
5fd97fb52fc30a15eb7cd8d8dc6fb485fc662dadd3c3e8a9fb1dd04be9a2e1970b0ce0c51c3167a8805f9a38ea10477ef72f7b8d40e7759599c1a8df27ca7262

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
891d52d9af4eb1a70f592c27226e4293

SHA1
1daa5115a97627f2d1f6444c09f39a4e0c164a73

SHA256
9b39dbe7ed8c24cf2b1fa9bc31ecc67bda47613956ed858bc107ce7e33dd07fb

SHA512
98aa4bece6f8ed6f6b7519c6fa1efdaa5ede666dc16019b09245f4b3dd61ee7f902b47c34af937dbb7729c611c816ab21095e15beeed365960c8ebfd4d2b94ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ff54905a87d0b21743d3e9279ebcd213

SHA1
95ea441196a1b87ae16ecad20fccaff7bc345fc4

SHA256
b69b00b0e47e7af4f8099b502546643b1d4f8e18494f8c5297bb91d5d8d93b94

SHA512
0e65f2efc8e9a479221b867c1666b2856355c77a7e10f13113d155f47b96826ca4ef2751588999718a0b84130971e76c3368d62026e96f42f8058a22471e271e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3b77d303141751c0028f285255e8dc5d

SHA1
acd09320452506334860283937b842d21bac9897

SHA256
27b82c1d7d61d5a37ad6f2ecb6ca2632d1d9ae223ca6bc45774e41101bf0cab2

SHA512
25653d5776b3bc8e6ddf22be9a80e1adcd1bdfb1229c7d11773de5dacbda416b2a745880522d2310afa98a2c1956d4ae4d67e3e87022898f9eda72027af05857

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
67b519404e3a6f225665aeb033727909

SHA1
bb610ec8238b9cc574a8a723790c6fc21c695fac

SHA256
dc024e5b2940751610926b1275121d597eab6a08ee6fcc5306bd01f32fa092ba

SHA512
65353dcdba66377e56b500dc3c0d28d0a59274e6965de56f48685617572888dc61b997fd4e7f2bf93e933bacbaa12fdcd9249fad770bd51b41204f157b176ce9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
da8a405f9da49b91b2a22432a70330ac

SHA1
14394180ce32b68c1c02ae7625f13dc74727f96b

SHA256
9879146e86c1937cdd04b84f478cc1b5fbc5a7583173bb431ec476e7848ff751

SHA512
fb33bae070004973542d8542d57f5f87c8246faca7ebc4a2c76bd5270fec16bf37ea5ba8406f8f42c466455abe3032f59c3bb9f16fc4b9c16dcecc00a61c9fa0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
9ce59b3ec972eb7eb0608463f05c1c05

SHA1
9045e5e3ae13c93f85342cff8e7fefd8db5fb445

SHA256
55731d3f353687c3448589a6572522fd17675626d51967e865a76123d0bd4e2b

SHA512
08992c2f35ad255b340069ca8a926aa02e50905aceaaf4a1afd1b96105f23fe0ca9fdcf2224268af4d44aa9749291ef342fc173a5aa241d076ab7199ae116fa5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
a9b952d64824c8afcd210518844e5918

SHA1
3fa11f9ebd9ebf4db5f45c883394a759f286c95a

SHA256
0fe415293f378d7d81a64af91346fadb125f1ac71cac9a1daab4bd75cd9fa1d4

SHA512
b535789f23c1a342341236d0523af5fb1c8f59104843af4428c671d45f7a516a10adbf17285fcd4585dd6d86bf4a42d37a96da958ce133eb2ba84179e71cf849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
243b0c26443e4c20e69971e11076cd99

SHA1
cdb5f45337822fb6ecb18633b3785d8cb9884590

SHA256
f4d3e99dc7bce3de51d47451ca4f329109119e4f106b9166cd1da5171d48ac61

SHA512
14f10c3f4aa986a17842603e20bb78aee6180e43e85cc027f8835b770ebe27c04f4d72779ebad3dc791206496c84ff39952cd8b79fa59d71f03ea695140129f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2b738f73c497356658c446db2fc10268

SHA1
66d26e82276abc9483af685347280bd8f49b27b9

SHA256
a1f8be621c685be4bc35db6d36ae6a95b8217f4834004fde7f4ee9f17da2f96a

SHA512
69cf44d575d0cbba41052b635f4758d943104fdc14c15f0d116c0b617aa04bc6e65d19523029656dbdea49395ac592bd1161f971acbe0af248f3f6c5502a68df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b5

Filesize
18KB

MD5
7d54dd3fa3c51a1609e97e814ed449a0

SHA1
860bdd97dcd771d4ce96662a85c9328f95b17639

SHA256
7a258cd27f674e03eafc4f11af7076fb327d0202ce7a0a0e95a01fb33c989247

SHA512
17791e03584e77f2a6a03a7e3951bdc3220cd4c723a1f3be5d9b8196c5746a342a85226fcd0dd60031d3c3001c6bdfee0dcc21d7921ea2912225054d7f75c896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ce

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06eca3bfc289dadb_0

Filesize
291KB

MD5
1719fb1daf069b12c905d5ef3772a0e9

SHA1
6ff5b4137a44630c48ffc01abea459d0920b87a5

SHA256
4f1132c74a05776644ca4b5cf4bc413bb9cfcc46350e859378b67d87cc2e2ee1

SHA512
8e03b02a02ba8517497b3e19b13ed8f59bb661de6e8fe832c2900741d938cad649e846cb36c2a96f23c60f84c184155ff81785d6700c63ce5ba95df62f1e8954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
2KB

MD5
27f269195cc3dd2e29fefda5982bbf24

SHA1
b66365dd11e81681d4261bd38c02b8b956cecad4

SHA256
6fdeb8148628068681b07b5b092dd44dd6ee55fe99e0dba228ebfa671638b569

SHA512
ff7757a14bd1a39b4ec1feb09169584155b2eea39ec6e5a73f534800b69e0ec8a46f16c084bb2f3418eacb7073a5b9d450e9b1282eefd170bb89112e95c8ab45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
a0d56dfb6c5bc20d919db670cc01360b

SHA1
2d59ffd7cd02008fb51a7025fb87ae8ee80df2b6

SHA256
ada0fdd9def299e4ea31f0d3d04f0da0d31d67577ad905666219f36550e6d779

SHA512
f98c90dbc0f8bb271159b0f506899e530fadeea5d9afb094e9ad82319275ef4d7043dd0e2511649f3990baf142db99c5b06f5a10b5a869d380b21d2b19c49da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37afe38eb817b647_0

Filesize
27KB

MD5
f7298870d049314909c420bd50c7c885

SHA1
5ba13aef4727932a12bfc38c23836c134419ed86

SHA256
f3b606f8932a07f518b4f71290b6038639ca1cf1e5291c2b8a5c3af7a721cca1

SHA512
7ee612a936f0936c0c80e8cd724f9da01ebccb1d2a251f35e10a3babf027bc484043345704865a6f3fe3520ad953e41a408ae37ee60473fb195b9b96a155a3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
7KB

MD5
dc85586ae0e5164c63aa40b7318f1ea5

SHA1
0424b74e1974f30cf61c1462d6b83194243551d2

SHA256
d560712362844c1a7d3e97a2cd9c431867620a5291311ebef1b026f24bed3302

SHA512
c0ab6f14ce8521e518e9b133f1097d7c4ff0e13b743b3627f9dc45f7aea6900a3aabb57b1652b67eaf4222b15149456452de1f238e193397495d15bcfa5fe96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f139f229e6f0497_0

Filesize
5KB

MD5
fdf29bba63560df67f83eb5b4c10698d

SHA1
576c5b73290c775fd91afffb0bec55988e42f1ae

SHA256
b6f3e59b48244677605c10bdbf7300c8964960826f81e27f47be2537df8fe3b7

SHA512
bf19da4061f8bc6439fd8660aacc23f781484a87735fbf00813084cbf4e0ce9d467365f98a34ecde48dca05f9ddfd544acf1aeb70fb28f4be5bb5316e76b3905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
96d2bf5acd5de7b06fe88112a460ef2a

SHA1
a1c631984af30bee3328240d9e231909e5e7dbe4

SHA256
5b48d4724b9ac2088cb17fb1e0bbb56bb9e477cad4906242cbb98e0c5d0096a3

SHA512
9edcdf4e80dcc268d572e6d97777bff2623ba1e3c9c35c3ef2525b69474229eedbe31d42c4e831eae5b39f1df2c0cc4baa5384f6947c416f5bc0e14a58f8d3e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5019d8827d11a353_0

Filesize
200KB

MD5
a7591cd5fecaffc3fdd5f4c39f5e9bde

SHA1
301f1f5e06dbf9f93ce6f1da1bd9d4a86d72b201

SHA256
ba516511cd5f833e19556466a76d79b99e0d9d9f01e6353093833be96d575885

SHA512
049e6196c85822358aa2f7e807350d40549fd9c2073319927593c152d79b11de5f2f9501b7dbb56e108910c4579dba30f472494898eba36ccff376a186d4514f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
fc4556ba751257ce460deb9a37d3682b

SHA1
b53e555d887a00e56ff72daa3f89629e744f5a94

SHA256
80ba10e7fcdaf86d7f9227eaaaf99c350a607b2cb9970ca8b860b4bcc5573460

SHA512
ce80cf12e08565efc1c6f29729c4a112009738434127fadf4fe4110194647c775d1d632eb8eea4e3ce60b3e075f52a073c37ee166fa4ae27897aacbf4241e7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
350fa51fc0e099d41c59dc925feab86f

SHA1
e63831ccf471cc06af739e1e0b972b1fb6082cb9

SHA256
924eb1d53b7a91d3693261eb6cdc6b51b6a2effc67c86ef81ef8ed5544c11ef5

SHA512
1173892d79d471e06d7a43eb5c686b85cea9bfb6b6a1a8d9e4b869a7390cfefe2ff3a5a1e734edea302686f4287c879cd638c19950a2e3cc88c73c198233de3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
4KB

MD5
9cf3c84e94dbf83693e63d2a7eb0bf28

SHA1
2e0eb3fd586c83e5fc4f7aeda3301056d8e3bfe0

SHA256
eb029039960f47eb6933ee72f4efa3596dfeb445ae28f8667e689ccbb20ddfda

SHA512
6d9c318a5c550b7202866ad5e3b6d78e300fd2f80dc3430f5da5b8397c955fbf6af6b9198e286428f6bfe239a3fb0ce079ceb797324c3b6443e5b5628cbc61df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7175e5a3468a178d_0

Filesize
294B

MD5
d534184a13371e35f84789812462bd8a

SHA1
fac8f0551eaeadebf008677824c531481fbb6dd7

SHA256
1660d704895cf1e399c20229b7482050943fb0b382c5519ee42bcb97460c3974

SHA512
7c3c1679f018b6f5a6c6fff6543227fa590c89df938faa4011df48c9cab375004c3a58f440274e92c98fc54fe466b6b5e00117552ae5a106d9ea4646ed78ead9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
4c9232491e18549459e3986a01a3af5d

SHA1
5d76bf4211bf879d8977ccff3d7cf412dbb6a433

SHA256
8c7d6f701f98544734c9be3f5818b38fa1ce9b2b9c1b1276912c25ecdfe29a54

SHA512
f978bab7e5958ce3eea6fe221e38e77b884a5dfb8d811b343f93fd54a35ed7460dab319425f0d60415d7b91e2557591a7d3937ba2aeb433c490486a46d125980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
9002cb43c2362cca350297ba49b133c3

SHA1
5b2366868f12d00e03dc4e38db7d913f8e15d10d

SHA256
cc32b48ce5f0980ae5dd258f0186a58eb9fa87c937c2e1d54eb9a2dec70016bd

SHA512
6803734e13c3e024b673b32b8e385b0b96fd3b779659c32d6f5a25a3fdf3b511212e666d725e33f664af76bf86aa21c4f12c1ddf7757b0114fc17e5d03ad90a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d693ac0f52716b_0

Filesize
3KB

MD5
649daef98a5d4d2ed379716ee751b6a2

SHA1
40f316e2f4f634e72db1f09e8978ea0af76ea88c

SHA256
d18267cb5e74581cee640e52a9c036d57362f3dc697be8edc527632afffde46c

SHA512
470ff3a024701be576246265fddde3546a1af032925e830310c0ff7b5514fcf4dd9da6bf0252dd30994721b4a5ab001bcc7782d387c104c6861672aac6b2c0f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
1KB

MD5
6dd9125efc7e546866b61dc9bd30e383

SHA1
ec3395a363e42409dd48610604e1515d18c6df03

SHA256
b2456764cc92e3c07525995923cecf3e1fec88739cf3a9c836eb9c1ed5ea60b9

SHA512
c5ec2e5eacc8f5ed471db1104dd229b87bdc0aa3dbc7b5ad28378f37ef4847c44c5bd141075b0e5f90819240e228760ae63c1c300b505d5bde2fd260d2f695c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c91c845c83814759_0

Filesize
14KB

MD5
04bdd857000217fc12e3a1b772117fb5

SHA1
af30bf1d6e57000f624af75db9d0aa4c67e874f0

SHA256
91b43fb2b1a5dafd35cbb6dffe27052ad1ae39af25f7623e83e32e1b23dca9c3

SHA512
153b28d3d656a5e6e98775763513d43d6d8fbafa10ee58d1509219765c4b708c8f610fd2b1d6dbe0c6611221c4af1133f394edf8c29c8fadb5bf12c4b354cea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da82014a94532e8f_0

Filesize
24KB

MD5
76165db6cd14657cb96fb7b5cbc44c35

SHA1
98995a4d772fc11fde2e106fba400573bbf85363

SHA256
5d3b654785ae4eb4eb13f3dd9f244fa58c91cd2e2fe4fcc3b2f92489859349e4

SHA512
6c7277a5b7c0605d1fe44e1d502c5217c371830b1ad6390032eccd07e601eb9285bf0d1c65bb485d6fe69b14c7553acebfae09ffb3a7d1f03421cc97293c360b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
6KB

MD5
29fcfd4af08c3f64da772ea1eaf145f8

SHA1
cf99d928c6c5f891475c0bea72b347a3a332ab6b

SHA256
531f49fe7e64b34f400d8be771b201eabe83648d6fd776a9bdeaccc0838dc928

SHA512
209917108d9d39a7b85b24734ffa8d401936a0265e17e8fc4da458ad7f1580664048221e65804bd93935b0da330da9acfd9fd29a7ea43630ef9a16a27d0d7b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
a161ebb6720be465f255b0f869b94e13

SHA1
4b9a47654406df94768467ee61363515fe87b5b9

SHA256
bd2c993601aefe24736168a96b4095cf64ce79bc4e107a494fa38da9ed22772b

SHA512
ca36f73a2ae9e6cc0e3a75c570d3ea4bfdef5f265d398c8ca620effa6ee863b3cd0ef1033a61e4e92b3a6f90653bd3a4d2604c0ef6bd71db02b266dc5481f26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
5a79cad40e007c72e7ccd90de5c469ba

SHA1
0a609f41405722ce6b9e87d3c81d5630fdd44aa7

SHA256
79cf65cde1b48de5461e80ad9b919cbb5e8e011219c96795641b02407b40efc9

SHA512
54b3159a6dbaaa8941851e8dcfc9c1f2165356a5621518838aa0cf8efae2d88591e05f9e91bc9eea23f879658d7b01016e277673eeaba1cc894c430b9ad2bb0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
947cf7a29443438190a04a0f74427931

SHA1
fab1f85a161c701ed70b31ff2c832ced99983329

SHA256
5216ff16f4b67ed96216f3424d88bd6a356d4130057aae279e8cad4435ad6442

SHA512
2d346e6b3ed1271717a21ea20879e2a4b7488841b0dbf811343fb41737848d298d19b0c3e8cf05cbd74df1d74b31de664ba12146f4a1d1cbc863eefcff004222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
da25239179058395f04d0e731b372322

SHA1
d11edcf6fa48a2cce6fc4fc76e3fb9a15be1592e

SHA256
64e4943c2fbe309998a4d173ded9684a2258a0dca2363f8339adba758744c62a

SHA512
eaa7f97aef252b3d6370e3f95eaf11f12291eb73b21697289afb89b7c2fe95479e72e410160e3f302b287404dc8d4799d9b9fe3393273638aa7c029da86205fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
6dafbe306333a3a76d2ee5e67e441460

SHA1
86632e80dca20f819cc1766b4eadb07486fbac58

SHA256
c67411064b7b1adb9cad8ac95437863aad1a5a45bd3b2468673f8100682f8aee

SHA512
26f25d2fc6d698f9ea02b6c62c512f0eb2d0927b9ff42ec1140e84a74fb7dc3acdf351229d5e58791d44b91fc5e34ab3a58241cafe79fc6549abc8365c112d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
dc8ff8ca04f51e05968bed998ca89cfb

SHA1
62400233befebdaecb62d7e7939620afa169392b

SHA256
771f346d820a938c620bc68ee634b4aebe5f891e6a740dec92b4f5830ae8c050

SHA512
f1e632704254ae5cd341c4136a6d5c3a8e672f5c2d847d17df4d7d8bff595ff28fa75ea1661ad165373e0e44f463d0727383b9c3f1646e3fcde969025caf47a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
224e6779745c8f6c5ea346a3cb1cc92d

SHA1
ece88ab964b4577afae9362f6bf5847deb4dd802

SHA256
ef25fc98d1d59039333d0b67ebb46760f5bcea8ac232fdaea908ad33ab197b21

SHA512
4bcd7aa81b8157e7a0921e40221d5b0cee1b45f89aee3c19935e7535bfcac8490803fc54be463f940a40ee9bc76fb1ad475eec6abf319922b67c473879b6a369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
944d381a5f0c38b2c197272ade53ede8

SHA1
0ba7fb1969e54a1f009a3eff50460265b03ed501

SHA256
becdb0bee1789bba3f5f987758698d0df1159148285a6953e87a5db81830a335

SHA512
bdac55c2a94f9db9b8d44fd10778907e8d702ed02be40bc06063303147ff2d6d667f6e8318d63bc76457ecb8c35c46dd75080d685ad4f772b72ec7bf7d7a11b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
e8e490abf50ecb063265ae12620752d9

SHA1
88a2ef7e7148e71313dce2f08b91c854dc4fca7a

SHA256
853183be1aa1b3c628b4bb5792e15eca54d8fd03a082dd7c9669c7f8a3528c8d

SHA512
492d54a7bb0db249229b22dfd628e4d2a9203a4f25dec34ed4ecb4ab5ddb6e949fa23fb6f8e59d125c5215799d2168be01a0c829a2592b97678c1bc408af5b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f5adc6f2cb1670b8d57619e22cb35d3a

SHA1
2aa0fd3ec29f8e9c0fa6e9c6f2f2a7449a52f986

SHA256
6fea4c808d3eba3ad11122f5816adb7c648d46b03440b635dd8d79c4b6b84f0b

SHA512
eec8ca026356ad8046bedb48e0b957697bb26607626d6d0f7b838711925e072e82845cb47a222b81ea60152745bd1271c352ce6ed993d83c5581ca07dac516ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
d5aadb474654cce369e5cd5696c75a9f

SHA1
15187f24a02052d4226a924069b84faa0c0fb901

SHA256
930498a99d8071c55cdc0518f4282df70d1a0bde8e0d55d3d3c96ccf372103e5

SHA512
16e570f604a5d1f3eb6b51cc760e47d9dec87e2bdd357109cf6b7423266151b9e01f52770612a4469f58748eff23a264741b1975c358e0ce47420a962f5c442a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
1a6c97419cda93a7c5b547f2e405a3c8

SHA1
d99d05210b1b57c6f31177da26d6ac3184c6657f

SHA256
76183856f5c644e0e585d41cd6a755db48c682c5c00691b77d5157109709ce3b

SHA512
4265707b1ad03145066883220c7dba1a9359ba58e66846ee04c63fd2ed2987222a9af07cc0bd3078c85446e86b1d063e64cb35924e1ca671f1be51e83bcdb832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1fcbf93871f845b915de0feeff255f2d

SHA1
475fdf541dcbb2f81d0a5f6c08443655d1e8b0ee

SHA256
5927be714fe38285b42a15e34807cdcc3472c9a562766cdf06b2e312c1973a33

SHA512
0c0707f62237f575944d9c64a07b6569410a4698c0b9220f4fff28e069473fe122ae0b00ef116445762a01abe35e7e1e582bebd0ec0ba3730c90efa086c143db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
82bd56dfd6100add13c9b28297f4cc1f

SHA1
e992008a8654a534a74d145793f56a13c377a82b

SHA256
df2a5769227d12a0d29d630b336c8c61ac6af8ec4bf75083863da4b7ab878b2f

SHA512
db8c7d4179bbe7ddbfa6193b2c858c6401ed0e198f9cd204ff1c862dd5718aea19e58514d68086b258cba063fccae9cc06aaf4fa522cac360b88fbb137fa35e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
c45a466a08f85f0ea098b52ed8b34f64

SHA1
fa155143c2aa6f97a8fe682e125770ccb5de80f0

SHA256
60799167cab0467d7acaedc551ae7e4421486de199cf0a564fa43e747a12619a

SHA512
2bfe1b61f440994cb955566bead31606c759d8eda89d1dc9c984e0ebb1ea979c08a57314d401f12a6b8f579d4b42a1ce51a7449f5522b5f828f16572c241e8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
0d3647a639ea0450e8aecfa060be675c

SHA1
914f35f31be74def27f899e540b0494a5100c80c

SHA256
72d56665604ea237c3c74d81b841649ad72643b45778d6449d76e49c09aa0d38

SHA512
eec8d2c8017b81843462312cf0687b91c671d18f04befc7e583e18505394effc4c5e4b7c96779b25a94679135b114dccf1478c48cbdcd8021ef7f14494e8d74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba0f23378b24c4ec0e36d690ac732548

SHA1
84d317622fab6b8645da976c2f6253caf45d832a

SHA256
e1675e2251aa03ab929a91699f212ed089616f1985f65a68869c57d53b9ab2b7

SHA512
7c2a64448ebb3e43b976926abad88b365782d465a5d1030a9ffef38fef7ac1211a31616f83e62e6ced23f4b30599322adf8df5e22208fba01efce7b09d8856bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5ee640366747402117b303939a6a4959

SHA1
0aae6818435608755cd30c80e3786c34fc210d5e

SHA256
8a81ae2511714c1cb33cf74790d3dcb03999a7a714b0285c7e9806bfae67d16b

SHA512
6adb460ae9889b23569d8b1efc4c832936aee7992cfbad06b9bca3e64a6e58056ff871b2ee45070be85c8e7d24fb9956338ae2ffc437e945e445a1709f73dbec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
b0c9db9e506258b0a0c64273bfbfede3

SHA1
da17f05ae37343c219a2b0851c39c45f0db73724

SHA256
c2a1bc730bcb1145a4fc7728942d1df00d02117900d0e2e8c5a653f0f1a75a0e

SHA512
aaa6b6cbbda8c10d926891c5e7dc14a4a9160f2acdc69e9af93208167d064c3fe62da098705757b51d897cb2e31da1e47defaee5e74b0f17f125078c0a4685ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f40ab98a5adc1be41fc131f074481588

SHA1
8303a76dbe5aa6411673a18c2c1024a62fa2c5c9

SHA256
6d56b11db09590bbfecde0812ceefb6390ec9c3d50ce5a322ee95c4a6e50c5f5

SHA512
c8d4a5039f557c08580c1203ea7c36cd7828b3e1815c5d25c7067041e05d7782016dfd4fb8001bf85ec8713c104b27023e2061feac66ca6534996a2983fd60ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4a0f502897d430af888b418b9ed4974e

SHA1
d020d91faf6d18d6896041a4f5e11f6330b3998a

SHA256
66294c6311cfc663474371cb175b76096540f93369004051397d5e84385b5f03

SHA512
8d0d6e769f3e0c96038688b5ba43ae7b1dcedaba1093343e68b6707ddebb18bdcf260da400af40073b6bfda7e2ff79f7f5ce804cea33185fd047049f2fb4181b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
15d6b2412ce0e6eafce9047ac924c8b3

SHA1
b5113204c9b6872bdb574486e488d2086603b808

SHA256
b28cb471d061473330c567c9ff1f0dcf2fd91def40437e9225b7cd8da8f88644

SHA512
23d97bf592245d84cffcc4348486c2fa99608d97564291ddfd71ed46ad7eb7167db0d041443c23c5d52bb24d06be82e2fa608535bc37d423aed2bf6bbdd2183f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
b952f61b33fa57209d5b2a4cad5fee03

SHA1
8e883cd2c59e9666e97f10de284f9b270cc569f5

SHA256
4bd3f44ad2a8eea8e554fcbafee817df6041eb90346f78060585614f1d4c218b

SHA512
31c76a9c0234e83884d79790ecdf19516f41ed1e164bd69988c59379ed40b4908ff16b719f7f877cb53198dc0b5351ec3d82323a6248f832cd0b537b24d220a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f3474c25846f64b224a074a6e535d3a7

SHA1
51bdd67d761c86fba17730e74a35ce64a1931e86

SHA256
a8c2c842f232086b01ff8d37a5dcf2978aac6de905f3dd87b15838aaaff4b2e1

SHA512
0f2c9fc451d1a6140e8245c9ebcfd338967b7e80d9540a4da9a6c34f58ba00268fbe2a5f8de21b39216f297e7a48d5f1b54ce4dcc3f3b328b827fdf055b421c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
778140e7d861e63a2bf032ca66f2c03d

SHA1
d6756af97ec095a5b31f42d9fa963d71a5ec4d4f

SHA256
7afde033981d5b3ea2c568b4cb540d77ff186c5ec2f8d1a4e49232c600cf1478

SHA512
80bc310e3e3a5ce15f6d5f9fb0148ffbdbfd0ab0a8c6ff1dd27d8e0e12d21b6dd1293553d9aa3f14b2bb6fc7967c5843b571d3a6fd2f132803f74ea1eaaefb21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f10a9d4f7a75fa5b1c881e921f2001bc

SHA1
d3f02b81f86ed409d07f88da93b1745b330d1de6

SHA256
0980b829a9b78a15d5628b3a2a8c4346facdd26e74884d4f8df39701f6ed2ca3

SHA512
8b3888a8f61ef43e897aed69dd2708087812c2b4a4332eea5d4281d9bfda9a51305d5bdb64f5044c8d5924e6bd7c250763abf8166a10582f76d5320b8beacdf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
510a7c823aa1c104affa62f2d00b0191

SHA1
0f1bbaea70d872d2ba08847f7103da12d871bd20

SHA256
97067931b3334df07f5368495719f0e4fccb384b1733037f0c8715bc4d5b2c78

SHA512
af01bd63ccf165962f1b1479310c98fd7833312ca34632b10d52e7a996c8cd084acdbb45590623ac79e246749d6dfe9ccda13aedb91353999c91446c49a41739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4e9dccf4f57cc057be77d22c53a144c4

SHA1
78fb95dfd8e77fa4d4f048fa2b3f9ba3b706e546

SHA256
530dc0650607acddd2fe6ea2f7a86b2c29f8462d0d556e39df080d9a4b2e1844

SHA512
55b5c72762486b6a290d8ce5f89c1018e7a83a53b21e2f5311b3b17e41f2c67d4286a90bff39e773889e1feb5bc2ec150f3ccd2450d9ed22d42586f2942eca06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
bf3770db08ec29ebc9fbbdecce2167b6

SHA1
2edf7b54d768f80d0b64fec9952225813ad5cf37

SHA256
b10bc29f34b180e36a659ce7b7ec4f280796bd573b25cf4cd2db3b8bfc866962

SHA512
9b8e9b6c3eaa8468de747ba38e4f26faf2898e544ac1d27411621c10ce0a85cd857b6e2e4e73b6fdadad1c6814352e276aa77dc0dffd9c2d625c2c52705574c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d7b67144867301a446f5c7ec3523662a

SHA1
de4edf68747f7482a0a69583a151e21cac8529b2

SHA256
24ab8fd4c4fe474e6982a4536bf1fd232a25948dd45769dff5ef802854129a09

SHA512
1050723a6c7ac3d36ff016a24045ddae78d32bcc3a18996b2678976363fd37c5f5318466f475448a8f7e23e1c75b681693ff721ae3dd55ec0fbc564460ce5d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d8cdfc2a4eb75da89d92523b18aa0fc3

SHA1
3bf437a4e85bf6bda0be90d8b58e0289bcdcfc04

SHA256
f260aeb0427419d3935cdb15c1a5a8c3c65c6a7b01c8d49892d51ce46e0e1c4e

SHA512
71b394bfa709cb0536738e7b6cf60ea22d674f467f8872febec8774568bef13ee64985228b75aa381d5554b1122d26248ca377048b25a899d4f826ce3f3ae51b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
61e0726e20b36688c4f7ae556a5477ea

SHA1
e386059943897d2c9f116b11dba363d927a511ae

SHA256
656237578fb6bc2edf10aa0c2dd77fd11fd9ee15268bfbc945949362ea423e7f

SHA512
1a18620e215d113db77ab54c2e1dd617e649cc6f11bab1a2fc9451535a23c3e3534239d51da511b049f0605d485a0cbaaf375d4e2cc28d814a7c50a77abf167b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2276884e83db6601438ea6e2b53e6c30

SHA1
f09e5ba3d96f92e8b45ce46793bf8b1a1afb355d

SHA256
9fb7fcdcd5ee4eaefdefb318769e788eaa78e936a689120d032647df302ea3f8

SHA512
370270f5c4fe440794cc57a4c0c17cfb56a093d31cebcdfa1595058c61c1c764321db6dd98d649f81552c9a53c42f267a1a8bfdf421ad736a61b175d218187cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e7778daac0a348d96472d7b03e784b39

SHA1
6112eaba2b0740df15a483873e7ce1605317186b

SHA256
29940b8821d1b9f3549e2e4d2fe707befe038c78268b56167e2cc3be17392ff5

SHA512
1cb99d6d03d735e1a49e56c5cbb8c0ab9733c12f376f92401eeec7304795279cfb01fbbc648d7f60e0483b4da3c0f5b018b3cc61fc8c7b9f94bfb1620c7fe327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2a519ce55b8b3893f8c85576172be137

SHA1
c19733f8929e308292ed9991ac77820d19b6bf1d

SHA256
e89c66feb5b069f8977259a1733272682a53a35691116e56df87dd9d2ce32dfd

SHA512
3b0fd9a29cc75d204d02464b730f47b4d57f7bb19555887c9c82f664b7312a4ac8a3338b8fd460fb27db347176435bd5d55bbf5ea3a767adcb9e9eb0b2bb0967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
c855dff8caa01da8acbd36ae8d460758

SHA1
274375d5a619f3dc34539ad85544f1c4eabc2515

SHA256
9f8342cb492b02a376d5114f11333e41efa7695eb362e1661c72f851d7ce7af7

SHA512
9b9fc78c3c88c66a7833768da40c518c6a1a202303707b32d3c77d823ea9142f4bae3092ccd858673d7720965b8006182b6f0ed4c1e8a67fbaea7a2ed84751c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
42c0963d42db197eac7bfd3ff0bfd380

SHA1
0b009d8a3031df1bf5b8dca7cdd8b7855617abc0

SHA256
fbd1981e7441f48acb771d293e7c3b5701c994d8d66171cb06b5ed9c599c5dc7

SHA512
87fc7c5429eddaa9fefbd77cf6f3561b1dd21f1a3a5f2b7941ccbbbd03813db6996b66cea954513685bc72325d13578a918fea1353b1609ab4f055e28b3d1152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3941f7cfeeef195832e4070235ab8d9

SHA1
15d00f9b54f89415d8851cdd4fcce5a9ee55133a

SHA256
61f0b003c1bee56419b86ec3be03a1b026420a13c6b3ed0783ee8716dc138f7d

SHA512
21d2c836ef7ee2d0da2305c73ddf71ba9fc71a88187a7da5e3b99878debcfad656bdeb9376155d04020ee68f6b0b300e71afbb3be43eaa7d63e8ddf0650746d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b3e0f33e1d0e015dd608645d86a11b68

SHA1
6305396570d47be1b8033ed868aed7c2a3e9317c

SHA256
fdd4c064c54468e74f8b3dcdde9a114f3483cad33eb2eeb36a8949f9aa1bb728

SHA512
f49adcd56d48940b7c321c35f234bb1ce75bda1e0c1cf3bd4014f93cc2b233a27997681c8bd5c28cc3a8103ffb5d88ed28347ca7ef751fc5b6f1cbdebc1f5736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
427967da9e8e267bff33a48c51056b19

SHA1
89a354d3fe9a548c559e54ef3163f4a48184303e

SHA256
326b020cb6b95640f9f2336a7d5bf8f687941a3f0d20020b95608023207797b8

SHA512
aa9ea33b1ad1a6e3bedef5c3b86324f3293dd40b646efd1ff0f26c8f0f063dd318a0b3d4e79f33f046cc00f474809bc44606ede361f65c2ed257cbe3f1cc19c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f5f889a5adc5cb8e5a3bb422ea262dc3

SHA1
3c9234e83c4c0bb6f514a3f1421daa6ea7fac414

SHA256
1d72c7c48b0adb03959a2904991f2b0674174fff2c84bcb592f9ad7505e8f142

SHA512
92b4974423c6325c93cff2637dd2bb59a33f9ac4b4fc837f3343e374c87ff72f7c03836b1f592ce4c18b8a5dc207302c75391413dc2e7127aabd63454f08d427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
81129727c774320c0efae3b805f65b12

SHA1
fdafae46eed1fe7d01b33f608680fe220799f0f1

SHA256
b34a92ea8825a3594d7703d34621de86427d9e7124dddd9fcc3ef80088b3bad4

SHA512
770a2b5b791253357a0d261b913d4c213412b950d291d4e3b0a7c0b9e90c3b58b2c47b45990a0717fa8f12c6ab642a45baa40e7b42ac71e21ccc7670bef4c5c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d3938cf498d6de9abcaaa66b0a3c5b31

SHA1
aface5953d8524f2abf297fe36d778f70d926ce1

SHA256
69ffb047d15e92ee1e9704f0c4e02dbd38266a78cc2371c6f54b0dbdcdae7e14

SHA512
23b35f524025126645bb9011b4f7e5982419128387ed106e94fc54b3db36742353538a46fb19f207ae5b21dfb6d2cb21b97c235325d35beca61b6c407817bd6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
42c2d28565f539d9aa6e5d9e864a16e6

SHA1
48be753fa585393fc919a073d2baeb2f5e5afdea

SHA256
9727a3d17238ffcc4746997d3bf78ba0516398f6c57901abe89d8392c4107b56

SHA512
9ef748f423be6c799357b2d259d24f95653ba62f4d84ba3c944aa9b533ee7084a6eb0f2f2e160443df77ca1e7cca8c4fb9cde0fbb94e4e7463b3fed480c9ca39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
97fbc78afe8ad574de1acd8679396a03

SHA1
4a373e2bcbec9aab6b9b4e729938a5a096f0b326

SHA256
048aad11abd69ee8fdda628217859704fecb6cfadac8d21549b4908b371fe68d

SHA512
cc0a414dc4e5838a0f06e70f43057144b8bd633be54470d69e8e37a02b5dc15903f395ae31cec2da16bb39e6c24d29b7647d5effc91b62b1a82dcd75da625d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ecb2.TMP

Filesize
700B

MD5
f970ae5a162bb4b5206adb3dc9fc489c

SHA1
d3e741ca4cadfbe43847c393170185b4b8b4e08a

SHA256
e8ae554f9a3b119428aa281dfd87d1a448ccd3fdf8fc4582d047593ce6c74b83

SHA512
0c0ad752103f1e691cda4a1189deb1524cbb669f505427e995a5188a937b97f84c883260a1189e4c24a4fd1c97b11d30c4fa1e27820e4f6ae328bb6f8cf5a7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a913c38c-9949-4737-a133-c792be457889.tmp

Filesize
4KB

MD5
d7ac95ad5de0757f1890226a078e80ad

SHA1
9e850ba984bfa56cf8239d5fe2aaaa526bc05f49

SHA256
ebb3ed013f78863f7c801646380eda7bb627e969899d55977c9190aaa63cd621

SHA512
ddd97ec342f06eb8acdd8d6cb0a058015bcd4c20105cc112ab1e585fcc8f59065e0be4342af3037593359a561ee71847c7f86d47ea0e7c23bf76409c440bf568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc3481f0-9f0c-4981-a7dc-c8fa9fad00a7.tmp

Filesize
5KB

MD5
93abde71f64ec97fb2254fb21279f41d

SHA1
c1375c790dc3a01e98a6960c445ae6c3da73a0ff

SHA256
424d1ff57b3afe6db73c4922d61e6558a0cbdb4c2eed1288b5d8328f3a295bbd

SHA512
33b3e517d39cae9e9941567851182dd84dc44da152cb0759e440d39090735588a75ceea93f56cbd8a3e47dd27ed68f599c6488e3ab949499f12aceca69de9730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
491c8778ea00596120a644f94b134184

SHA1
664fceebd82c703bd92c6d43b240b2a6fe644fa0

SHA256
512453b2404ae1c4fa9285d4ab7221f54d5a8e01785a6024357f0b2d60f457d3

SHA512
03b35f208b54f609543db6bf7b441a666b41f1a28ef8e2b1d95fa4be57305f7b3a53b88858344bc0acd857acc2605565c50368f09a694521c1ffcca83a9b2ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bcc9968c7d1f53d760ceb8f9132685f6

SHA1
9f415501ddabcd86e4a64019dd30ffbd262dec6e

SHA256
7f68e8ec07fa883c6c7a339cd87854f9a762928dc7041c7d179e88c2bd32b48c

SHA512
0c33d1fef6381a953448c682bfb1e7cb8452c5bb3d393b47b47c77440f83f55a7192e7ddcb43a54691d48ebad0c7f8896efa6d5ef29011f4ceac9aab3004c6c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d2d2489f4ff1918f140ae41bd6e442c

SHA1
de87a85917614df24a459675073c78da65d4bb22

SHA256
5418a8465eddc6afe1741c78b0b1ca471df8736ab9587aecf176029f59887b9b

SHA512
9961fbd389bfba2bcdf12888a160f71dfddbbed4391490a3cb1689f600cf4ef1745e12ed83cca676c7d46141d1d8bc73393def28592dd95602a342c2244f8b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f5287631d853e86ee24e81445af561c

SHA1
8d321541d9b970105444f48a08141e27dcf23b6c

SHA256
c0077cfed292923fcae360a6692f17e6bd06feccb9c3447da67388b2540cbc46

SHA512
36d8daf55a57553ac22964c8c957ca958ef17730f89673c1958b5a9be1caf251f8faa07789c6475b808454d2e85fc901d18e5e2c8334b00cda060a1a0c213659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7ffdf9ea268c8915759b9ee4f84c8a3a

SHA1
1a8d00518aa65eedaac283865599ead80f5ba4e3

SHA256
90a9f07d25a3e241ec21be81f027770756d6e3ec94bb8241e7143c66e8fd8b78

SHA512
9961557e575a566af3668eb534129fe510e378fb52549e1951cf31d029a5ca8c3b4c87934f4407ba7c9cf3833ae6ced5c399443fb6fd88693ad7f11886128d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cc15a40a8cbd1497abc5d7c754331427

SHA1
46d814f4395b9a843230418c5b8b6150c6dfee9f

SHA256
a9420eb8a9684b99eb4430d065f8e336ba84afcc05cbb0ec47ac92ae11c34540

SHA512
3a29c91ea519fa1934ba2772cf5f3861352f26c1a296b99b88bd3129c204b48360dc200de30c0b816287b1724a3a92ba3af046ee904d8df657ac7ddb7815b98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19985bf8297e5bc9ac31d0d1f39fdbcd

SHA1
a0a5d7be9209b762f48f07fd2f0a493064e95495

SHA256
1e098d278c497ecdd9b7ebf7c9c5fa12d0eb0df5e8a1a851aa9827ba23d44e16

SHA512
ba519cc596a051cdec8c9aac6bfb6038168ba35d7f449cd5dade2daf510372dd73148c48a6727d9206266fda8d00cd601b58f0393f1b336114e05341903643ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64a584e1da66c7f5ee5464f0d2f99f05

SHA1
2e1c4701ab2a2535098712771a769fd1f5f79e87

SHA256
2d60d1d0670a937ea1a0335d877a4423e73215c232224897afdb02af3a35e1ef

SHA512
bb637bf9463bf1d686257c582658d5ca8e2b0ad264571e20dc2fd64aadc00ca343b8be9ff202da8154e7e59574430ccdad04ca3ebdd15b572c849b60503bc09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c205d0b318f0f26f9c005cff8d4da43b

SHA1
578939106139bfe842c13cf25c2898b195e21155

SHA256
12d2d62ce6fab0e469a88114122b0c9b42ef76a963ac905e06ac3b6fd3f124a9

SHA512
3b9aace81f35a4962263e4bb7b4f6910114bedcb430d9d9edfe274d67c628ce18901b18fe764c187fe715d4bec0e2f3d5eb50f77024105a4dd7b028baced83da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f14aca623d6e0431e06358ea0c7bd038

SHA1
faca6f7baecae1dbf4fdc3b9bc021aa71b8dcef3

SHA256
06f193347df31090124451b42837431dc55274375e427ffbc7a6d7778c34436f

SHA512
b7798602635b3ded00a61d26e01891bffc556a8686d1a1ae2a843d821aa63b4b56b7265dee574385b4da648ffcef33c197a699737a7c85e743b45cdcb764cb94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
946a579760ab869ae921a660d9637c67

SHA1
9f74de3bafe8a19ff38a45abeea7945549eeef8b

SHA256
914507d0bb06087b994d41e29371fd11d3190dd57d476d4836629e45619ff78c

SHA512
da1490a2fbef9267f7c89914c8f2ca8bedb9a8c1cb8cb088661a03695a72170cb81de5ffdc8b0d57f8106b15c4ce196e7f692f35a2e43a15144a7a1f6e8fb3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c43107036a11426593961ade8b32c2fc

SHA1
cbf23a71b4a5a5f36794821c92ffd383527729f1

SHA256
755d0f05118e54db1c1923113c8a66f365f124719e36b5c3cabffc843fedf2f5

SHA512
47382c84cfd62dde6ad7e3939bcc94b79f0279809e7db105f5b8035c4c1ae49106899a8f0bcfc3022c47e5f7618bfabaab812cdf7a5f6b92d06eacddcaeb0e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7eb63b7e3452f081f87f53331b1991f5

SHA1
500d3c89610dd9d2f8a788dade5b061bbea4313d

SHA256
45ea9746377d0dd4935e29dd251286acc48bc18871401c5fb820f3f15dd41378

SHA512
d1619eb08e0604bb1fcf44b19d7c7b82abc2ae77af8a02a7dc77cb890a88dbd050a5db820f310a2866354d80a3fe4e54864f012f2100fa2f490448a462e7ba57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33e3d8105954b89e9319230721f5a1ab

SHA1
095126010281a4ded452c8a04150359bad929f9b

SHA256
6f0039b99f3ca3c45b9b06198751dd7dcc4c265b6035e70ca2f3a3eebf04c84c

SHA512
bc018b905a1b5eff9bf732d85d8b302fc84348c5bb389d303d6b36ef3f7a9ca8c8635175757483a50de288bc1c3435e0f39de5a15ee7029fd2d07d8476c0492c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\146D5ADE.emf

Filesize
5KB

MD5
0ed5bc16545d23c325d756013579a697

SHA1
dcdde3196414a743177131d7d906cb67315d88e7

SHA256
3e430584cd9774ea3b21d8e19b485b48212fe356776158dd5f3c5f63a5bde7d3

SHA512
c93072d11058fa50e3b09ff4da9f3dbe2637c2b5df05e616bd8ddd04557ea1e8b0db106b1545fad334619118c467776f81cf97ca52d3f2fcbbe007f30032b8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0000.tmp

Filesize
18KB

MD5
cec6fec3307a7040575d581771c131f8

SHA1
de9eac97645ce7341cbd1cb83df1e299942fa440

SHA256
b0c2b20b6f99b62c3ebde7656bf98b40e9cc0eb6581fe50efb89d0176707eae7

SHA512
b5bd9e7914d96dfda2343c423e5031e5d79d0fba5bd64575163e949076ab85166e78f86dd7f05fc4e6988e45713e231cfc9e43d553132cd5a821fb1de21a4c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7becd0fd-95c8-43c3-b024-de902bea4f67.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD9E68.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1664_1410163726\2bc99b8e-04f5-4753-b528-473c3826cb07.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1664_1410163726\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbhja.rtf

Filesize
816KB

MD5
f72cacb0015a05e86e2d6df3392c6473

SHA1
bbef163834de537f3467e8a9f5fbb82c5ed989e0

SHA256
59104de2f41b7870aee8044349efa140cfd507fbf637bd77e6b8824859d4a3da

SHA512
3066ab9a9d0d109c2a05aad522c04d9ce8acc6360a5c6166f49b2a711e065f42d5f8c4426c56bbbd0f19a7779b8fac9ce21dd3a8c0a8a9fd3ef5a09a44032809

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
373B

MD5
478da8911f929a62c13e129c8cee7ef6

SHA1
570e3970a60124c9a2c4a526da3b236af93ff6d0

SHA256
5c496502a80a3ef4e838a3f92636dd872809acfdee7721d90012c21d5c522d62

SHA512
23e37b19010adcd76b5684497ced6b6ab97bb7de49e5578ab5a1d1b53dfd14f8255f1a8d179a3522b25cc97eb97976d55c1562c5e781abf8fd09d1d266991fc6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
413B

MD5
a61ed82a79660c5bc3afa2dacf6961ca

SHA1
16181764fb0f9083dbd4183fb231d3ece01466dd

SHA256
6f3fc539fd88f1a3877ad73cf355d1c508ca6b25ea2ed72785e2f8c26b2f8c33

SHA512
a5f6c6c05502c9db3d4f708beae27db5e1a36cb65df14e7f009c976a778be491454a6915cc2bf66213a637c9ccaa31772f35bdf39ee4e2e40fe880fa32031644

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
9b768714a5902a6fa8d5d12625aea1de

SHA1
2bdee5df8d67bc8ae6d6b6d14057183195c1c4f7

SHA256
451a2676acd8462bd8901d9fda6f2160618f3fa5a86ab90ef089c1b56dc59123

SHA512
72a679643e5e7ce7990977299da8dae53ef7d5f8573109c0f39b1d847b0ddda01928f6ba2049019ffecc12f4eb805f3a7d2edf09f687af00ecae845113c67994

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7e90724e5ea248fe05dffba3891d59a6

SHA1
f1f601b7da728670c3dad968ec145e104c3b7263

SHA256
ea0cb8455c233c3ee66b54aae3d61dfe2ee8ab06015b4d094553462bff05f077

SHA512
8fb60b63971c87605a64e4760326ade88fd5fe0bd447241d69119fc04e51f8f84451e0286af02538d0545b8e5d43a13fd99c90e208e5c2a83512a39bbf505043

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
39ac789bdc9ddef0a26afaade2bfbb05

SHA1
b539407b5eee5731732e56e970dbadaec18907ed

SHA256
7f094a1fefd90f10f9b053f920f3070b620ca04a49d37b26b6b055bbfa9c2992

SHA512
c22254d84ac54bc4a0ab3873688932124a91653cc62fe2ff37f7f6966399775b878567bc7f5556a67ee78f7d0995afa4e1755eb87dbcee2e71e22ee0e3600a9a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
4e09456c2f49379f85bfe195ae544000

SHA1
9f1e2913f2c28045a0e3049fec08bc0d216355b5

SHA256
cac95682c466c08e9e77578b77eb2146a78d68f0911a4c54e104e97608f98d75

SHA512
e07c0bf533c9733d35656238a491364aa943c0ef9cd2e69c005af7ddcd2e19c759d2d59191f6b0e8d7000e4a27c8ac0b2b5279e873a17f04a57d92577eca100e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
e95fe17e2242852a3277e5d962df8a5d

SHA1
af881e7af91b0105510c708c1c2afab65790bbaa

SHA256
f16944718dde60fcfa145dfa81b6f4561e171a49a224cfc9a09a403cd84e6b1b

SHA512
d694a1173777b7c5741e8a964129c0050c429de8f533177dd283ef626e77759a8742939586953c273fb149e478c335ae249aeb46e74b04632af5220f003825e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
680B

MD5
22c8b640ca606c6aadbb0a4d9bb1c4cf

SHA1
a73fa2e97939c5d0b67ecb9d15142f75d399a2c2

SHA256
5530695d75d0acaab8303746f834d74ed03dff02901579e91312912b6cf2ea9a

SHA512
e075260dacc3b77ca73e5d5bb876e054809e1d2c35384b07d0e46a734148a663033e39cea2dd02ddd04f1b67f4072ccb04967e69d3f9dedf4640efa8152a02b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
329ef57755b6b566288767e6301cdaa7

SHA1
f5587f8ee8c365663d36506f7f3266ad3d39dcc0

SHA256
a0b8bcc572a5b7c89625936c5d54e8f274e279611ebd56eda1415c55a35de0d0

SHA512
9fd14dd4dc77fb5e66b70931c32d8b628cfe125c58d29ac11c1685eaf347fbc7073ac3260c190e68b419750b4d848423f128865b0e2c0f839a62f8cdc621df87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
84e611df4aff05586b75a534e7ad6fbd

SHA1
08487953bf4f456ed4fee98e30cd78a3d8219f99

SHA256
9da350514d0ef91968aad53065ecbf108f98f0a49aebfaa4eb9b7698b454e655

SHA512
e66e6555b753fbdad4143f27e91c5d3f8d0131c21d613fe6f1a6116e73ce58d0404e52e7424ac3025feeeaf58cbc7bcdf1aa63e2186e8c673ed640e0944b10f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
6236697a3c1bb53554784b74f3462472

SHA1
d30b92db7f343ff7de3aa2a2ff0f5cdde98d46df

SHA256
82d1de1cc68057572c17fbf8d8bfa11aba93eda841349e71b77a1f888d7b0c52

SHA512
1fc926076596e2f6d200771fb1b6e6fbd0690a7f4cb6486e6a9f6b9c9a9ce44587b3b12c6d48b92dd366b01a654e2544976041f67721aec9a17ac4523dc60f2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
b066cdf27980eabd4c244c3bd25f7992

SHA1
cca2b5e9cd113d0fc73fcb988f2032ed937ec530

SHA256
e33b5d350f9f2b8b147635b20796b42cf14bb3b6403e3706d1675125ed48d18f

SHA512
44cf5fdbe322d4f6cbe3d5cac1b9cb3faa19f2a7be69f32dfd8897964b838be99c546d695c40b380cdaca8b0277a54e5a0d9fc80cc18af1d21d7a557228a02c3

Download Submit
C:\Users\Admin\Downloads\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\Downloads\CobaltStrike.doc

Filesize
86KB

MD5
96ff9d4cac8d3a8e73c33fc6bf72f198

SHA1
17d7edf6e496dec4695d686e7d0e422081cd5cbe

SHA256
96db5d52f4addf46b0a41d45351a52041d9e5368aead642402db577bcb33cc3d

SHA512
23659fb32dff24b17caffaf94133dac253ccde16ea1ad4d378563b16e99cb10b3d7e9dacf1b95911cd54a2cad4710e48c109ab73796b954cd20844833d3a7c46

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\Downloads\NJRat (1).exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 29722.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 344275.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 740040.crdownload

Filesize
125KB

MD5
ea534626d73f9eb0e134de9885054892

SHA1
ab03e674b407aecf29c907b39717dec004843b13

SHA256
322eb96fc33119d8ed21b45f1cd57670f74fb42fd8888275ca4879dce1c1511c

SHA512
c8cda90323fd94387a566641ec48cb086540a400726032f3261151afe8a981730688a4dcd0983d9585355e22833a035ef627dbd1f643c4399f9ddce118a3a851

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 829754.crdownload

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot (1).exe:Zone.Identifier

Filesize
279B

MD5
bcb9707609402e88d489700b2c4423bb

SHA1
2802c23988f9265ca8c7e006f4146ee2e7f41852

SHA256
76ae0452592aaa11423e45674fb6259abde8e126993fc791ed988b8fc222b7ae

SHA512
7f951e192e940b5de9faa0d4bc95cfdd0860ffb9e8a342e2235d6f38badc72c2993aa266f6146f998bd3d1b87b43d921be905cce7c5614886c0ab9e6df4791ab

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\metrofax.doc

Filesize
221KB

MD5
28e855032f83adbd2d8499af6d2d0e22

SHA1
6b590325e2e465d9762fa5d1877846667268558a

SHA256
b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e

SHA512
e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34

Download Submit
memory/328-4326-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1380-3223-0x000002089C7D0000-0x000002089C7EE000-memory.dmp

Filesize
120KB

Download
memory/1916-2128-0x00007FFF050E0000-0x00007FFF05396000-memory.dmp

Filesize
2.7MB

Download
memory/1916-2129-0x0000020576E50000-0x0000020577F00000-memory.dmp

Filesize
16.7MB

Download
memory/1916-2126-0x00007FF716190000-0x00007FF716288000-memory.dmp

Filesize
992KB

Download
memory/1916-2127-0x00007FFF09C70000-0x00007FFF09CA4000-memory.dmp

Filesize
208KB

Download
memory/2184-1683-0x0000000005380000-0x0000000005926000-memory.dmp

Filesize
5.6MB

Download
memory/2184-1686-0x0000000005060000-0x00000000050B6000-memory.dmp

Filesize
344KB

Download
memory/2184-1682-0x0000000004D30000-0x0000000004DCC000-memory.dmp

Filesize
624KB

Download
memory/2184-1684-0x0000000004E70000-0x0000000004F02000-memory.dmp

Filesize
584KB

Download
memory/2184-1685-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Filesize
40KB

Download
memory/2184-1681-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download
memory/2348-3044-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/2348-3046-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/2348-3049-0x00007FFED1FE0000-0x00007FFED1FF0000-memory.dmp

Filesize
64KB

Download
memory/2348-3048-0x00007FFED1FE0000-0x00007FFED1FF0000-memory.dmp

Filesize
64KB

Download
memory/2348-3047-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/2348-3045-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/2348-3043-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/2688-3262-0x000002CF238D0000-0x000002CF241E4000-memory.dmp

Filesize
9.1MB

Download
memory/3032-3454-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/3032-3453-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/3032-3452-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/3032-3451-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/3288-4258-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3288-4247-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4556-3083-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/4748-3060-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4748-3059-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4748-3058-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4748-3057-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4960-3330-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4960-3335-0x00007FFED3B80000-0x00007FFED3B90000-memory.dmp

Filesize
64KB

Download
memory/4960-3334-0x00007FFED3B80000-0x00007FFED3B90000-memory.dmp

Filesize
64KB

Download
memory/4960-3333-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4960-3332-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4960-3331-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/4960-3329-0x00007FFED47B0000-0x00007FFED47C0000-memory.dmp

Filesize
64KB

Download
memory/6072-4226-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6072-4222-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads